EXOS SNMP filter


Hi,
is it possible to filter snmp message from EXOS?
I want to do a snmpbulkwalk to a switch with more than 800 VLAN's. The snmpbulkwalk need more than 5 minutes. This is fatal for my rrd graphs.
Can I dismiss all VLANs (IF-MIB::ifDescr.1000001 ... >1000000) so that the bulkwalk doesn't get this informations?

9 replies

Userlevel 5
I'm not sure if you can teach EXOS to limit SNMP replies, but have you considered playing with "-Cn" and "-Cr" in snmpbulkwalk /snmpbulkget ? (See http://www.uow.edu.au/~blane/netapp/ontap/nag/networking/concept/c_oc_netw_snmp_command_examples.htm... in addition to the man-page)

Also, if you're using Cacti for your graphs, I presume you've already switched to "spine" as your poller?
And here's a "limit OIDs / tune cacti" page that I should probably implement to some extent as well: http://realworldnumbers.com/cacti-tuning-how-to-set-maximum-oids-per-get-request/

HTH,

Frank
Thanks for your fast feedback. I want to use observium and still tried the -Cr option. But the snmp request dies after some seconds with following message:

Error in packet.Reason: (tooBig) Response message would have been too large.
Userlevel 5
Chris wrote:

Thanks for your fast feedback. I want to use observium and still tried the -Cr option. But the snmp request dies after some seconds with following message:

Error in packet.Reason: (tooBig) Response message would have been too large.

Ah, Observium 🙂 I've played with that as well - and yes, it seems to want to query *EVERYTHING* on the devices, and I have noticed it takes a while on its queries. I may have to revisit that, but that might take me a bit, as I'm not using it actively in production.
Userlevel 6
Chris wrote:

Thanks for your fast feedback. I want to use observium and still tried the -Cr option. But the snmp request dies after some seconds with following message:

Error in packet.Reason: (tooBig) Response message would have been too large.

You may want to consider using the LibreNMS fork of Observium, the developers would be interested in your bug.
Chris wrote:

Thanks for your fast feedback. I want to use observium and still tried the -Cr option. But the snmp request dies after some seconds with following message:

Error in packet.Reason: (tooBig) Response message would have been too large.

@Frank - observium is very helpful but it is only usable if the snmp poller need less than 5 minutes :/
@ James - thank you very much for this notice. I will try this tool asap.
Chris wrote:

Thanks for your fast feedback. I want to use observium and still tried the -Cr option. But the snmp request dies after some seconds with following message:

Error in packet.Reason: (tooBig) Response message would have been too large.

I tried librenms but it's the same poller mechanism as observium uses it.
Userlevel 6
Chris wrote:

Thanks for your fast feedback. I want to use observium and still tried the -Cr option. But the snmp request dies after some seconds with following message:

Error in packet.Reason: (tooBig) Response message would have been too large.

It is currently the same, but the LibreNMS community is more likely to see it as a problem to fix than the Observium developer.
Userlevel 7
Chris,
Check the output of
code:
show management
. You're looking for these lines near the bottom:
SNMP Compatibility Options :
GETBULK Reply Too Big Action : Too Big Error
IP Fragmentation : Disallow[/code]The "GETBULK Reply Action" is configurable with this option:
X460-24t.2 # configure snmp compatibility get-bulk reply-too-big-action
standard Generate a response as per the standard
too-big-error Generate a 'too big error' response (Default)[/code]Note that these large responses can potentially bog down the switch while being generated and transmitted... you may want to first test in a lab or other controlled environment.

-Drew
Drew C. wrote:

Chris,
Check the output of

code:
show management
. You're looking for these lines near the bottom:
SNMP Compatibility Options :
GETBULK Reply Too Big Action : Too Big Error
IP Fragmentation : Disallow[/code]The "GETBULK Reply Action" is configurable with this option:
X460-24t.2 # configure snmp compatibility get-bulk reply-too-big-action
standard Generate a response as per the standard
too-big-error Generate a 'too big error' response (Default)[/code]Note that these large responses can potentially bog down the switch while being generated and transmitted... you may want to first test in a lab or other controlled environment.

-Drew

Hi Drew, thanks for your answer.
This would be helpful. 🙂

Reply