EXOS SNMP filter

  • 12 January 2016
  • 9 replies
  • 375 views

Hi,
is it possible to filter snmp message from EXOS?
I want to do a snmpbulkwalk to a switch with more than 800 VLAN's. The snmpbulkwalk need more than 5 minutes. This is fatal for my rrd graphs.
Can I dismiss all VLANs (IF-MIB::ifDescr.1000001 ... >1000000) so that the bulkwalk doesn't get this informations?

9 replies

Userlevel 5
I'm not sure if you can teach EXOS to limit SNMP replies, but have you considered playing with "-Cn" and "-Cr" in snmpbulkwalk /snmpbulkget ? (See http://www.uow.edu.au/~blane/netapp/ontap/nag/networking/concept/c_oc_netw_snmp_command_examples.htm... in addition to the man-page)

Also, if you're using Cacti for your graphs, I presume you've already switched to "spine" as your poller?
And here's a "limit OIDs / tune cacti" page that I should probably implement to some extent as well: http://realworldnumbers.com/cacti-tuning-how-to-set-maximum-oids-per-get-request/

HTH,

Frank
Thanks for your fast feedback. I want to use observium and still tried the -Cr option. But the snmp request dies after some seconds with following message:

Error in packet.Reason: (tooBig) Response message would have been too large.
Userlevel 5
Thanks for your fast feedback. I want to use observium and still tried the -Cr option. But the snmp request dies after some seconds with following message:

Error in packet.Reason: (tooBig) Response message would have been too large.
Ah, Observium 🙂 I've played with that as well - and yes, it seems to want to query *EVERYTHING* on the devices, and I have noticed it takes a while on its queries. I may have to revisit that, but that might take me a bit, as I'm not using it actively in production.
Userlevel 6
Thanks for your fast feedback. I want to use observium and still tried the -Cr option. But the snmp request dies after some seconds with following message:

Error in packet.Reason: (tooBig) Response message would have been too large.
You may want to consider using the LibreNMS fork of Observium, the developers would be interested in your bug.
Thanks for your fast feedback. I want to use observium and still tried the -Cr option. But the snmp request dies after some seconds with following message:

Error in packet.Reason: (tooBig) Response message would have been too large.
@Frank - observium is very helpful but it is only usable if the snmp poller need less than 5 minutes :/
@ James - thank you very much for this notice. I will try this tool asap.
Thanks for your fast feedback. I want to use observium and still tried the -Cr option. But the snmp request dies after some seconds with following message:

Error in packet.Reason: (tooBig) Response message would have been too large.
I tried librenms but it's the same poller mechanism as observium uses it.
Userlevel 6
Thanks for your fast feedback. I want to use observium and still tried the -Cr option. But the snmp request dies after some seconds with following message:

Error in packet.Reason: (tooBig) Response message would have been too large.
It is currently the same, but the LibreNMS community is more likely to see it as a problem to fix than the Observium developer.
Userlevel 7
Chris,
Check the output of
code:
show management
. You're looking for these lines near the bottom:
SNMP Compatibility Options :
GETBULK Reply Too Big Action : Too Big Error
IP Fragmentation : Disallow[/code]The "GETBULK Reply Action" is configurable with this option:
X460-24t.2 # configure snmp compatibility get-bulk reply-too-big-action
standard Generate a response as per the standard
too-big-error Generate a 'too big error' response (Default)[/code]Note that these large responses can potentially bog down the switch while being generated and transmitted... you may want to first test in a lab or other controlled environment.

-Drew
Chris,
Check the output of
code:
show management
. You're looking for these lines near the bottom:
SNMP Compatibility Options :
GETBULK Reply Too Big Action : Too Big Error
IP Fragmentation : Disallow[/code]The "GETBULK Reply Action" is configurable with this option:
X460-24t.2 # configure snmp compatibility get-bulk reply-too-big-action
standard Generate a response as per the standard
too-big-error Generate a 'too big error' response (Default)[/code]Note that these large responses can potentially bog down the switch while being generated and transmitted... you may want to first test in a lab or other controlled environment.

-Drew
Hi Drew, thanks for your answer.
This would be helpful. 🙂

Reply