XIQ-SE SNMP Configuration for zabbix access

Jochen — Tue, 10 Jun 2025 12:17:48 GMT

Hi all

We have a Zabbix Server for collect snmp information.
We have the problem that zabbix cannot connct with snmpv3 credentials to xiq-se.

The first time zabbix can connect but after a while we see with "service snmpd status" that Athentication failed for snmpuser. I checked the snmpv3 credentials twice.

Have everyone done the same or with an other snmp collector?
Or did we have change some configuration at snmpd.conf?

Thanks for some advice.

Jochen

Re: XIQ-SE SNMP Configuration for zabbix access

Robert_Haynes — Tue, 10 Jun 2025 12:32:42 GMT

I would be curious -- how does this issue resolve itself? Do you take action?

You can always take a tcpdump trace and observe the SNMP transaction flow and when the issue re-appears can decode the trace (assuming SNMPv3) to confirm if the payloads continue to be encoded properly and which endpoint essentially stops playing nice.

Site Engine inventoried to itself (as numerous customers do) or via third party tools AFAIK has never been reported (until now) as failing local SNMP. I would suspect that if the service output is reporting that authentication failed for snmpuser that the originator (Zabbix) is the problem point and is not properly encoding requests...

Re: XIQ-SE SNMP Configuration for zabbix access

Markus_Nikulski — Tue, 10 Jun 2025 13:51:41 GMT

If you are lost with a topic, go back to the basic checks.

1. check what you have initially configured
cat /usr/postinstall/snmpconfig.properties

2. check the SNMP daemon settings
nano /etc/snmp/snmpd.conf

3. check if the SNMP daemon running
ss -lnup | grep 161

4. use LINUX generic tools to check the service
snmpwalk -v 3 -l authPriv -u snmpuser -a MD5 -A snmpauthcred -x DES -X snmpprivcred 10.8.255.5 iso.3.6.1.2.1.1

5. go back to your application vendor and open a ticket

thanks
Markus

Re: XIQ-SE SNMP Configuration for zabbix access

Jochen — Thu, 12 Jun 2025 10:19:00 GMT

Hi Markus

I did your your checks.

1. Are the same what I configured with snmpconfig.

2. I'm not shure if this config are correct. SNMP credentials are removed in this file.

########################################################################### # # snmpd.conf # ########################################################################### # SECTION: Access Control Setup # # This section defines who is allowed to talk to your running # snmp agent. # # The following needs to be enabled to utilize OID trap monitoring. # Must be the same as rouser. agentSecName netsight-wa # allow IPv6 connections if they are supported agentaddress udp6:161 agentaddress udp:161 # rwuser: a SNMPv3 read-write user # arguments: user [noauth|auth|priv] [restriction_oid] # # This setting needs to be set if you are using snmp v3 but is not necessary # for netsight. rwuser snmpuser createUser snmpuser SHA xxxxxxx AES xxxxxxxxxxxx # rouser: a SNMPv3 read-only user # arguments: user [noauth|auth|priv] [restriction_oid] # # The following needs to be on to enable OID trap monitors. # Must be the same as authSecUser. rouser netsight-wa # rocommunity: a SNMPv1/SNMPv2c read-only access community name # arguments: community [default|hostname|network/bits] [oid] # # Please change this to your Read Only(public) community and IP address(s) # allowed to connect. #rocommunity public # rwcommunity: a SNMPv1/SNMPv2c read-write access community name # arguments: community [default|hostname|network/bits] [oid] # # Please change this to your Read Write(private) community and IP address(s) # allowed to connect. #rwcommunity public ########################################################################### # SECTION: Monitor Various Aspects of the Running Host # # The following check up on various aspects of a host. # proc: Check for processes that should be running. # proc NAME [MAX=0] [MIN=0] # # NAME: the name of the process to check for. It must match # exactly (ie, http will not find httpd processes). # MAX: the maximum number allowed to be running. Defaults to 0. # MIN: the minimum number to be running. Defaults to 0. # # The results are reported in the prTable section of the UCD-SNMP-MIB tree # Special Case: When the min and max numbers are both 0, it assumes # you want a max of infinity and a min of 1. #--------------------------------------------------------------------------- # # APP Specific Changes: # # The following proc listings should be uncommented based on what type # of appliance you have installed. The easiest way to determine # which to use(at this point - it will be automated for final release) # is to make sure netsight is started and issue a 'ps ax|grep -i netsight' # and uncomment the processes listed in that output. If you install netsight # into a directory other than /opt/netsight, you must change the following # accordingly. #-------------------------------------------------------------------------- # disk: Check for disk space usage of a partition. # The agent can check the amount of available disk space, and make # sure it is above a set limit. # # disk PATH [MIN=100000] # # PATH: mount path to the disk in question. # MIN: Disks with space below this value will have the Mib's errorFlag set. # Can be a raw byte value or a percentage followed by the % # symbol. Default value = 100000. # # The results are reported in the dskTable section of the UCD-SNMP-MIB tree # disk / # load: Check for unreasonable load average values. # Watch the load average levels on the machine. # # load [1MAX=12.0] [5MAX=12.0] [15MAX=12.0] # # 1MAX: If the 1 minute load average is above this limit at query # time, the errorFlag will be set. # 5MAX: Similar, but for 5 min average. # 15MAX: Similar, but for 15 min average. # # The results are reported in the laTable section of the UCD-SNMP-MIB tree load 5 5 5 ########################################################################### # SECTION: System Information Setup # # This section defines some of the information reported in # the "system" mib group in the mibII tree. # syslocation: The [typically physical] location of the system. # Note that setting this value here means that when trying to # perform an snmp SET operation to the sysLocation.0 variable will make # the agent return the "notWritable" error code. IE, including # this token in the snmpd.conf file will disable write access to # the variable. # arguments: location_string # # syslocation # syscontact: The contact information for the administrator # Note that setting this value here means that when trying to # perform an snmp SET operation to the sysContact.0 variable will make # the agent return the "notWritable" error code. IE, including # this token in the snmpd.conf file will disable write access to # the variable. # arguments: contact_string # # syscontact # sysservices: The proper value for the sysServices object. # arguments: sysservices_number sysservices 12 # sysobjectid: Sets the system description or object ID for the # agent. Although these values are not SNMP- # writable, it is conceivable that a network adminis- # trator may wish to configure them to something # other than the default values. # We need to modify the object id based upon which device they # selected. sysobjectid .1.3.6.1.4.1.1916.2.249 sysdescr ExtremeCloud IQ - Site Engine Appliance - Version 24.10.12.14 ########################################################################### # SECTION: Trap Destinations # # Here we define who the agent will send traps to. # trapsink: A SNMPv1 trap receiver # arguments: host [community] [portnum] # # Please change this to the IP address of your snmp trap server and community #trapsink public # trap2sink: A SNMPv2c trap receiver # arguments: host [community] [portnum] # # Please change this to the IP address of your snmp trap server and community # trap2sink public # informsink: A SNMPv2c inform (acknowledged trap) receiver # arguments: host [community] [portnum] # # Please uncomment the informsink line if you want to use acknowledged traps. # If uncommented, please change the IP address and community string to # those of your inform receiver and community. #informsink 0.0.0.0 public # trapcommunity: Default trap sink community to use # arguments: community-string # # Please change trapcommunity to match the trap sink community on your network. trapcommunity public # authtrapenable: Should we send traps when authentication failures occur # arguments: 1 | 2 (1 = yes, 2 = no) authtrapenable 1 # Disable TCP Wrapper connect messages dontLogTCPWrappersConnects 1 #----------------------------------------------------------------------------- # # Monitors For Traps # #----------------------------------------------------------------------------- #defaultMonitors yes #monitor -r 300 -o ifDescr "Interface Down" ifOperStatus != 1 #monitor -r 300 -o ifDescr "Interface Inbound Errors" ifInErrors != 0 #monitor -r 300 -o ifDescr "Interface Outbound Errors" ifOutErrors != 0 #monitor -r 300 "Available Real Memory Low" memAvailReal > 65535 #monitor -r 300 "Available Swap Memory Low" memAvailSwap > 65535 #monitor -r 300 "Available Disk Space Low" dskPercent > 20 #monitor -r 300 "Available Inodes Low" dskPercentNode > 10 #monitor -r 300 "High CPU Utilization" ssCpuIdle > 10

3. Get the message "Authentication failure (incorrect password, community or key)", but the snmp credentials are right.

Re: XIQ-SE SNMP Configuration for zabbix access

Jochen — Thu, 12 Jun 2025 11:42:04 GMT

Hi all

Now it works. I have customized the SNMP credentials. Certain special characters do not seem to work. But snmpwalk with the same snmp credentials will not work.

Thanks for your assistance. Jochen

Re: XIQ-SE SNMP Configuration for zabbix access

Robert_Haynes — Thu, 12 Jun 2025 12:12:23 GMT

If you are using snmpwalk on the command line w/ special characters make sure you quote them. Characters like ! and & and the like have special meaning in bash/shell that unquoted can be misinterpreted.

Re: XIQ-SE SNMP Configuration for zabbix access

Markus_Nikulski — Thu, 12 Jun 2025 12:35:11 GMT

I guess you mean 4 instead of 3.

If you get an error it means the SNMP daemon is not in the right place.

topic Re: XIQ-SE SNMP Configuration for zabbix access in ExtremeCloud IQ- Site Engine Management Center

XIQ-SE SNMP Configuration for zabbix access

Re: XIQ-SE SNMP Configuration for zabbix access

Re: XIQ-SE SNMP Configuration for zabbix access

Re: XIQ-SE SNMP Configuration for zabbix access

Re: XIQ-SE SNMP Configuration for zabbix access

Re: XIQ-SE SNMP Configuration for zabbix access

Re: XIQ-SE SNMP Configuration for zabbix access