XIQ-SE SNMP Configuration for zabbix access

[Jochen]

Hi all

We have a Zabbix Server for collect snmp information.
We have the problem that zabbix cannot connct with snmpv3 credentials to xiq-se.

The first time zabbix can connect but after a while we see with "service snmpd status" that Athentication failed for snmpuser. I checked the snmpv3 credentials twice.

Have everyone done the same or with an other snmp collector?
Or did we have change some configuration at snmpd.conf?

Thanks for some advice.

Jochen

[Jochen]

Hi all

Now it works. I have customized the SNMP credentials. Certain special characters do not seem to work. But snmpwalk with the same snmp credentials will not work.

Thanks for your assistance. Jochen

[Robert_Haynes]

If you are using snmpwalk on the command line w/ special characters make sure you quote them. Characters like ! and & and the like have special meaning in bash/shell that unquoted can be misinterpreted.

[Markus_Nikulski · Accepted solution]

If you are lost with a topic, go back to the basic checks.

 1.  check what you have initially configured
cat /usr/postinstall/snmpconfig.properties

2. check the SNMP daemon settings
nano /etc/snmp/snmpd.conf

3. check if the SNMP daemon running
ss -lnup | grep 161

4. use LINUX generic tools to check the service
snmpwalk -v 3 -l authPriv -u snmpuser -a MD5 -A snmpauthcred -x DES -X snmpprivcred 10.8.255.5 iso.3.6.1.2.1.1

5. go back to your application vendor and open a ticket

thanks
Markus 

[Jochen]

Hi Markus

I did your your checks.

1.  Are the same what I configured with snmpconfig.

2. I'm not shure if this config are correct. SNMP credentials are removed in this file.

###########################################################################
#
# snmpd.conf
#
###########################################################################
# SECTION: Access Control Setup
#
#   This section defines who is allowed to talk to your running
#   snmp agent.
#
# The following needs to be enabled to utilize OID trap monitoring.
# Must be the same as rouser.

agentSecName netsight-wa

# allow IPv6 connections if they are supported
agentaddress udp6:161
agentaddress udp:161

# rwuser: a SNMPv3 read-write user
#   arguments:  user [noauth|auth|priv] [restriction_oid]
#
# This setting needs to be set if you are using snmp v3 but is not necessary
# for netsight.

rwuser snmpuser
createUser snmpuser SHA xxxxxxx AES xxxxxxxxxxxx

# rouser: a SNMPv3 read-only user
#   arguments:  user [noauth|auth|priv] [restriction_oid]
#
# The following needs to be on to enable OID trap monitors.
# Must be the same as authSecUser.

rouser netsight-wa

# rocommunity: a SNMPv1/SNMPv2c read-only access community name
#   arguments:  community [default|hostname|network/bits] [oid]
#
# Please change this to your Read Only(public) community and IP address(s)
# allowed to connect.

#rocommunity public

# rwcommunity: a SNMPv1/SNMPv2c read-write access community name
#   arguments:  community [default|hostname|network/bits] [oid]
#
# Please change this to your Read Write(private) community and IP address(s)
# allowed to connect.

#rwcommunity public

###########################################################################
# SECTION: Monitor Various Aspects of the Running Host
#
#   The following check up on various aspects of a host.

# proc: Check for processes that should be running.
#     proc NAME [MAX=0] [MIN=0]
#
#     NAME:  the name of the process to check for.  It must match
#            exactly (ie, http will not find httpd processes).
#     MAX:   the maximum number allowed to be running.  Defaults to 0.
#     MIN:   the minimum number to be running.  Defaults to 0.
#
#   The results are reported in the prTable section of the UCD-SNMP-MIB tree
#   Special Case:  When the min and max numbers are both 0, it assumes
#   you want a max of infinity and a min of 1.
#---------------------------------------------------------------------------
#
# APP Specific Changes:
#
# The following proc listings should be uncommented based on what type
# of appliance you have installed.  The easiest way to determine
# which to use(at this point - it will be automated for final release)
# is to make sure netsight is started and issue a 'ps ax|grep -i netsight'
# and uncomment the processes listed in that output. If you install netsight
# into a directory other than /opt/netsight, you must change the following
# accordingly.
#--------------------------------------------------------------------------

# disk: Check for disk space usage of a partition.
#   The agent can check the amount of available disk space, and make
#   sure it is above a set limit.
#
#    disk PATH [MIN=100000]
#
#    PATH:  mount path to the disk in question.
#    MIN:   Disks with space below this value will have the Mib's errorFlag set.
#           Can be a raw byte value or a percentage followed by the %
#           symbol.  Default value = 100000.
#
#   The results are reported in the dskTable section of the UCD-SNMP-MIB tree
#

disk /

# load: Check for unreasonable load average values.
#   Watch the load average levels on the machine.
#
#    load [1MAX=12.0] [5MAX=12.0] [15MAX=12.0]
#
#    1MAX:   If the 1 minute load average is above this limit at query
#            time, the errorFlag will be set.
#    5MAX:   Similar, but for 5 min average.
#    15MAX:  Similar, but for 15 min average.
#
#   The results are reported in the laTable section of the UCD-SNMP-MIB tree

load  5 5 5

###########################################################################
# SECTION: System Information Setup
#
#   This section defines some of the information reported in
#   the "system" mib group in the mibII tree.

# syslocation: The [typically physical] location of the system.
#   Note that setting this value here means that when trying to
#   perform an snmp SET operation to the sysLocation.0 variable will make
#   the agent return the "notWritable" error code.  IE, including
#   this token in the snmpd.conf file will disable write access to
#   the variable.
#   arguments:  location_string
#

# syslocation

# syscontact: The contact information for the administrator
#   Note that setting this value here means that when trying to
#   perform an snmp SET operation to the sysContact.0 variable will make
#   the agent return the "notWritable" error code.  IE, including
#   this token in the snmpd.conf file will disable write access to
#   the variable.
#   arguments:  contact_string
#

# syscontact

# sysservices: The proper value for the sysServices object.
#   arguments:  sysservices_number

sysservices 12

# sysobjectid: Sets  the  system  description or object ID for the
#    agent.   Although  these  values  are   not   SNMP-
#    writable, it is conceivable that a network adminis-
#    trator may wish  to  configure  them  to  something
#    other than the default values.

# We need to modify the object id based upon which device they
# selected.
sysobjectid .1.3.6.1.4.1.1916.2.249

sysdescr ExtremeCloud IQ - Site Engine Appliance - Version 24.10.12.14

###########################################################################
# SECTION: Trap Destinations
#
#   Here we define who the agent will send traps to.

# trapsink: A SNMPv1 trap receiver
#   arguments: host [community] [portnum]
#
# Please change this to the IP address of your snmp trap server and community

#trapsink  public

# trap2sink: A SNMPv2c trap receiver
#   arguments: host [community] [portnum]
#
# Please change this to the IP address of your snmp trap server and community

# trap2sink  public

# informsink: A SNMPv2c inform (acknowledged trap) receiver
#   arguments: host [community] [portnum]
#
# Please uncomment the informsink line if you want to use acknowledged traps.
# If uncommented, please change the IP address and community string to
# those of your inform receiver and community.

#informsink 0.0.0.0 public

# trapcommunity: Default trap sink community to use
#   arguments: community-string
#
# Please change trapcommunity to match the trap sink community on your network.

trapcommunity  public

# authtrapenable: Should we send traps when authentication failures occur
#   arguments: 1 | 2   (1 = yes, 2 = no)

authtrapenable  1

# Disable TCP Wrapper connect messages
dontLogTCPWrappersConnects 1

#-----------------------------------------------------------------------------
#
# Monitors For Traps
#
#-----------------------------------------------------------------------------

#defaultMonitors yes
#monitor -r 300 -o ifDescr "Interface Down" ifOperStatus != 1
#monitor -r 300 -o ifDescr "Interface Inbound Errors" ifInErrors != 0
#monitor -r 300 -o ifDescr "Interface Outbound Errors" ifOutErrors != 0
#monitor -r 300 "Available Real Memory Low" memAvailReal > 65535
#monitor -r 300 "Available Swap Memory Low" memAvailSwap > 65535
#monitor -r 300 "Available Disk Space Low" dskPercent > 20
#monitor -r 300 "Available Inodes Low" dskPercentNode > 10
#monitor -r 300 "High CPU Utilization" ssCpuIdle > 10

  3. Get the message "Authentication failure (incorrect password, community or key)", but the snmp credentials are right.