How to enable host-level SNMP monitoring through Nagios

SNMP Configuration

Dependencies
Log on to a TIE Server appliance and install the base SNMP packages available in /apps. Follow the recommended steps for configuration.
Install Packages
For TIE Server 2.1.0:
Download the RPMs attached to this article and copy them to the appliance. For example, to the home of the admin user, assuming it is /home/admin.

cd /home/admin
rpm -Uvh net-snmp-libs-5.5-60.mlos2.x86_64.rpm net-snmp-5.5-60.mlos2.x86_64.rpm net-snmp-utils-5.5-60.mlos2.x86_64.rpm

For TIE Server up to 2.0.0:
NOTE: Upgrade to the latest version, if possible.

cd /apps
rpm -ivh net-snmp-5.5-54.mlos2.x86_64.rpm net-snmp-utils-5.5-54.mlos2.x86_64.rpm
Configuration
Configure the SNMP service according to your monitoring needs, and then restart the service. The actual configuration is specific to each environment and monitoring approach. The same context ID must be used when remotely accessing SNMP data to secure the exchange. Run the following commands on the appliance:

# SNMP configuration
cp /etc/snmp/snmpd.conf /etc/snmp/snmpd.conf.backup

For SNMP v2c:

vi /etc/snmp/snmpd.conf

Replace /etc/snmp/snmpd.conf content with the following example configuration:

# Map 'idv90we3rnov90wer' community to the 'ConfigUser'
# Map '209ijvfwer0df92jd' community to the 'AllUser'
# sec.name source community
com2sec ConfigUser default idv90we3rnov90wer
com2sec AllUser default 209ijvfwer0df92jd

# Map 'ConfigUser' to 'ConfigGroup' for SNMP Version 2c
# Map 'AllUser' to 'AllGroup' for SNMP Version 2c
# sec.model sec.name
group ConfigGroup v2c ConfigUser
group AllGroup v2c AllUser

# Define 'SystemView', which includes everything under .1.3.6.1.2.1.1 (or .1.3.6.1.2.1.25.1)
# Define 'AllView', which includes everything under .1
# incl/excl subtree
view SystemView included .1.3.6.1.2.1.1
view SystemView included .1.3.6.1.2.1.25.1.1
view AllView included .1

# Give 'ConfigGroup' read access to objects in the view 'SystemView'
# Give 'AllGroup' read access to objects in the view 'AllView'
# context model level prefix read write notify
access ConfigGroup "" any noauth exact SystemView none none
access AllGroup "" any noauth exact AllView none none
dontLogTCPWrappersConnects yes

For SNMP v3:
1. Stop the snmp service if it is running:
  
  service snmpd stop
2. Create two different users, which have different visibility of the MIB tree:
  
  net-snmp-create-v3-user -ro -A "AUTHENTICATION_PASSWORD" -X "ENCRYPTION_PASSWORD" -a SHA -x AES TIESnmpRoUser
  
  net-snmp-create-v3-user -ro -A "ADMIN_AUTHENTICATION_PASSWORD" -X "ADMIN_ENCRYPTION_PASSWORD" -a SHA -x AES TIESnmpRoAdmin
3. Replace the AUTHENTICATION_PASSWORD, ENCRYPTION_PASSWORD, ADMIN_AUTHENTICATION_PASSWORD and ADMIN_ENCRYPTION_PASSWORD with strong passwords or passphrases, to be used for authentication and encryption.
  
  vi /etc/snmp/snmpd.conf
4. Replace /etc/snmp/snmpd.conf content with the following example configuration:
  
  rouser TIESnmpRoUser priv .1.3.6.1.2.1.1
  rouser TIESnmpRoUser priv .1.3.6.1.2.1.25.1.1
  rouser TIESnmpRoAdmin priv .1
  dontLogTCPWrappersConnects yes

Firewall Configuration

Configuration
Run the following commands on the appliance:

# Add rule to iptables
cp /etc/sysconfig/iptables /etc/sysconfig/iptables.backup
vi /etc/sysconfig/iptables
# make sure to add the line
-A TIE -p udp -m udp --dport 161 -j ACCEPT
Service Restart
Run the following commands on the appliance:

# Enable service
chkconfig snmpd on
# Restart services
service iptables restart
service snmpd restart
Testing
Test locally in the appliance, by running the following commands:

# show monitoring information
snmpwalk -v 2c -c idv90we3rnov90wer -O e 127.0.0.1
# show monitoring information
snmpwalk -v 2c -c 209ijvfwer0df92jd -O e 127.0.0.1

NOTE: In a typical TIE appliance, the default output of the last command is several pages long. It provides a large amount of information that might be useful, according to each deployment's needs.

Nagios Integration

Nagios Configuration
To use SNMP from Nagios, configure a remote check using check scripts available as part of the Nagios Plugins package. The procedure to include the checks as part of Nagios monitoring server is standard for any other Linux distributions. The following is an example of what must be configured on the Nagios monitoring server, and not the TIE appliance:

define service {
use generic-service
host_name TIE1
service_description CPU 0 Load
normal_check_interval 1
retry_check_interval 1
check_command check_snmp! -o iso.3.6.1.2.1.25.3.3.1.2.196608 -P2c -C 209ijvfwer0df92jd -m '' -w 75 -c 90
}

IMPORTANT: Nagios Remote Plugin Execute (NRPE) integration is not supported because it requires dependency installations inside the appliance.
Nagios Remote Check Testing
To test that the integration is working, you can remotely run the following command on the Nagios monitoring server using the check_snmp script:

./check_snmp -H $APPLIANCE -c 209ijvfwer0df92jd -o SNMPv2-MIB::sysUpTime.0
SNMP OK - *695875* | DISMAN-EVENT-MIB::sysUpTimeInstance=695875;;209ijvfwer0df92jd;;209;

NOTE: The check_snmp script is only available if both net-snmp-perl and net-snmp-utils packages are available in the monitoring system while the Nagios Plugins is built.

The capabilities of the script are documented at https://linux.die.net/man/1/snmpcheck.

When properly configured, Nagios monitors the TIE Server appliance as follows:

How to enable host-level SNMP monitoring through Nagios

Environment

Summary

Attachment

Affected Products

Glossary of Technical Terms

Title

Title

Featured Solutions:Draft for New Nav

Explore Our Portfolio

Security Outcomes

Industries

Products

Featured Solutions

Explore Our Portfolio

MVISION Products

Services & Training

Threat Research

Our Researchers

Threat Landscape Dashboard

Tools

Contact Us

Resources

Downloads

Product Help

Connect with Us

Explore

Our Company

Our Efforts

Other Resources

Careers

Partnerships

How to enable host-level SNMP monitoring through Nagios

Environment

Summary

Attachment

Affected Products

Glossary of Technical Terms

Choose your region

Title

Title