Contact our honeypot department if you are desperate to get blacklisted.
Showing posts with label SNMP. Show all posts
Showing posts with label SNMP. Show all posts

Tuesday, September 20, 2011

Displaying Interface descriptions in SNMP traps using SNMPTT's PREXEC funtion

I collect snmp traps via snmptrapd which then hands them off to snmptt. Upon receipt of an interface down/up trap (.1.3.6.1.6.3.1.1.5.3, for example) snmptt then runs a quick snmpget request (unfortunately using SNMPv1 at the moment) to the reporting host to pull the description for the given interface like so:
EVENT ciscoConfigManEventDN .1.3.6.1.6.3.1.1.5.3 "Status Events" Normal
# use snmpget to fetch the interface description and save it as $p1, to be used it the FORMAT line.
PREEXEC /usr/bin/snmpget -v 1 -t 2 -Ovq -c snmptt $aA ifAlias.$1
FORMAT Link DOWN $2 - $p1
# OPTIONAL: do not process this event for VI interfaces (like PPPoE interfaces)
MATCH $2:!(Virtual-Access)
MATCH $2:!(Multilink)
MATCH MODE=and
#
EXEC /root/bin/sendemail.sh high traps@mydomain.com "ALERT-$s-$R-$Fz" "Agent $A at $aA reports $Fz$FnTrap $e:$D$Fn"


Note that I've created a special SNMP VIEW and community one our routers which allow access only to the ifAlias.* OID tree like so:
snmp-server view snmptt ifXEntry.* included
! note that ACL99 includes my snmp NMS only!
snmp-server community snmptt view snmptt RO 99

Monday, January 4, 2010

Find the IfIndex ID of a given interface

When you're using SNMP to poll a router for stats on a given interface sometimes you need to know the SNMP IfIndex ID of a given interface. It's easy (example from a 7206 running 12.4(9)T2):

router-1#show snmp mib ifmib ifindex atm1/0.1080       
Interface = ATM1/0.1080, Ifindex = 190

router-1#show snmp mib ifmib ifindex detail atm1/0.1080
Description                     ifIndex  Active  Persistent 
---------------------------------------------------------------

ATM1/0.1080-aal5 layer           190    yes      enabled