Check_snmp_int.pl for Windows 2008

Post by **srrhd** » Mon Jul 18, 2011 9:24 am

Hi,

I am trying to monitore the bandwidth of two network inrterfaces on a Windows 2008 Server. My problème is that when executing the plugins in verbose mode to get the interfaces list, i got the interesting one in hexa:

[nagiosadmin@NagiosXI]# sudo -u nagios ./check_snmp_int.pl -v -H X.X.X.X -C COMMUNITY -2 -n Conn
Alarm at 15 + 5
SNMP v2c login
Filter : Conn
OID : 1.3.6.1.2.1.2.2.1.2.1, Desc : Software Loopback Interface 1
OID : 1.3.6.1.2.1.2.2.1.2.14, Desc : Teredo Tunneling Pseudo-Interface
OID : 1.3.6.1.2.1.2.2.1.2.16, Desc : 0x4d696e69706f72742072e97365617520e974656e64752057414e202849507636292d516f53205061636b6574205363686564756c65722d3030303000
OID : 1.3.6.1.2.1.2.2.1.2.18, Desc : 0x4d696e69706f72742072e97365617520e974656e647520284d6f6e69746575722072e973656175292d516f53205061636b6574205363686564756c65722d3030303000
OID : 1.3.6.1.2.1.2.2.1.2.12, Desc : isatap.{3461D5B5-F25C-46D4-AFF8-C2C59B80AB95}
OID : 1.3.6.1.2.1.2.2.1.2.17, Desc : Miniport WAN (IP)-QoS Packet Scheduler-0000
OID : 1.3.6.1.2.1.2.2.1.2.3, Desc : 0x4d696e69706f72742072e97365617520e974656e64752057414e20284c3254502900
OID : 1.3.6.1.2.1.2.2.1.2.2, Desc : WAN Miniport (SSTP)
OID : 1.3.6.1.2.1.2.2.1.2.7, Desc : 0x4d696e69706f72742072e97365617520e974656e647520284d6f6e69746575722072e9736561752900
OID : 1.3.6.1.2.1.2.2.1.2.9, Desc : Carte asynchrone RAS
OID : 1.3.6.1.2.1.2.2.1.2.13, Desc : isatap.{F0475204-A9D4-4B75-B30E-5317F39EF385}
OID : 1.3.6.1.2.1.2.2.1.2.6, Desc : 0x4d696e69706f72742072e97365617520e974656e64752057414e2028495076362900
OID : 1.3.6.1.2.1.2.2.1.2.4, Desc : 0x4d696e69706f72742072e97365617520e974656e64752057414e2028505054502900
OID : 1.3.6.1.2.1.2.2.1.2.10, Desc : 0x436f6e6e6578696f6e2072e97365617520496e74656c2852292050524f2f31303030204d5400
OID : 1.3.6.1.2.1.2.2.1.2.15, Desc : 6TO4 Adapter
OID : 1.3.6.1.2.1.2.2.1.2.8, Desc : Miniport WAN (IP)
OID : 1.3.6.1.2.1.2.2.1.2.5, Desc : Miniport WAN (PPPOE)
OID : 1.3.6.1.2.1.2.2.1.2.11, Desc : 0x436f6e6e6578696f6e2072e97365617520496e74656c2852292050524f2f31303030204d5420233200

This is a bit annoying as the interface name appears in the plugin result.
The weird thing is that when i proceed to an snmpwalk on this branch i got the real name:

[nagiosadmin@NagiosXI]# sudo -u nagios snmpwalk -v 2c -c COMMUNITY X.X.X.X 1.3.6.1.2.1.2.2.1.2
IF-MIB::ifDescr.1 = STRING: Software Loopback Interface 1
IF-MIB::ifDescr.2 = STRING: WAN Miniport (SSTP)
IF-MIB::ifDescr.3 = STRING: Miniport réseau étendu WAN (L2TP)
IF-MIB::ifDescr.4 = STRING: Miniport réseau étendu WAN (PPTP)
IF-MIB::ifDescr.5 = STRING: Miniport WAN (PPPOE)
IF-MIB::ifDescr.6 = STRING: Miniport réseau étendu WAN (IPv6)
IF-MIB::ifDescr.7 = STRING: Miniport réseau étendu (Moniteur réseau)
IF-MIB::ifDescr.8 = STRING: Miniport WAN (IP)
IF-MIB::ifDescr.9 = STRING: Carte asynchrone RAS
IF-MIB::ifDescr.10 = STRING: Connexion réseau Intel(R) PRO/1000 MT
IF-MIB::ifDescr.11 = STRING: Connexion réseau Intel(R) PRO/1000 MT #2
IF-MIB::ifDescr.12 = STRING: isatap.{3461D5B5-F25C-46D4-AFF8-C2C59B80AB95}
IF-MIB::ifDescr.13 = STRING: isatap.{F0475204-A9D4-4B75-B30E-5317F39EF385}
IF-MIB::ifDescr.14 = STRING: Teredo Tunneling Pseudo-Interface
IF-MIB::ifDescr.15 = STRING: 6TO4 Adapter
IF-MIB::ifDescr.16 = STRING: Miniport réseau étendu WAN (IPv6)-QoS Packet Scheduler-0000
IF-MIB::ifDescr.17 = STRING: Miniport WAN (IP)-QoS Packet Scheduler-0000
IF-MIB::ifDescr.18 = STRING: Miniport réseau étendu (Moniteur réseau)-QoS Packet Scheduler-0000

Like on our others Windows Server, i tryied to specified the interface name this ways:

Code: Select all

Connexion réseau Intel\(R\) PRO/1000 MT
or
Connexion réseau Intel\\(R\\) PRO/1000 MT

Don't ask me why depending on the server i have to use one or the other.

But the result remain 'Unknow interface' while specifying the name in hexa works.

Is this a know issue with Bill's products ? Is there a way to circumvent this ?

Post by **nscott** » Mon Jul 18, 2011 10:22 am

I haven't seen that before and there isn't anything on the mailing-list that matches your problem exactly. This thread seems similar but not right on:

http://www.mail-archive.com/nagios-user ... 08635.html

Maybe check the MIB file on the offending Windows 2k8 machine and make sure its using SNMP v2. Or, could you post the output of the actual plugin you are going to run, I can certainly come up with a quick regular expression fix for you, but as far as the root of this problem, I would guess it lies with the SNMP setup on the Win 2k8 machine.

Post by **srrhd** » Tue Jul 19, 2011 7:42 am

Here is the output:

Code: Select all

[nagiosadmin@NagiosXI]# sudo -u nagios ./check_snmp_int.pl -H X.X.X.X -C COMMUNITY -2 -n "0x436f6e6e6578696f6e2072e97365617520496e74656c2852292050524f2f31303030204d5400" -fY -kBM -w 50,50 -c 70,70
0x436f6e6e6578696f6e2072e97365617520496e74656c2852292050524f2f31303030204d5400:UP No usable data on file (1 rows) :(1 UP): UNKNOWN

Concerning the thread, it says that's this issue should have been corrected since the version 1.4.1 and we are using 1.4.6:

Code: Select all

[nagiosadmin@NagiosXI]# sudo -u nagios ./check_snmp_int.pl -V
check_snmp_int version : 1.4.6

So it seems that your right concerning the SNMP agent on the W2K8, if you have any advice on configuring the SNMP agent on the server ortherwise i wait for your regex fix.

Post by **nscott** » Tue Jul 19, 2011 5:01 pm

Alright, well I've got a 'solution' that is a quick fix to your problem.

Your command should look like this:

Code: Select all

sudo -u nagios ./check_snmp_int.pl -H X.X.X.X -C COMMUNITY -2 -n "0x436f6e6e6578696f6e2072e97365617520496e74656c2852292050524f2f31303030204d5400" -fY -kBM -w 50,50 -c 70,70 | sed 's@[a-zA-Z0-9]*\(:.*\)@Connexion reseau Intel(R) PRO/1000 MT\1@'

Until I can dig through the the plugin code and find the bug, this will get the display on your web frontend to look a little prettier. You can change the 'Connexion reseau Intel(R) PRO/1000 MT' to be whatever you want, but the '\1' must stay.

Post by **srrhd** » Mon Jul 25, 2011 2:28 am

Hi Nicholas,

Your RegEx trick works like a charm. Thanks a lot.

I still got trouble with monitoring Windows Servers' Interfaces. Still on a W2K8, this time the SNMP polling provide the names in a readable way, not hexa, but the plugin keeps on returning unknow interface:

[Nagiosadmin@NagiosXI]# sudo -u nagios ./check_snmp_int.pl -v -H X.X.X.X -C COMMUNITY -2 -n HP
Alarm at 15 + 5
SNMP v2c login
Filter : HP
OID : 1.3.6.1.2.1.2.2.1.2.1, Desc : Software Loopback Interface 1
OID : 1.3.6.1.2.1.2.2.1.2.14, Desc : isatap.{B487D6C8-E410-446E-B42F-7785E5A258CB}
OID : 1.3.6.1.2.1.2.2.1.2.16, Desc : Miniport WAN (IP)-QoS Packet Scheduler-0000
OID : 1.3.6.1.2.1.2.2.1.2.18, Desc : HP NC373i Multifunction Gigabit Server Adapter-QoS Packet Scheduler-0000
Name : HP NC373i Multifunction Gigabit Server Adapter-QoS Packet Scheduler-0000, Index : 18
OID : 1.3.6.1.2.1.2.2.1.2.12, Desc : Teredo Tunneling Pseudo-Interface
OID : 1.3.6.1.2.1.2.2.1.2.17, Desc : 0x4d696e69706f727420728273656175208274656e647520284d6f6e697465757220728273656175292d516f53205061636b6574205363686564756c65722d3030303000
OID : 1.3.6.1.2.1.2.2.1.2.3, Desc : 0x4d696e69706f727420728273656175208274656e64752057414e20284c3254502900
OID : 1.3.6.1.2.1.2.2.1.2.2, Desc : WAN Miniport (SSTP)
OID : 1.3.6.1.2.1.2.2.1.2.7, Desc : 0x4d696e69706f727420728273656175208274656e647520284d6f6e6974657572207282736561752900
OID : 1.3.6.1.2.1.2.2.1.2.9, Desc : Carte asynchrone RAS
OID : 1.3.6.1.2.1.2.2.1.2.13, Desc : isatap.{135D6D0E-540B-4F9C-809B-4FE6E1FE3D50}
OID : 1.3.6.1.2.1.2.2.1.2.6, Desc : 0x4d696e69706f727420728273656175208274656e64752057414e2028495076362900
OID : 1.3.6.1.2.1.2.2.1.2.4, Desc : 0x4d696e69706f727420728273656175208274656e64752057414e2028505054502900
OID : 1.3.6.1.2.1.2.2.1.2.10, Desc : HP NC373i Multifunction Gigabit Server Adapter
Name : HP NC373i Multifunction Gigabit Server Adapter, Index : 10
OID : 1.3.6.1.2.1.2.2.1.2.15, Desc : 0x4d696e69706f727420728273656175208274656e64752057414e202849507636292d516f53205061636b6574205363686564756c65722d3030303000
OID : 1.3.6.1.2.1.2.2.1.2.8, Desc : Miniport WAN (IP)
OID : 1.3.6.1.2.1.2.2.1.2.5, Desc : Miniport WAN (PPPOE)
OID : 1.3.6.1.2.1.2.2.1.2.11, Desc : HP NC373i Multifunction Gigabit Server Adapter #2
Name : HP NC373i Multifunction Gigabit Server Adapter #2, Index : 11
HP NC373i Multifunction Gigabit Server Adapter-QoS Packet Scheduler-0000:UP, HP NC373i Multifunction Gigabit Server Adapter:UP, HP NC373i Multifunction Gigabit Server Adapter #2:UP:3 UP: OK

An snmpwalk provides the same information:

[Nagiosadmin@NagiosXI]# sudo -u nagios snmpwalk -v 2c -c COMMUNITY -Cc -t 10 X.X.X.X 1.3.6.1.2.1.2.2.1.2
IF-MIB::ifDescr.1 = STRING: Software Loopback Interface 1
IF-MIB::ifDescr.2 = STRING: WAN Miniport (SSTP)
IF-MIB::ifDescr.3 = STRING: Miniport rseau tendu WAN (L2TP)
IF-MIB::ifDescr.4 = STRING: Miniport rseau tendu WAN (PPTP)
IF-MIB::ifDescr.5 = STRING: Miniport WAN (PPPOE)
IF-MIB::ifDescr.6 = STRING: Miniport rseau tendu WAN (IPv6)
IF-MIB::ifDescr.7 = STRING: Miniport rseau tendu (Moniteur rseau)
IF-MIB::ifDescr.8 = STRING: Miniport WAN (IP)
IF-MIB::ifDescr.9 = STRING: Carte asynchrone RAS
IF-MIB::ifDescr.10 = STRING: HP NC373i Multifunction Gigabit Server Adapter
IF-MIB::ifDescr.11 = STRING: HP NC373i Multifunction Gigabit Server Adapter #2
IF-MIB::ifDescr.12 = STRING: Teredo Tunneling Pseudo-Interface
IF-MIB::ifDescr.13 = STRING: isatap.{135D6D0E-540B-4F9C-809B-4FE6E1FE3D50}
IF-MIB::ifDescr.14 = STRING: isatap.{B487D6C8-E410-446E-B42F-7785E5A258CB}
IF-MIB::ifDescr.15 = STRING: Miniport rseau tendu WAN (IPv6)-QoS Packet Scheduler-0000
IF-MIB::ifDescr.16 = STRING: Miniport WAN (IP)-QoS Packet Scheduler-0000
IF-MIB::ifDescr.17 = STRING: Miniport rseau tendu (Moniteur rseau)-QoS Packet Scheduler-0000
IF-MIB::ifDescr.18 = STRING: HP NC373i Multifunction Gigabit Server Adapter-QoS Packet Scheduler-0000

The plugin find the interface when using the regex:

[Nagiosadmin@NagiosXI]# sudo -u nagios ./check_snmp_int.pl -H X.X.X.X -C COMMUNITY -2 -n 'HP NC373i Multifunction Gigabit Server Adapter' HP NC373i Multifunction Gigabit Server Adapter-QoS Packet Scheduler-0000:UP, HP NC373i Multifunction Gigabit Server Adapter:UP, HP NC373i Multifunction Gigabit Server Adapter #2:UP:3 UP: OK

But when specifying not to use regex to get the right interface, it doesn't find the interface:

[Nagiosadmin@NagiosXI]# sudo -u nagios ./check_snmp_int.pl -H X.X.X.X -C COMMUNITY -r -2 -n 'HP NC373i Multifunction Gigabit Server Adapter'
ERROR : Unknown interface HP NC373i Multifunction Gigabit Server Adapter

I hope one day to have no more Windows product, but untill this time, if you have another trick...

Post by **nscott** » Mon Jul 25, 2011 9:58 am

Aurelien,

I was digging into some Microsoft docs and I found this:

http://blogs.technet.com/b/networking/a ... unter.aspx

Which isn't leaving me very hopeful.

Post by **srrhd** » Tue Jul 26, 2011 6:58 am

Do you know about a plugin to check interface using the OID ?

Post by **nscott** » Tue Jul 26, 2011 1:39 pm

I do believe the check_snmp plugin can do exactly that. Its not geared towards interfaces but you can poll any particular OID you want. It comes preinstalled with Nagios XI. Check it out:

http://nagiosplugins.org/man/check_snmp

Post by **srrhd** » Wed Jul 27, 2011 8:27 am

Right, but it lacks the perf data to get the trafic graph.

Post by **nscott** » Wed Jul 27, 2011 2:44 pm

Ahh, well then no I'm not aware of one that can do that.

Nagios Support Forum

Check_snmp_int.pl for Windows 2008

Check_snmp_int.pl for Windows 2008

Re: Check_snmp_int.pl for Windows 2008

Re: Check_snmp_int.pl for Windows 2008

Re: Check_snmp_int.pl for Windows 2008

Re: Check_snmp_int.pl for Windows 2008

Re: Check_snmp_int.pl for Windows 2008

Re: Check_snmp_int.pl for Windows 2008

Re: Check_snmp_int.pl for Windows 2008

Re: Check_snmp_int.pl for Windows 2008

Re: Check_snmp_int.pl for Windows 2008