5 kx ###############################################################################
5 kx #
5 kx # snmpd.conf:
5 kx # An example configuration file for configuring the ucd-snmp snmpd agent.
5 kx #
5 kx ###############################################################################
5 kx #
5 kx # This file is intended to only be as a starting point. Many more
5 kx # configuration directives exist than are mentioned in this file. For
5 kx # full details, see the snmpd.conf(5) manual page.
5 kx #
5 kx # All lines beginning with a '#' are comments and are intended for you
5 kx # to read. All other lines are configuration commands for the agent.
5 kx
5 kx ###############################################################################
5 kx # Access Control
5 kx ###############################################################################
5 kx
5 kx # As shipped, the snmpd demon will only respond to queries on the
5 kx # system mib group until this file is replaced or modified for
5 kx # security purposes. Examples are shown below about how to increase the
5 kx # level of access.
5 kx
5 kx # By far, the most common question I get about the agent is "why won't
5 kx # it work?", when really it should be "how do I configure the agent to
5 kx # allow me to access it?"
5 kx #
5 kx # By default, the agent responds to the "public" community for read
5 kx # only access, if run out of the box without any configuration file in
5 kx # place. The following examples show you other ways of configuring
5 kx # the agent so that you can change the community names, and give
5 kx # yourself write access to the mib tree as well.
5 kx #
5 kx # For more information, read the FAQ as well as the snmpd.conf(5)
5 kx # manual page.
5 kx
5 kx ####
5 kx # First, map the community name "public" into a "security name"
5 kx
5 kx # sec.name source community
5 kx com2sec notConfigUser default public
5 kx
5 kx ####
5 kx # Second, map the security name into a group name:
5 kx
5 kx # groupName securityModel securityName
5 kx group notConfigGroup v1 notConfigUser
5 kx group notConfigGroup v2c notConfigUser
5 kx
5 kx ####
5 kx # Third, create a view for us to let the group have rights to:
5 kx
5 kx # Make at least snmpwalk -v 1 localhost -c public system fast again.
5 kx # name incl/excl subtree mask(optional)
5 kx view systemview included .1.3.6.1.2.1.1
5 kx view systemview included .1.3.6.1.2.1.25.1.1
5 kx
5 kx ####
5 kx # Finally, grant the group read-only access to the systemview view.
5 kx
5 kx # group context sec.model sec.level prefix read write notif
5 kx access notConfigGroup "" any noauth exact systemview none none
5 kx
5 kx # -----------------------------------------------------------------------------
5 kx
5 kx # Here is a commented out example configuration that allows less
5 kx # restrictive access.
5 kx
5 kx # YOU SHOULD CHANGE THE "COMMUNITY" TOKEN BELOW TO A NEW KEYWORD ONLY
5 kx # KNOWN AT YOUR SITE. YOU *MUST* CHANGE THE NETWORK TOKEN BELOW TO
5 kx # SOMETHING REFLECTING YOUR LOCAL NETWORK ADDRESS SPACE.
5 kx
5 kx ## sec.name source community
5 kx #com2sec local localhost COMMUNITY
5 kx #com2sec mynetwork NETWORK/24 COMMUNITY
5 kx
5 kx ## group.name sec.model sec.name
5 kx #group MyRWGroup any local
5 kx #group MyROGroup any mynetwork
5 kx #
5 kx #group MyRWGroup any otherv3user
5 kx #...
5 kx
5 kx ## incl/excl subtree mask
5 kx #view all included .1 80
5 kx
5 kx ## -or just the mib2 tree-
5 kx
5 kx #view mib2 included .iso.org.dod.internet.mgmt.mib-2 fc
5 kx
5 kx
5 kx ## context sec.model sec.level prefix read write notif
5 kx #access MyROGroup "" any noauth 0 all none none
5 kx #access MyRWGroup "" any noauth 0 all all all
5 kx
5 kx
5 kx ###############################################################################
5 kx # Sample configuration to make net-snmpd RFC 1213.
5 kx # Unfortunately v1 and v2c don't allow any user based authentification, so
5 kx # opening up the default config is not an option from a security point.
5 kx #
5 kx # WARNING: If you uncomment the following lines you allow write access to your
5 kx # snmpd daemon from any source! To avoid this use different names for your
5 kx # community or split out the write access to a different community and
5 kx # restrict it to your local network.
5 kx # Also remember to comment the syslocation and syscontact parameters later as
5 kx # otherwise they are still read only (see FAQ for net-snmp).
5 kx #
5 kx
5 kx # First, map the community name "public" into a "security name"
5 kx # sec.name source community
5 kx #com2sec notConfigUser default public
5 kx
5 kx # Second, map the security name into a group name:
5 kx # groupName securityModel securityName
5 kx #group notConfigGroup v1 notConfigUser
5 kx #group notConfigGroup v2c notConfigUser
5 kx
5 kx # Third, create a view for us to let the group have rights to:
5 kx # Open up the whole tree for ro, make the RFC 1213 required ones rw.
5 kx # name incl/excl subtree mask(optional)
5 kx #view roview included .1
5 kx #view rwview included system.sysContact
5 kx #view rwview included system.sysName
5 kx #view rwview included system.sysLocation
5 kx #view rwview included interfaces.ifTable.ifEntry.ifAdminStatus
5 kx #view rwview included at.atTable.atEntry.atPhysAddress
5 kx #view rwview included at.atTable.atEntry.atNetAddress
5 kx #view rwview included ip.ipForwarding
5 kx #view rwview included ip.ipDefaultTTL
5 kx #view rwview included ip.ipRouteTable.ipRouteEntry.ipRouteDest
5 kx #view rwview included ip.ipRouteTable.ipRouteEntry.ipRouteIfIndex
5 kx #view rwview included ip.ipRouteTable.ipRouteEntry.ipRouteMetric1
5 kx #view rwview included ip.ipRouteTable.ipRouteEntry.ipRouteMetric2
5 kx #view rwview included ip.ipRouteTable.ipRouteEntry.ipRouteMetric3
5 kx #view rwview included ip.ipRouteTable.ipRouteEntry.ipRouteMetric4
5 kx #view rwview included ip.ipRouteTable.ipRouteEntry.ipRouteType
5 kx #view rwview included ip.ipRouteTable.ipRouteEntry.ipRouteAge
5 kx #view rwview included ip.ipRouteTable.ipRouteEntry.ipRouteMask
5 kx #view rwview included ip.ipRouteTable.ipRouteEntry.ipRouteMetric5
5 kx #view rwview included ip.ipNetToMediaTable.ipNetToMediaEntry.ipNetToMediaIfIndex
5 kx #view rwview included ip.ipNetToMediaTable.ipNetToMediaEntry.ipNetToMediaPhysAddress
5 kx #view rwview included ip.ipNetToMediaTable.ipNetToMediaEntry.ipNetToMediaNetAddress
5 kx #view rwview included ip.ipNetToMediaTable.ipNetToMediaEntry.ipNetToMediaType
5 kx #view rwview included tcp.tcpConnTable.tcpConnEntry.tcpConnState
5 kx #view rwview included egp.egpNeighTable.egpNeighEntry.egpNeighEventTrigger
5 kx #view rwview included snmp.snmpEnableAuthenTraps
5 kx
5 kx # Finally, grant the group read-only access to the systemview view.
5 kx # group context sec.model sec.level prefix read write notif
5 kx #access notConfigGroup "" any noauth exact roview rwview none
5 kx
5 kx
5 kx
5 kx ###############################################################################
5 kx # System contact information
5 kx #
5 kx
5 kx # It is also possible to set the sysContact and sysLocation system
5 kx # variables through the snmpd.conf file:
5 kx
5 kx syslocation Unknown (edit /etc/snmp/snmpd.conf)
5 kx syscontact Root <root@localhost> (configure /etc/snmp/snmp.local.conf)
5 kx
5 kx # Example output of snmpwalk:
5 kx # % snmpwalk -v 1 localhost -c public system
5 kx # system.sysDescr.0 = "SunOS name sun4c"
5 kx # system.sysObjectID.0 = OID: enterprises.ucdavis.ucdSnmpAgent.sunos4
5 kx # system.sysUpTime.0 = Timeticks: (595637548) 68 days, 22:32:55
5 kx # system.sysContact.0 = "Me <me@somewhere.org>"
5 kx # system.sysName.0 = "name"
5 kx # system.sysLocation.0 = "Right here, right now."
5 kx # system.sysServices.0 = 72
5 kx
5 kx
5 kx # -----------------------------------------------------------------------------
5 kx
5 kx
5 kx ###############################################################################
5 kx # Process checks.
5 kx #
5 kx # The following are examples of how to use the agent to check for
5 kx # processes running on the host. The syntax looks something like:
5 kx #
5 kx # proc NAME [MAX=0] [MIN=0]
5 kx #
5 kx # NAME: the name of the process to check for. It must match
5 kx # exactly (ie, http will not find httpd processes).
5 kx # MAX: the maximum number allowed to be running. Defaults to 0.
5 kx # MIN: the minimum number to be running. Defaults to 0.
5 kx
5 kx #
5 kx # Examples (commented out by default):
5 kx #
5 kx
5 kx # Make sure mountd is running
5 kx #proc mountd
5 kx
5 kx # Make sure there are no more than 4 ntalkds running, but 0 is ok too.
5 kx #proc ntalkd 4
5 kx
5 kx # Make sure at least one sendmail, but less than or equal to 10 are running.
5 kx #proc sendmail 10 1
5 kx
5 kx # A snmpwalk of the process mib tree would look something like this:
5 kx #
5 kx # % snmpwalk -v 1 localhost -c public .1.3.6.1.4.1.2021.2
5 kx # enterprises.ucdavis.procTable.prEntry.prIndex.1 = 1
5 kx # enterprises.ucdavis.procTable.prEntry.prIndex.2 = 2
5 kx # enterprises.ucdavis.procTable.prEntry.prIndex.3 = 3
5 kx # enterprises.ucdavis.procTable.prEntry.prNames.1 = "mountd"
5 kx # enterprises.ucdavis.procTable.prEntry.prNames.2 = "ntalkd"
5 kx # enterprises.ucdavis.procTable.prEntry.prNames.3 = "sendmail"
5 kx # enterprises.ucdavis.procTable.prEntry.prMin.1 = 0
5 kx # enterprises.ucdavis.procTable.prEntry.prMin.2 = 0
5 kx # enterprises.ucdavis.procTable.prEntry.prMin.3 = 1
5 kx # enterprises.ucdavis.procTable.prEntry.prMax.1 = 0
5 kx # enterprises.ucdavis.procTable.prEntry.prMax.2 = 4
5 kx # enterprises.ucdavis.procTable.prEntry.prMax.3 = 10
5 kx # enterprises.ucdavis.procTable.prEntry.prCount.1 = 0
5 kx # enterprises.ucdavis.procTable.prEntry.prCount.2 = 0
5 kx # enterprises.ucdavis.procTable.prEntry.prCount.3 = 1
5 kx # enterprises.ucdavis.procTable.prEntry.prErrorFlag.1 = 1
5 kx # enterprises.ucdavis.procTable.prEntry.prErrorFlag.2 = 0
5 kx # enterprises.ucdavis.procTable.prEntry.prErrorFlag.3 = 0
5 kx # enterprises.ucdavis.procTable.prEntry.prErrMessage.1 = "No mountd process running."
5 kx # enterprises.ucdavis.procTable.prEntry.prErrMessage.2 = ""
5 kx # enterprises.ucdavis.procTable.prEntry.prErrMessage.3 = ""
5 kx # enterprises.ucdavis.procTable.prEntry.prErrFix.1 = 0
5 kx # enterprises.ucdavis.procTable.prEntry.prErrFix.2 = 0
5 kx # enterprises.ucdavis.procTable.prEntry.prErrFix.3 = 0
5 kx #
5 kx # Note that the errorFlag for mountd is set to 1 because one is not
5 kx # running (in this case an rpc.mountd is, but thats not good enough),
5 kx # and the ErrMessage tells you what's wrong. The configuration
5 kx # imposed in the snmpd.conf file is also shown.
5 kx #
5 kx # Special Case: When the min and max numbers are both 0, it assumes
5 kx # you want a max of infinity and a min of 1.
5 kx #
5 kx
5 kx
5 kx # -----------------------------------------------------------------------------
5 kx
5 kx
5 kx ###############################################################################
5 kx # Executables/scripts
5 kx #
5 kx
5 kx #
5 kx # You can also have programs run by the agent that return a single
5 kx # line of output and an exit code. Here are two examples.
5 kx #
5 kx # exec NAME PROGRAM [ARGS ...]
5 kx #
5 kx # NAME: A generic name.
5 kx # PROGRAM: The program to run. Include the path!
5 kx # ARGS: optional arguments to be passed to the program
5 kx
5 kx # a simple hello world
5 kx
5 kx #exec echotest /bin/echo hello world
5 kx
5 kx # Run a shell script containing:
5 kx #
5 kx # #!/bin/sh
5 kx # echo hello world
5 kx # echo hi there
5 kx # exit 35
5 kx #
5 kx # Note: this has been specifically commented out to prevent
5 kx # accidental security holes due to someone else on your system writing
5 kx # a /tmp/shtest before you do. Uncomment to use it.
5 kx #
5 kx #exec shelltest /bin/sh /tmp/shtest
5 kx
5 kx # Then,
5 kx # % snmpwalk -v 1 localhost -c public .1.3.6.1.4.1.2021.8
5 kx # enterprises.ucdavis.extTable.extEntry.extIndex.1 = 1
5 kx # enterprises.ucdavis.extTable.extEntry.extIndex.2 = 2
5 kx # enterprises.ucdavis.extTable.extEntry.extNames.1 = "echotest"
5 kx # enterprises.ucdavis.extTable.extEntry.extNames.2 = "shelltest"
5 kx # enterprises.ucdavis.extTable.extEntry.extCommand.1 = "/bin/echo hello world"
5 kx # enterprises.ucdavis.extTable.extEntry.extCommand.2 = "/bin/sh /tmp/shtest"
5 kx # enterprises.ucdavis.extTable.extEntry.extResult.1 = 0
5 kx # enterprises.ucdavis.extTable.extEntry.extResult.2 = 35
5 kx # enterprises.ucdavis.extTable.extEntry.extOutput.1 = "hello world."
5 kx # enterprises.ucdavis.extTable.extEntry.extOutput.2 = "hello world."
5 kx # enterprises.ucdavis.extTable.extEntry.extErrFix.1 = 0
5 kx # enterprises.ucdavis.extTable.extEntry.extErrFix.2 = 0
5 kx
5 kx # Note that the second line of the /tmp/shtest shell script is cut
5 kx # off. Also note that the exit status of 35 was returned.
5 kx
5 kx # -----------------------------------------------------------------------------
5 kx
5 kx
5 kx ###############################################################################
5 kx # disk checks
5 kx #
5 kx
5 kx # The agent can check the amount of available disk space, and make
5 kx # sure it is above a set limit.
5 kx
5 kx # disk PATH [MIN=100000]
5 kx #
5 kx # PATH: mount path to the disk in question.
5 kx # MIN: Disks with space below this value will have the Mib's errorFlag set.
5 kx # Default value = 100000.
5 kx
5 kx # Check the / partition and make sure it contains at least 10 megs.
5 kx
5 kx #disk / 10000
5 kx
5 kx # % snmpwalk -v 1 localhost -c public .1.3.6.1.4.1.2021.9
5 kx # enterprises.ucdavis.diskTable.dskEntry.diskIndex.1 = 0
5 kx # enterprises.ucdavis.diskTable.dskEntry.diskPath.1 = "/" Hex: 2F
5 kx # enterprises.ucdavis.diskTable.dskEntry.diskDevice.1 = "/dev/dsk/c201d6s0"
5 kx # enterprises.ucdavis.diskTable.dskEntry.diskMinimum.1 = 10000
5 kx # enterprises.ucdavis.diskTable.dskEntry.diskTotal.1 = 837130
5 kx # enterprises.ucdavis.diskTable.dskEntry.diskAvail.1 = 316325
5 kx # enterprises.ucdavis.diskTable.dskEntry.diskUsed.1 = 437092
5 kx # enterprises.ucdavis.diskTable.dskEntry.diskPercent.1 = 58
5 kx # enterprises.ucdavis.diskTable.dskEntry.diskErrorFlag.1 = 0
5 kx # enterprises.ucdavis.diskTable.dskEntry.diskErrorMsg.1 = ""
5 kx
5 kx # -----------------------------------------------------------------------------
5 kx
5 kx
5 kx ###############################################################################
5 kx # load average checks
5 kx #
5 kx
5 kx # load [1MAX=12.0] [5MAX=12.0] [15MAX=12.0]
5 kx #
5 kx # 1MAX: If the 1 minute load average is above this limit at query
5 kx # time, the errorFlag will be set.
5 kx # 5MAX: Similar, but for 5 min average.
5 kx # 15MAX: Similar, but for 15 min average.
5 kx
5 kx # Check for loads:
5 kx #load 12 14 14
5 kx
5 kx # % snmpwalk -v 1 localhost -c public .1.3.6.1.4.1.2021.10
5 kx # enterprises.ucdavis.loadTable.laEntry.loadaveIndex.1 = 1
5 kx # enterprises.ucdavis.loadTable.laEntry.loadaveIndex.2 = 2
5 kx # enterprises.ucdavis.loadTable.laEntry.loadaveIndex.3 = 3
5 kx # enterprises.ucdavis.loadTable.laEntry.loadaveNames.1 = "Load-1"
5 kx # enterprises.ucdavis.loadTable.laEntry.loadaveNames.2 = "Load-5"
5 kx # enterprises.ucdavis.loadTable.laEntry.loadaveNames.3 = "Load-15"
5 kx # enterprises.ucdavis.loadTable.laEntry.loadaveLoad.1 = "0.49" Hex: 30 2E 34 39
5 kx # enterprises.ucdavis.loadTable.laEntry.loadaveLoad.2 = "0.31" Hex: 30 2E 33 31
5 kx # enterprises.ucdavis.loadTable.laEntry.loadaveLoad.3 = "0.26" Hex: 30 2E 32 36
5 kx # enterprises.ucdavis.loadTable.laEntry.loadaveConfig.1 = "12.00"
5 kx # enterprises.ucdavis.loadTable.laEntry.loadaveConfig.2 = "14.00"
5 kx # enterprises.ucdavis.loadTable.laEntry.loadaveConfig.3 = "14.00"
5 kx # enterprises.ucdavis.loadTable.laEntry.loadaveErrorFlag.1 = 0
5 kx # enterprises.ucdavis.loadTable.laEntry.loadaveErrorFlag.2 = 0
5 kx # enterprises.ucdavis.loadTable.laEntry.loadaveErrorFlag.3 = 0
5 kx # enterprises.ucdavis.loadTable.laEntry.loadaveErrMessage.1 = ""
5 kx # enterprises.ucdavis.loadTable.laEntry.loadaveErrMessage.2 = ""
5 kx # enterprises.ucdavis.loadTable.laEntry.loadaveErrMessage.3 = ""
5 kx
5 kx # -----------------------------------------------------------------------------
5 kx
5 kx
5 kx ###############################################################################
5 kx # Extensible sections.
5 kx #
5 kx
5 kx # This alleviates the multiple line output problem found in the
5 kx # previous executable mib by placing each mib in its own mib table:
5 kx
5 kx # Run a shell script containing:
5 kx #
5 kx # #!/bin/sh
5 kx # echo hello world
5 kx # echo hi there
5 kx # exit 35
5 kx #
5 kx # Note: this has been specifically commented out to prevent
5 kx # accidental security holes due to someone else on your system writing
5 kx # a /tmp/shtest before you do. Uncomment to use it.
5 kx #
5 kx # exec .1.3.6.1.4.1.2021.50 shelltest /bin/sh /tmp/shtest
5 kx
5 kx # % snmpwalk -v 1 localhost -c public .1.3.6.1.4.1.2021.50
5 kx # enterprises.ucdavis.50.1.1 = 1
5 kx # enterprises.ucdavis.50.2.1 = "shelltest"
5 kx # enterprises.ucdavis.50.3.1 = "/bin/sh /tmp/shtest"
5 kx # enterprises.ucdavis.50.100.1 = 35
5 kx # enterprises.ucdavis.50.101.1 = "hello world."
5 kx # enterprises.ucdavis.50.101.2 = "hi there."
5 kx # enterprises.ucdavis.50.102.1 = 0
5 kx
5 kx # Now the Output has grown to two lines, and we can see the 'hi
5 kx # there.' output as the second line from our shell script.
5 kx #
5 kx # Note that you must alter the mib.txt file to be correct if you want
5 kx # the .50.* outputs above to change to reasonable text descriptions.
5 kx
5 kx # Other ideas:
5 kx #
5 kx # exec .1.3.6.1.4.1.2021.51 ps /bin/ps
5 kx # exec .1.3.6.1.4.1.2021.52 top /usr/local/bin/top
5 kx # exec .1.3.6.1.4.1.2021.53 mailq /usr/bin/mailq
5 kx
5 kx # -----------------------------------------------------------------------------
5 kx
5 kx
5 kx ###############################################################################
5 kx # Pass through control.
5 kx #
5 kx
5 kx # Usage:
5 kx # pass MIBOID EXEC-COMMAND
5 kx #
5 kx # This will pass total control of the mib underneath the MIBOID
5 kx # portion of the mib to the EXEC-COMMAND.
5 kx #
5 kx # Note: You'll have to change the path of the passtest script to your
5 kx # source directory or install it in the given location.
5 kx #
5 kx # Example: (see the script for details)
5 kx # (commented out here since it requires that you place the
5 kx # script in the right location. (its not installed by default))
5 kx
5 kx # pass .1.3.6.1.4.1.2021.255 /bin/sh /usr/local/local/passtest
5 kx
5 kx # % snmpwalk -v 1 localhost -c public .1.3.6.1.4.1.2021.255
5 kx # enterprises.ucdavis.255.1 = "life the universe and everything"
5 kx # enterprises.ucdavis.255.2.1 = 42
5 kx # enterprises.ucdavis.255.2.2 = OID: 42.42.42
5 kx # enterprises.ucdavis.255.3 = Timeticks: (363136200) 42 days, 0:42:42
5 kx # enterprises.ucdavis.255.4 = IpAddress: 127.0.0.1
5 kx # enterprises.ucdavis.255.5 = 42
5 kx # enterprises.ucdavis.255.6 = Gauge: 42
5 kx #
5 kx # % snmpget -v 1 localhost public .1.3.6.1.4.1.2021.255.5
5 kx # enterprises.ucdavis.255.5 = 42
5 kx #
5 kx # % snmpset -v 1 localhost public .1.3.6.1.4.1.2021.255.1 s "New string"
5 kx # enterprises.ucdavis.255.1 = "New string"
5 kx #
5 kx
5 kx # For specific usage information, see the man/snmpd.conf.5 manual page
5 kx # as well as the local/passtest script used in the above example.
5 kx
5 kx # Added for support of bcm5820 cards.
5 kx pass .1.3.6.1.4.1.4413.4.1 /usr/bin/ucd5820stat
5 kx
5 kx ###############################################################################
5 kx # Further Information
5 kx #
5 kx # See the snmpd.conf manual page, and the output of "snmpd -H".
Radix cross Linux
The main Radix cross Linux repository contains the build scripts of packages, which have the most complete and common functionality for desktop machines
452 Commits
2 Branches
1 Tag