net-snmp on HP-UX 11.31

[SyedHamid]

Hi All,

I'm trying to monitor a HP-UX server with an application Orion Solarwinds

Following are the version details

NET-SNMP version:  5.7.2

HP -UX  :  B.11.31

I have disabled HP-UX's snmp and have installed  it from HP recommended depot ( https://h20392.www2.hp.com/portal/swdepot/searchProducts.do )

I'm able to snmpwalk on version 1 via public community on the HP-UX server. However I'm not able to get the server to be snmpwalked via a community from the monitoring system.

I have attached my snmpd.conf file and netstat details.

Any help would be highly appreciated.

Thanks

Syed

[SyedHamid]

Also following is my lsof output

lsof -i udp:161

COMMAND  PID USER   FD   TYPE             DEVICE SIZE/OFF NODE NAME
snmpd   4878 root    5u  IPv4 0xe0000003139bbc80      0t0  UDP *:snmp (Idle)
snmpd   4881 root    5u  IPv6 0xe00000036f71c980      0t0  UDP *:snmp (Idle)

[Matti_Kurkela]

Your lsof output and your previous netstat output don't match:
according to the "agentaddress" setting in the configuration you posted, the net-snmp daemon should be listening in port 1161, as confirmed by netstat. Your ps -ef indicates that the net-snmp daemon is running as PID 2022.

Yet your lsof indicates snmpd is running in port 161 and with PIDs 4878 (for IPv4) and 4881 (for IPv6).

What is going on?

[SyedHamid]

I was testing,I have changed my agentaddress to 161. My new snmpd.conf ( relating to my lsof output ) has been uploaded.

[Matti_Kurkela]

Is 172.16.5.57 the IP address of your monitoring system? At the moment, it seems to be the only remote host that is authorized to query your net-snmp daemon for anything at all.

If your monitoring system has multiple NICs and/or IP addresses, are you sure its requests to this HP-UX hosts are sent out via the 172.16.5.57 interface?

With your current configuration, queries from 172.16.5.57 will only succeed if community "FusAfiL2IQs" is used, and even then with read access only.

Any other non-local queries will fail.

[SyedHamid]

Hi,

True, on the HP-UX server

/opt/iexpress/net-snmp/bin/snmpwalk -v 2c -c FusAfiL2IQs 172.16.184.34 system

and

/opt/iexpress/net-snmp/bin/snmpwalk -v 2c -c FusAfiL2IQs 172.16.5.57 system

Work absolutely fine. However when I try and poll the HP UX server from the Orion Solarwinds applications it fails.

Thanks

Syed

[Matti_Kurkela]

So the IP address 172.16.5.57 belongs to the HP-UX server itself? And maybe 172.16.184.34 too?

Then you need to find out the IP address the Orion Solarwinds applications send their SNMP requests from, and add it to a line like this:

com2sec mynetwork  aa.bb.cc.dd          FusAfiL2IQs

 Replace aa.bb.cc.dd with the IP address the Orion Solarwinds uses.

[SyedHamid]

com2sec mynetwork  172.16.5.57          FusAfiL2IQs

is my entry

172.16.5.57   - Is the Solarwinds server

172.16.184.34 - Is the ip of the HPUX box

[Matti_Kurkela]

Try restarting snmpd with full debug logging enabled:

/opt/iexpress/net-snmp/sbin/snmpd -LF7 /tmp/snmp-troubleshooting.log -a -p /var/tmp/net-snmpd -c /opt/iexpress/net-snmp/etc/snmpd.conf

This should produce a log file at /tmp/snmp-troubleshooting.log.

Then send some queries locally, using first a correct community name and then an incorrect one. Both queries should produce messages in the log.

Then send some queries from the Solarwinds server and look at the log again.

I think there are three possibilities:

• no new messages in the log = something is blocking the queries from the Solarwinds server from reaching the HP-UX system
• the messages say that snmpd is rejecting the queries from the Solarwinds server = most likely the Solarwinds server is not actually using the community name you expect it to use, or
• the log file says snmpd is receiving the query and responding to it = something is blocking the response from reaching the Solarwinds server.

[SyedHamid]

no new messages in the log = something is blocking the queries from the Solarwinds server from reaching the HP-UX system.