What uses the SNMP write community string in SIM?

[Darren Z]

HP SIM Help says "A few tools need this option set". Does anyone know what tools?

[Rob Buxton]

The thresholds settings on the agents for one.

If you don't have a write community string, when you go to the agent from HPSIm and go to thresholds you cannot save any changes to the threshold sliders.

[Darren Z]

Ahh... gotcha. Don't use them so I didn't think of that.

[Ferry Steenvoorde]

There's another one. In the Integrated Management Logs on managed systems, you cannot set the reported events to "Mark Item Repaired", or "Clear all IML Entries" if you do not use an SNMP-community with READ/WRITE rights.
Most default server installations only use an SNMP-community "public" with READ ONLY rights.

The Integrated Management Log can be accessed via the System Management Homepage.
Sometimes HPSIM reports a hardware status Orange when specific events are logged in the IML (like BlueScreens etc.).

[David Claypool]

HP SIM does not use a write community string for any operation over the wire. When using 'Configure or Repair Settings,' HP SIM will define a random string for each system to eastablish a write community string at the target system. The string is used for intra-agent communications and is never transmitted over the wire (i.e. can't be sniffed on the network).

All 'write' operations that HP SIM does over the wire are complete via HTTPS.

Intra-agent communications include:

- setting disk thresholds
- clearing the IML
- changing agent settings through the SMH or from HP SIM
- VCA updates

[Darren Z]

Thanks Claypool that make sense.

[Bill Holland_2]

Claypool,

Thanks for that info, but what about situations (like ours) where those who make the rules for the network expressly forbid setting SNMP write strings?

[David Claypool]

...the same thing you would do if they forbade the use of Windows on your network because it is too insecure. :)

Sorry for the sarcasm, but most of these 'decrees' are made by people without a clear understanding of the problem who read an article about something and start making uninformed decisions.

A perfectly secure server would have no administrative or management access whatsoever, in fact no access at all. (The system where we do digital signing of software is not even connected to a network because of security restrictions.) Everyone needs to make a decision about the tradeoff between security and the amount of management they want to/need to use.

[Micke_Ch_1]

Hi!!

In what way is SNMP Write Community string used in VCA updates??

Best Regards
/Mikael Christenson