snmp 学习

SNMP：“简单网络管理协议”，用于网络管理的协议。SNMP用于网络设备的管理。SNMP的工作方式：管理员需要向设备获取数据，所以SNMP提供了“读”操作；管理员需要向设备执行设置操作，所以SNMP提供了“写”操作；设备需要在重要状况改变的时候，向管理员通报事件的发生，所以SNMP提供了“Trap”操作。

什么是 MIB?

MIB 是描述被管理设备上的参数的数据结构。如前所述，管理一个设备，就是利用 SNMP 协议，通过网络对被管理设备上的参数进行 get 和 set 操作。

SNMP MIB 是定义了这个设备都有哪些信息可以被收集，哪些trap的触发条件可以被定义，只有符合TRAP触发条件的事件才被发送出去

 snmpget 命令

[root@vStack ~]# snmpget -v 2c -c public localhost system.sysDescr.
SNMPv2-MIB::sysDescr. = STRING: Linux vStack 3.10.-.el7.x86_64 # SMP Thu Nov  :: UTC  x86_64

snmpbulkwalk 命令

[root@vStack ~]# snmpbulkwalk -v 2c -c public 127.0.0.1 .1.3.6.1.2.1.
SNMPv2-MIB::sysDescr. = STRING: Linux vStack 3.10.-.el7.x86_64 # SMP Thu Nov  :: UTC  x86_64
SNMPv2-MIB::sysObjectID. = OID: NET-SNMP-MIB::netSnmpAgentOIDs.
DISMAN-EVENT-MIB::sysUpTimeInstance = Timeticks: () ::21.08
SNMPv2-MIB::sysContact. = STRING: Root <root@localhost> (configure /etc/snmp/snmp.local.conf)
SNMPv2-MIB::sysName. = STRING: vStack
SNMPv2-MIB::sysLocation. = STRING: Unknown (edit /etc/snmp/snmpd.conf)
SNMPv2-MIB::sysORLastChange. = Timeticks: () ::00.04
SNMPv2-MIB::sysORID. = OID: SNMP-MPD-MIB::snmpMPDCompliance
SNMPv2-MIB::sysORID. = OID: SNMP-USER-BASED-SM-MIB::usmMIBCompliance
SNMPv2-MIB::sysORID. = OID: SNMP-FRAMEWORK-MIB::snmpFrameworkMIBCompliance
SNMPv2-MIB::sysORID. = OID: SNMPv2-MIB::snmpMIB
SNMPv2-MIB::sysORID. = OID: TCP-MIB::tcpMIB
SNMPv2-MIB::sysORID. = OID: IP-MIB::ip
SNMPv2-MIB::sysORID. = OID: UDP-MIB::udpMIB
SNMPv2-MIB::sysORID. = OID: SNMP-VIEW-BASED-ACM-MIB::vacmBasicGroup
SNMPv2-MIB::sysORID. = OID: SNMP-NOTIFICATION-MIB::snmpNotifyFullCompliance
SNMPv2-MIB::sysORID. = OID: NOTIFICATION-LOG-MIB::notificationLogMIB
SNMPv2-MIB::sysORDescr. = STRING: The MIB for Message Processing and Dispatching.
SNMPv2-MIB::sysORDescr. = STRING: The management information definitions for the SNMP User-based Security Model.
SNMPv2-MIB::sysORDescr. = STRING: The SNMP Management Architecture MIB.
SNMPv2-MIB::sysORDescr. = STRING: The MIB module for SNMPv2 entities
SNMPv2-MIB::sysORDescr. = STRING: The MIB module for managing TCP implementations
SNMPv2-MIB::sysORDescr. = STRING: The MIB module for managing IP and ICMP implementations
SNMPv2-MIB::sysORDescr. = STRING: The MIB module for managing UDP implementations
SNMPv2-MIB::sysORDescr. = STRING: View-based Access Control Model for SNMP.
SNMPv2-MIB::sysORDescr. = STRING: The MIB modules for managing SNMP Notification, plus filtering.
SNMPv2-MIB::sysORDescr. = STRING: The MIB module for logging SNMP Notifications.
SNMPv2-MIB::sysORUpTime. = Timeticks: () ::00.03
SNMPv2-MIB::sysORUpTime. = Timeticks: () ::00.03
SNMPv2-MIB::sysORUpTime. = Timeticks: () ::00.03
SNMPv2-MIB::sysORUpTime. = Timeticks: () ::00.03
SNMPv2-MIB::sysORUpTime. = Timeticks: () ::00.03
SNMPv2-MIB::sysORUpTime. = Timeticks: () ::00.03
SNMPv2-MIB::sysORUpTime. = Timeticks: () ::00.03
SNMPv2-MIB::sysORUpTime. = Timeticks: () ::00.03
SNMPv2-MIB::sysORUpTime. = Timeticks: () ::00.04
SNMPv2-MIB::sysORUpTime. = Timeticks: () ::00.04

snmpbulkwalk命令： 获取snmp服务器的mib-2各种资讯，snmpbulkwalk用于通过SNMPv2 的SNMP GET BULK请求命令与其它网络实体通信，只能用于snmpv2,速度快于snmpwalk

snmptrap 命令

[root@vStack snmp]# snmptrap
No hostname specified.
USAGE: snmptrap [OPTIONS] AGENT TRAP-PARAMETERS

  Version:  5.7.
  Web:      http://www.net-snmp.org/
  Email:    net-snmp-coders@lists.sourceforge.net

OPTIONS:
  -h, --help        display this help message
  -H            display configuration file directives understood
  -v |2c|        specifies SNMP version to use
  -V, --version        display package version number
SNMP Version  or 2c specific
  -c COMMUNITY        set the community string
SNMP Version  specific
  -a PROTOCOL        set authentication protocol (MD5|SHA)
  -A PASSPHRASE        set authentication protocol pass phrase
  -e ENGINE-ID        set security engine ID (e.g. )
  -E ENGINE-ID        set context engine ID (e.g. )
  -l LEVEL        set security level (noAuthNoPriv|authNoPriv|authPriv)
  -n CONTEXT        set context name (e.g. bridge1)
  -u USER-NAME        set security name (e.g. bert)
  -x PROTOCOL        set privacy protocol (DES|AES)
  -X PASSPHRASE        set privacy protocol pass phrase
  -Z BOOTS,TIME        set destination engine boots/time
General communication options
  -r RETRIES        set the number of retries
  -t TIMEOUT        set the request timeout (in seconds)
Debugging
  -d            dump input/output packets in hexadecimal
  -D[TOKEN[,...]]    turn on debugging output for the specified TOKENs
               (ALL gives extremely verbose debugging output)
General options
  -m MIB[:...]        load given list of MIBs (ALL loads everything)
  -M DIR[:...]        look in given list of directories for MIBs
    (default: /root/.snmp/mibs:/usr/share/snmp/mibs)
  -P MIBOPTS        Toggle various defaults controlling MIB parsing:
              u:  allow the use of underlines in MIB symbols
              c:  disallow the use of "--" to terminate comments
              d:  save the DESCRIPTIONs of the MIB objects
              e:  disable errors when MIB symbols conflict
              w:  enable warnings when MIB symbols conflict
              W:  enable detailed warnings when MIB symbols conflict
              R:  replace MIB symbols from latest module
  -O OUTOPTS        Toggle various defaults controlling output display:
              :  print leading  for single-digit hex characters
              a:  print all strings in ascii format
              b:  do not break OID indexes down
              e:  print enums numerically
              E:  escape quotes in string indices
              f:  print full OIDs on output
              n:  print OIDs numerically
              q:  quick print for easier parsing
              Q:  quick print with equal-signs
              s:  print only last symbolic element of OID
              S:  print MIB module-id plus last element
              t:  print timeticks unparsed as numeric integers
              T:  print human-readable text along with hex strings
              u:  print OIDs using UCD-style prefix suppression
              U:  don't print units
              v:  print values only (not OID = value)
              x:  print all strings in hex format
              X:  extended index format
  -I INOPTS        Toggle various defaults controlling input parsing:
              b:  do best/regex matching to find a MIB node
              h:  don't apply DISPLAY-HINTs
              r:  do not check values for range/type legality
              R:  do random access to OID labels
              u:  top-level OIDs must have '.' prefix (UCD-style)
              s SUFFIX:  Append all textual OIDs with SUFFIX before parsing
              S PREFIX:  Prepend all textual OIDs with PREFIX before parsing
  -L LOGOPTS        Toggle various defaults controlling logging:
              e:           log to standard error
              o:           log to standard output
              n:           don't log at all
              f file:      log to the specified file
              s facility:  log to syslog (via the specified facility)

              (variants)
              [EON] pri:   log to standard error, output or /dev/null for level 'pri' and above
              [EON] p1-p2: log to standard error, output or /dev/null for levels 'p1' to 'p2'
              [FS] pri token:    log to file/syslog for level 'pri' and above
              [FS] p1-p2 token:  log to file/syslog for levels 'p1' to 'p2'
  -C APPOPTS        Set various application specific behaviour:
              i:  send an INFORM instead of a TRAP

  -v  TRAP-PARAMETERS:
     enterprise-oid agent trap-type specific-type uptime [OID TYPE VALUE]...
  or
  -v  TRAP-PARAMETERS:
     uptime trapoid [OID TYPE VALUE] ...
[root@vStack snmp]# 

snmptrap的命令行格式如下：

  snmptrap -v [2c|] [COMMON OPTIONS]        uptime      trap-oid                [OID TYPE VALUE]
$ snmptrap -v 2c     -c public 127.0.0.1: ""         .1.3.6.1.4.1.2021.251.  sysLocation. s "test"
$ snmptrap -v 2c     -c public 127.0.0.1: "" .1.3.6.1.4.1.2021.251.  sysLocation. s "test"

  snmptrap -v [2c|] [COMMON OPTIONS]        uptime      trap-oid                [OID TYPE VALUE]
$ snmptrap -v 2c     -c public 127.0.0.1: ""         .1.3.6.1.4.1.2021.251.  sysLocation. s "test"
$ snmptrap -v 2c     -c public 127.0.0.1: "" .1.3.6.1.4.1.2021.251.  sysLocation. s "test"

SNMP的MIB详解

1.MIB管理信息库

IETF规定的管理信息库MIB（由中定义了可访问的网络设备及其属性，由对象识别符（OID：Object Identifier）唯一指定。MIB是一个树形结构，SNMP协议消息通过遍历MIB树形目录中的节点来访问网络中的设备。

下图给出了NMS系统中SNMP可访问网络设备的对象识别树（OID：Object Identifier）结构。

上图中的节点是从internet开始的，其实上面还有几个节点请看下图。

下图给出了对一个DS1线路状态进行查询的OID设置例子。 

pysnmp:

>>> from pysnmp.entity.rfc3413.oneliner import cmdgen
>>> errorIndication, errorStatus, errorIndex, varBinds = cmdgen.CommandGenerator().getCmd( cmdgen.CommunityData('my-agent', 'public', 0), cmdgen.UdpTransportTarget(('localhost', 161)), (1,3,6,1,2,1,1,1,0) )
>>> varBinds
[(ObjectName('1.3.6.1.2.1.1.1.0'), OctetString('Linux devstack 3.10.0-514.26.2.el7.x86_64 #1 SMP Tue Jul 4 15:04:05 UTC 2017 x86_64'))]
>>>

snmptranslate 命令

将 MIB OIDs 的两种表现形式 ( 数字及文字 ) 相互转换。并显示 MIB 的内容与结构，如下所示：

[root@devstack ~]# snmptranslate -On SNMPv2-MIB::sysUpTime.0
.1.3.6.1.2.1.1.3.0
[root@devstack ~]# snmptranslate .1.3.6.1.2.1.1.3.0
DISMAN-EVENT-MIB::sysUpTimeInstance
[root@devstack ~]#

snmptranslate -Tp iso.org.dod.internet.mgmt.mib- #用snmptranslate打印从指定OID(.1.3.6.1.2.1)开始一直到该OID(.1.3.6.1.2.1)所属的 MIB 子树末端的树型结构信息
snmptranslate -Ta #用snmptranslate导出所有已经加载的 MIB 的数据，每个对象一行
snmptranslate -Tl #用snmptranslate导出所有已经加载的 MIB 的对象，并且输出完整的 oid 路径
snmptranslate -To #用snmptranslate导出已经加载的所有 MIB 的数字格式的 oid ，不含值和类型，仅仅有 oid 而已
snmptranslate -Ts #用snmptranslate只输出文字格式的 OID 名称而已

2， 处理自定义trap

编写两个mib文件，包括snmp1和snmp2两种trap

Snmp1的mib：TRAP-TEST-MIB.txt:

TRAP-TEST-MIB DEFINITIONS ::= BEGIN

       IMPORTS ucdExperimental FROM UCD-SNMP-MIB;

 demotraps OBJECT IDENTIFIER ::= { ucdExperimental 990 }

 demo-trap TRAP-TYPE

       STATUS current

       ENTERPRISE demotraps

       VARIABLES { sysLocation }

       DESCRIPTION "This is just a demo"

       ::= 17

 END

Snmp2的mib：NOTIFICATION-TEST-MIB.txt:

NOTIFICATION-TEST-MIB DEFINITIONS ::= BEGIN

       IMPORTS ucdavis FROM UCD-SNMP-MIB;

 demonotifs OBJECT IDENTIFIER ::= { ucdavis 991 }

 demo-notif NOTIFICATION-TYPE

         STATUS current

         OBJECTS { sysLocation }

         DESCRIPTION "Just a test notification"

         ::= { demonotifs 17 }

 END

然后放入到mibs文件夹中

在manager端敲入命令:

snmptrap -v 2c -c public 127.0.0.1:162 "" NOTIFICATION-TEST-MIB::demo-notif SNMPv2-MIB::sysLocation.0 s "just here"

agent端输出:

Received 96 bytes from UDP: [127.0.0.1]:44858
0000: 30 5E 02 01  01 04 06 70  75 62 6C 69  63 A7 51 02    0^.....public.Q.
0016: 04 7D BA 0E  AA 02 01 00  02 01 00 30  43 30 10 06    .}.........0C0..
0032: 08 2B 06 01  02 01 01 03  00 43 04 00  89 19 29 30    .+.......C....)0
0048: 18 06 0A 2B  06 01 06 03  01 01 04 01  00 06 0A 2B    ...+...........+
0064: 06 01 04 01  8F 65 87 5F  11 30 15 06  08 2B 06 01    .....e._.0...+..
0080: 02 01 01 06  00 04 09 6A  75 73 74 20  68 65 72 65    .......just here

2008-11-11 10:22:27 localhost [UDP: [127.0.0.1]:44858]:
DISMAN-EVENT-MIB::sysUpTimeInstance = Timeticks: (8984873) 1 day, 0:57:28.73
SNMPv2-MIB::snmpTrapOID.0 = OID: NOTIFICATION-TEST-MIB::demo-notif       SNMPv2-MIB::sysLocation.0 = STRING: just here
sh: log_it: command not found

其中just here就是我们想要的结果.

3， 自己编写处理trap脚本

建立root/bin/traps文件，输入以下内容:

#!/bin/sh
read host
read ip
vars=
while read oid val
do
    if [ "$vars" = "" ]
    then
        vars="$oid = $val"
    else
        vars="$vars, $oid = $val"
    fi
done
echo trap: $ $host $ip $vars

在manager的snmptrapd.conf加入以下几行:

traphandle SNMPv2-MIB::coldStart     /root/bin/traps cold
traphandle SNMPv2-MIB::warmStart    /root/bin/traps  warm
traphandle IF-MIB::linkDown          /root/bin/traps down
traphandle IF-MIB::linkUp            /root/bin/traps up

traphandle SNMPv2-MIB::authenticationFailure  /root/bin/traps auth
# this one is deprecated
traphandle .1.3.6.1.6.3.1.1.5.6 /root/bin/traps egp-neighbor-loss

在 manage 端 发送 trap

snmptrap -v 1 -c public 127.0.0.1:162 TRAP-TEST-MIB::demotraps 127.0.0.1 2 0 ""  IF-MIB::ifIndex i 1

snmptrap -v 2c -c public 127.0.0.1:162 "" NOTIFICATION-TEST-MIB::demo-notif SNMPv2-MIB::sysLocation.0 s "just here"

TRAP-TEST-MIB::demotraps 自定义mib 文件中的

agent端输出:

Received 96 bytes from UDP: [127.0.0.1]:44858
0000: 30 5E 02 01  01 04 06 70  75 62 6C 69  63 A7 51 02    0^.....public.Q.
0016: 04 7D BA 0E  AA 02 01 00  02 01 00 30  43 30 10 06    .}.........0C0..
0032: 08 2B 06 01  02 01 01 03  00 43 04 00  89 19 29 30    .+.......C....)0
0048: 18 06 0A 2B  06 01 06 03  01 01 04 01  00 06 0A 2B    ...+...........+
0064: 06 01 04 01  8F 65 87 5F  11 30 15 06  08 2B 06 01    .....e._.0...+..
0080: 02 01 01 06  00 04 09 6A  75 73 74 20  68 65 72 65    .......just here

2008-11-11 10:22:27 localhost [UDP: [127.0.0.1]:44858]:
DISMAN-EVENT-MIB::sysUpTimeInstance = Timeticks: (8984873) 1 day, 0:57:28.73
SNMPv2-MIB::snmpTrapOID.0 = OID: NOTIFICATION-TEST-MIB::demo-notif       SNMPv2-MIB::sysLocation.0 = STRING: just here
sh: log_it: command not found

其中just here就是我们想要的结果.

4， 让agent自动产生trap

配置agent的snmpd.conf，加入以下几行：(参考:
http://www.net-snmp.org/wiki/index.php/FAQ:Agent_17):

# From: http://www.net-snmp.org/wiki/index.php/FAQ:Agent_17
# send v1 traps
trapsink   127.0.0.1:162
# also send v2 traps
trap2sink  127.0.0.1:162
informsink 127.0.0.1:162

手动启动前台显示 snmptrapd 进行，显示消息

[root@vStack ~]# snmptrapd -d -f -Lo
NET-SNMP version 5.7.

Received  byte packet from UDP: [127.0.0.1]:->[127.0.0.1]:
:             6C    A7      0F.....public..
:   A5 1A  1E          2B  0F     .`.........+..
:  2B              1E B7      .+.......C.....
:  0A 2B              0A 2B     ..+...........+.
:    8F    7B                               ....e.{.

-- :: localhost [UDP: [127.0.0.1]:->[127.0.0.1]:]:
DISMAN-EVENT-MIB::sysUpTimeInstance = Timeticks: () ::50.79    SNMPv2-MIB::snmpTrapOID. = OID: UCD-SNMP-MIB::ucdStart
sh: page_me: 未找到命令

通过命令查看出 mib 文件保存的位置: 

[root@vStack snmp]# snmptrap -v 2c -c public 127.0.0.1: "" NOTIFICATION-TEST-MIB::demo-notif SNMPv2-MIB::sysLocation. s "just here"
MIB search path: /root/.snmp/mibs:/usr/share/snmp/mibs
Cannot find module (NOTIFICATION-TEST-MIB): At line  in (none)
NOTIFICATION-TEST-MIB::demo-notif: Unknown Object Identifier

链接： http://freeloda.blog.51cto.com/2033581/1306743/

用SNMP实现对大型网络的轻松管理  http://guojiping.blog.51cto.com/5635432/985885