Dynamic snmp

With this plugin you can perform dynamic SNMP scans.

Introduction

Ver. 22-05-2025

This plugin is designed to perform dynamic SNMP scans (e.g. interfaces where the OID changes between restarts).

Running it by default, it monitors the status of interfaces and their incoming and outgoing traffic. Its capabilities include filtering interfaces by name, as well as assigning thresholds and alerts to the modules it generates.

Tipo: Plug-in server, Agent Plug-in

Compatibility matrix

Tested and developed with Rocky linux 8/9, Fedora 34
Expected to work with Any linux system

Pre requisites

Parameters

Required parameters:

-v version
 SNMP version
-h IP
 Target IP address

SNMP specific parameters:

-c community
 SNMP community (SNMP v1 y v2c)
-u user
SNMP user name (SNMPv3 only)
-n context
Context (SNMPv3 only)
-l securityLevel
Security level (SNMPv3 only). Accepted values are "noAuthNoPriv", "authNoPriv" and "authPriv".
-a authProtocol
Authentication protocol (SNMPv3 only). It can be "MD5" or "SHA".
-A authKey
Authentication Key used in combination with the specified authentication protocol (SNMPv3 only).
-x privProtocol
Privacy protocol to be used for encrypting the transmitted data (SNMPv3 only). Accepted values are "DES" and "AES".
-X privKey
The privacy key used in conjunction with the privacy protocol to encrypt and decrypt transmitted data (SNMPv3 only).

Optional plugin parameters:

-agent agentname
 Agent name (only if running as a Server Plugin). If this parameter is omitted, the plugin will work as Agent Plugin.
-only regex
 Text string or regular expression to filter items. Only branches containing this expression in their name branch will be monitored.
-reject regex
 Text string or regular expression to filter items. Branches containing this expression in their name branch will be excluded.
-p port SNMP port of the target device. Default: 161
-d data_type Data type (auto-detected by default)
-o OID Base OID for monitoring (this is the starting point for the -branches and -names OIDs).
-names namesOID
 Sub-branch to be used as name for the modules (part of the OID denoted by -o)
-branches branches

This option specifies the branches to retrieve under the provided OIDs (part of the OID indicated by -o). The format is Branch1:OID1,Branch2:OID2,.... 

For example: ‘OperStatus:.8,AdminStatus:.7’.
-wmin wmin
 Minimum warning threshold for the generated modules
-wmax wmax
 Maximum warning threshold for the generated modules
-cmin cmin
 Minimum critical threshold for the generated modules
-cmax cmax
 Maximum critical threshold for the generated modules
-alrt alerts
 Global alerts for generated modules (e.g. ‘Critical condition’)
-group modulegroup
 Group for the generated modules
-nodefaults 1
 Disables monitoring by default (used in conjunction with -o, -names and -branches).
-interval
 Set the interval for the agent (By default 300)

Data transfer to Pandora FMS (only when running as a server plugin):

-m mode
 Transfer mode, tentacle or localcopy. Default: ‘tentacle’.
-t_ip tentacleIP
 Tentacle IP (only with ‘tentacle’ transfer mode). Default: 127.0.0.1
-t_port tentaclePort
 Tentacle port (only with ‘tentacle’ transfer mode). Default: 41121
-t_opts tentacleOpts
 Extra Tentacle options (only with ‘tentacle’ transfer mode)
-t_file_path tentaclePath
 Tentacle path (only with ‘localcopy’ transfer mode). Default: "/var/spool/pandora/data_in/"

Manual execution


The plugin execution format is as follows:

./dynamic_snmp -agent <agentname> -h <host> -v <version> [-c <community>] [-u <username>] [-a <authProtocol>] [-A <authKey>] [-x <privProtocol>] [-X <privPassword>] [-l <securityLevel>] [-o <base oid>] [-names <instance>] [-branches <branches>] [-nodefaults 1] [-t_ip <tentacleIP>] [-t_port <tentaclePort>] [-t_opts "<tentacleOptions>"] [-t_file_path "<tentaclePath>"] [-m <transferMode>] [-wmin <wmin>] [-wmax <wmax>] [-cmin <cmin>] [-cmax <cmax>] [-alrt <alert_name>] [-group <moduleGroup>]

Example of basic monitoring with SNMPv2, with everything by default and launched as an Agent plugin. It will generate OperStatus, ifInOctets and ifOutOctets modules (ifHCInOctets and ifHCOutOctets if available):

./dynamic_snmp -h "192.168.51.1" -v "2c" -c "mycommunity"

Example of basic monitoring with SNMPv2, running as a Server plugin and using the inclusion and exclusion filters. The interfaces whose name contains ‘Ge’ will be monitored, but not for those containing ‘0/3’, and will be included in the agent whose agentname is ‘Test-agentname’:

./dynamic_snmp -agent "Test-agentname" -h "192.168.51.1" -v "2c" -c "mycommunity" -only "Ge" -reject "0/3"

Same example, but using SNMPv3:

./dynamic_snmp -agent "Test-agentname" -h "192.168.51.1" -v "3" -l "authPriv" -u "snmpv3user" -a "SHA" -A "PASSWORD1" -x "AES" -X "PASSWORD2" -only "Ge" -reject "0/3"

Example of custom monitoring with SNMPv2, running as a Server plugin, deactivating the default monitoring and manually choosing the branches to monitor:

./dynamic_snmp -agent "Test-agentname" -h "192.168.51.1" -v "2c" -c "mycommunity"  -o ".1.3.6.1.2.1" -names ".2.2.1.2" -branches "OperStatus:.2.2.1.8,AdminStatus:.2.2.1.7" -nodefaults 1

Note: The quotation marks shown in the examples above are not necessary, but may avoid problems.

Configuration in Pandora FMS

To configure this as a Server plugin in Pandora FMS, you can follow these steps:

1. Upload the plugin to Pandora FMS, for example at the following path.

/usr/share/pandora_server/util/plugin

2. Create a server plugin in the Plugins section.

image.png


    3. Add name, description and timeout.

This plugin may take some time to execute, so it is recommended to configure a timeout of at least 20 seconds. It is possible that the global parameter ‘plugin_timeout’ of the pandora_server.conf should be adjusted as well.

Captura de pantalla 2025-05-22 a las 13.40.05.png

Description used in the example:

This plugin generates modules dynamically in the agent it's created in. Based on the ifName, it generates modules for:
- ifOperStatus
- ifInOctets (ifHCInOctets, if available)
- ifOutOctets (ifHCOutOctets, if available)
The value returned by the module represents the number of modules generated.


4. Add the path to the plugin in the command and the necessary parameters for its execution.  

This example is configured for monitoring interfaces with SNMPv2, indicating filters for the interfaces and status thresholds for the generated modules. The _agentname_ and _address_ server macros will be used to avoid having to manually indicate the agent name and IP address of the device in each execution.

For each parameter a macro must be configured, the syntax of this macro being the following : _fieldx_, where x is the positional number of the parameter. 

Captura de pantalla 2025-05-22 a las 13.43.29.png

Plugin parameters used in the example:

-agent "_agentname_" -h "_address_" -v "_field1_" -c "_field2_" -only "_field3_" -reject "_field4_" -wmin "_field5_" -wmax "_field6_" -cmin "_field7_" -cmax "_field8_"

5. Configure the macros shown above, adding in each one the description of the parameter.

image.png

Fields included in the example:

6. Once configured, you must create a module in an agent that will execute the plugin. In the module menu of an agent, create a module of plugin server type.

Captura de pantalla 2025-05-22 a las 16.05.33.png

7. In the module configuration menu, enter a name, select the plugin and fill in the required fields.

Captura de pantalla 2025-05-22 a las 15.51.20.png

8. Once the module is created, the plugin will run and generate the modules that match the specified filters.

Captura de pantalla 2025-05-22 a las 15.56.12.png

Agents and modules generated by the plugin

The plugin will create the modules in the selected agent with the -agent parameter. If the agentname specified does not correspond to any existing agent, a new one will be created automatically.

image.png

Captura de pantalla 2025-05-22 a las 15.56.12.png