Original subtitles

Before

we start, I think I owe you a little bit

of some uh introduction of who I'm

actually am to be sitting here and

talking for two hours about Isab uh more

specifically about uh SNMP and SNMP

traps in Isabic. I guess for those like

who know me probably you saw me in in

YouTube in all sort of different videos

about the zabics that's how most of the

community actually found out about me

like 7 years ago I started a YouTube

channel designated for all sort of

zabics tutorials at this point we have

something around likeund and uh I guess

55ish

videos about zabics and uh at the end of

this presentation I'm also going to

share like the channel itself and and

the links to to the playlists for the

Zavix tutorial.

Um, long story short also happens to be

like where this knowledge comes from.

Um, not just from my own personal usage

of Zabix and monitoring. Um, happens to

be that I also worked in a Zavix company

uh itself for uh basically 9 years close

to that. I did start as a support

engineer. Um learned a lot about concept

of monitoring about isabics about Linux

about all sort of the different

distributions

databases scripting monitoring types and

so on and so on. Uh eventually gathered

enough knowledge and experience like to

deliver some turnkey solutions to the

customers all over the globe. um also

did uh a lot of the trainings. uh

proudly can say that I deliver the

trainings for many uh existing trainers

uh that are out there uh right now which

which is awesome and uh so yeah overall

it was like amazing journey um in in the

Zabics in the monitoring sphere and uh

over those years I gathered quite a lot

of experience and and knowledge about

all of these things which kind of makes

me uh comfortable enough to sit here in

front of you and talk about uh

interesting topics. I'm going to move

the Paul results away just to not

confuse anyone. And as you know already

like the topic today is SNMP and SNMP

traps in the Zavix 7.0 which is in my

opinion like let me move to the next

slide to at least have uh some some

movement here on the screen. In my

opinion, it could be like one of the

most

I I don't want to say like complicated,

but most needed topics that people

usually seek questions about because

what SNMP monitoring essentially means

is simple network management protocol

that was that's what SNMP stands for.

But uh in a simple word saying we talk

about SNMP

every time when we're thinking about

monitoring of some network devices and

happens to be that like again over all

those years of experience um going to

all sort of different exhibitions and

conferences about Isab

is it's the software which is like for

the network monitoring. And you guys

probably already know that the Zavix can

do like much more than just the network

monitoring. But for many people

monitoring is all around the network

stuff because you can have some sort of

the um company or or or business or some

setup building whatever let's say

without AWS setup or without a docker

setup or without posgress database that

you would want to monitor but it's very

rarely when you will have some sort of

the setup without a single network

device and all of the network devices

usually have a big impact on our

environment. Like we are getting

internet access from those network

devices which means that uh any outage

of our network device which also means

the outage of the internet would

directly impact um output of our

business potentially would lose some

money. So that is always very important

and and we worry a lot about it which

makes us wanting to like monitor all of

that stuff and uh so SNMP is internet

standard protocol for collecting and

organizing information about a managed

devices on IP networks and for modifying

that information to change device

behavior. modifying like that is

supported with the SNMP that is possible

but in terms of the Zabix we usually

talk about monitoring and devices that

typically support the SNMP include cable

modms routers network switches servers

workstations printers and more and those

are like the ones that we usually think

about but um for some it might be

surprising that you could actually

monitor like uh Windows um server

computer you can monitor a Linux machine

through the SNMP though it's not like

the most popular way how to do that

because there are much more easier and

much more convenient monitoring types.

As example on a Linux you can install

just the Zabix agent and uh most

critical metrics are going to be

accessible for you out of the box. So

there's no reason to over complicate a

setup um with a SNMP.

When we talk about SNMP um we usually

hear about we usually hear like three

different u namings. We have SNMP v1,

SNMP v2 C and SNMP v3. And as you can

tell, as you can imagine, like all of

those three are basically three

different SNMP versions, while SNMP v1

is the first one which was released uh

published in 1988.

That's quite a long time ago, right? I I

was born in 1989. So SNMPv1 was out

there to monitor your um routers and and

modms when I was not even born. um

SNMPv2 which is I would say it's like

the golden standard right now. Um

and uh that's the typical what people

use because it has like a good

compromise of uh supporting all of the

monitoring metrics. We're going to talk

a little bit in the in the next slides

like what's the main differences between

SNPv1 and V2 um and between SNMPv3 which

is the most secure but uh security and

encryption always comes with with some

price of uh performance that you need to

pay because encryption takes some time

to deliver the data right and also

complexity of the setup like if we talk

about SNMPv2 then you just need a

community string paying for SNMP v3

usually for someone who has no

experience of uh SNMP usage and as I

said like it's not the most trivial

topic in uh the monitoring and overall

uh it might be just too complicated to

set up uh monitoring with SNMPv3 because

even creating a users and setting up all

the authentification is a little bit of

a hustle. So naturally people might

think like okay SNMPv1 is old that we

know for sure SNMPv2 is like uh most

popular version of SNMP to monitor

SNMPv3 is secure uh when there's going

to be SNMPv4 and will it bring something

new and uh I've actually like yesterday

preparing for this webinar did some

research about the exact question are

there any plans for SNPv4 and I really

like the responses is that I found that

SNMPv3 is considered complete. It has

everything. It has everything that

people need to monitor network devices,

servers, uh over the over the network,

over the internet and collect all of the

data. It has security. It has

protection. It has all sort of different

abilities to collect hundreds and

thousands of the metrics. So, there's

just no need for SNMPv4.

And uh ultimately

most of the softwares and most of the

systems right now are pushing in front

of the streaming telemetry data and

telemetry data is something that uh if

you are researching some sort of the

monitoring you definitely heard about

it. Um a lot of the monitoring tools are

uh using telemetry as their like

flagship feature for for the marketing

and advertising that hey we do support a

telemetry and uh interesting to know

that also like uh Zabex uh goes in the

same direction and um like well we

cannot tell for sure until it is really

released but at least uh everything

including the road map evidences that in

a Zavix

8.0 uh we're going to have uh telemetry

monitoring uh support within a zabix. So

that's going to be a good thing. How

SNMP actually works? SNMP agent checks

UDP port 161. So what do we know about

uh UDP?

alternative is like TCP and in case of

UDP we can lose the data and that's fine

we don't really care about it so much

that's how the standard works and

basically there are two key principles

and key ways how we could collect the

data when we talk about SNMP agent that

includes all three SNMP v1 SNMP2C and

SNMP v3 as well um that goes on a port

UDP 161. Basically in this case like if

we're talking about a zabic server then

we have zabic server which makes request

over SNMP UDP port 161 to let's say some

um network device requests the data

which could be let's say um incoming

traffic on Ethernet one or CPU load of

the device or the memory usage or

operational status of the port like

there's really a lot of the metrics that

we can collect and device responds with

the actual metric.

in terms of like how do I know what do I

actually request and how do I request

that like when we talk about isabics

agent monitoring it's mostly

straightforward like you don't need to

have a deep understand understanding and

a deep knowledge of the things you

install agent as example you open

documentation look for the supported

items and they're kind of

self-explanatory right you just look

through the table and you see like oh

there is a key system CPU dot load. Do

you need more information to understand

what this metric is? Probably not. You

understand that we're talking about a

CPU. With SNMP, it's a bit more

difficult. And I guess that's the main

confusion. Uh why

so often SNMP is so difficult for many

people because

in SNMP we do the monitoring based on

oid which is like this syntax of.13.6

six and sometimes this string is like 20

30 different numbers w with the dots in

between them and each of those numbers

each of those oids actually references

some specific metric some specific data

type later again we're going to talk

about uh how can we understand what they

are what's the structure and and how to

work with all of that but alternatively

to SNMP agent checks when our Zabix

server SNMP polar as example or the

regular polar connect to the network

device and request the data receives the

response. There are also such things

about like SNMP traps and uh the

difference is

SNMP agent is uh monitoring all the time

like uh operational status up or down.

We might be monitoring this specific

port or all ports on our device and uh

even if status is okay, we are still

collecting the data. We're just checking

every 10 seconds status okay, status

okay, status okay, everything is fine.

So SNMP trap work differently. They work

on some specific event that happens on a

device. So let's say on a device we can

configure that hey when operational

status of this port goes to down I want

to send a trap and only then if it's up

I don't care so I will receive something

in my monitoring server in Zabix only

some if something is going to go off and

a good thing for you guys that like in

this webinar we're going to talk about

both of these SNMP agents and also SNMP

traps and I think also important to

mention like uh both of these

configuration is done not only on a

Zabic server you're also going to need

some input from uh network devices and

for whole of this webinar when we talk

about SNMP I'm going to focus more like

on uh network devices right routers

Cisco microte

ubiquity uh you name it right because

those are the most popular ones like

Windows Linux is also an option but uh

not not not so popular as a network

devices. So you would need some

configuration and preparation on the

network device as well which means that

uh if you're started to work in some

company as uh Zavix monitoring engineer

and you get uh a task that uh hey we're

just onboarding our Zabix uh in in in

our office in our business and you need

to set up monitoring of all our network

stuff. you're going to need access to to

that network stuff or you're going to

need someone who has access because you

will have to go to each of the devices

enable SNMP monitoring choose the

version. If you want to go with a

version two, you will need to specify

community name which is going to be used

for authentification. If you're going to

use this in a PV3, you're going to uh

need to create a users and also make

sure that some other parameters as

engine ID are set correctly. So when we

know like how the communication actually

happens. Um let me actually try to also

where do we have here?

Okay, I'll try to find it later. I

wanted to get a Q&A section but never

mind. Um, a bit more on SNMP versions

like the the theory the the plain raw

data SNMP version one uh applies with

RFC uh 1213 released in 1988. Plain text

community string uh so community string

is used for authentification. That's

just going to be like one word or or

something like that. Just some sort of

the string uh that we're going to use to

authenticate end to end that make sure

that our router authentificates with our

zabix they have community string which

matches and then we are allowed to do

the monitoring. The biggest problem with

the 7PV1 probably is that because it is

so old um it supports only 32bit

counters. And uh if right now like 32bit

counter sounds like what are you even

talking about? What does it mean? Wait

for the next slide. We're going to have

the real example of what's the

difference. Um the golden standard SNMP

version 2C uh supplies with RFC 1441 uh

released in 93. Um, so a bit younger,

right? Uh, same plain text community

string adds a support for 64-bit

counters, which allows it to still

successfully work with uh everything

modern um like internet connections and

most importantly internet speeds that

are more common um to nowadays than they

were in uh 1988.

introduces getbulk command which is uh a

more efficient way how to get like a lot

of the data from the device at once

because as I said like we cover just

small examples of uh operational status

of the port or or description of the

port or incoming traffic but imagine if

we talk about like 20 port device and on

each port you have like around 12

different metrics and multiply that with

a 20 ports plus additionally you might

have hundreds of different metrics like

uh some VPN statuses uh BGP and and all

sort of that stuff. So we're actually

talking about quite a lot of metrics

that can even reach thousands and

collecting all that data one by one um

even despite like being possible in

theory is often not efficient. So we we

need to deal with all sort of things

that allows us to gather the data in

bulk. And then SNMP version 3 RFC 2570

released in 1999

adds authentification, adds encryption,

improved error reporting and reliability

and adds multiple SNMP contexts. So

SNMPv3 is basically designated to have

um a better security. So for those

companies, businesses, environments and

uh different use cases when you really

care about uh security and privacy and

making sure that nothing bad can happen

uh in between of your monitoring

uh setup and the device that you are

monitoring, you probably want to choose

SNMPv3. Although, as I said, it's going

to be a little bit more complicated

journey to set everything up. And uh

it's also going to be a little bit

easier to make some mistakes that can

potentially cause you um spending some

time, hours or even days to troubleshoot

and understand what happened in case if

you don't know all the specifics

and uh things that you need to keep in

mind when you are working with SNMP SNMP

which is exactly what we're going to try

to cover here today. and uh going in a

bit more details like 32bit versus 64

bits. So, SNP v1 versus uh V2 and V3.

The shift from one to other in SNMP is

primarily about preventing counter

rollovers or also sometimes called as

counter overflow on high-speed

interfaces. And here is example the

traffic volume 10 gigs is roughly 1.25

25 GB per second. 32bit limit is this

crazy number of the bytes which is appro

approximately 4.3 GB rollover time at

this speed of the internet which is like

nothing big right now for for for

current time it's like nothing big.

32bit counter will hit its limit and

reset every 3.4 4 seconds. Which means

that like if we would be monitoring

um this link with a zabix with 32bit

counters uh we would just get some sort

of the graphic uh which let's say gives

us uh incoming speed outgoing speed or

something like that. And every 3.4

seconds we would have some sort of the

drop down. That would be the time when

uh the counter actually overflows. And

to fix that the solution is like 64-bit

uh counter. Uh it's also different

in terms of uh oid that you monitor. So

the actual identifier of the metric. I

previously mentioned that we have like.1

3.6 and so on and so on and so on. Um,

I think it's time for me to actually

bring up the terminal and show something

uh something real.

Give me a second. Uh,

yeah. So

what I was saying um we have

this

oid which let's say

um yeah this would be the numerical way

right the oid that I was talking about

1312 4 114 where people will usually

look at it and not understand what it

actually means but if you have a mid

files which are like a libraries of

these identifier and next to them having

a bunch of information of like what this

number actually means. Um then we see

this

as this with the actual textual

information and index in the end which

allows us to more easily perceive. So

the point that I'm trying to make is

that here I have as examples listed

32bit counter if in octets which is the

translated oid name. You can monitor if

in octets and you have a 64bit counter

if HC in octets. Right? So each of these

could also be used as some sort of

numerical oid 136121140

whatever it would match for this one. So

basically no matter if you see the

textual representation or the numbers

we're basically talking about same

stuff. This one if we have MIB files,

this one if we don't. And uh what are

actual uh differences between both

cases? Again, we're going to cover um

actually next slide. Uh management

information base, MIB, which is a

management information base, a database

used for managing the entities in the

communication network. It's exactly like

a library to help you understand what

everything is and what each number means

because every time when you get um

uh are you going to explain how to

create a template from a myip file? Not

not directly but I'm going to talk in a

way that you will understand how that

actually works. So every time we are

receiving SNMP

um SNMP data like a bunch of different

oids it's very difficult to understand

what exactly we need to monitor because

we might be talking about hundreds or

even thousands different oids. So

without any knowledge and uh without the

MIBs we might end up just having to use

Google um let's say if we have some

Cisco whatever device you might google

just Cisco uh SNMP oid for the CPU load

but the problem is that very often you

will find something which you it's hard

to verify like you can check that value

through the S&P get or through the zabix

and you will receive some value but uh

there's no guarantee that what you're

getting is actually what you want to get

like um you might be looking for CPU

load but uh the real metric that you are

receiving might be something else that's

why the MIBs are very much um

helping us to determine what is going on

and here is uh RFC definition and some

examples so I previously mentioned this

1 3 6 1 right and basically each of

these oids is like a path to the actual

metric. Here we have everything written

just in one table. So one means or three

means sorry three means org uh six means

dot internet is again one then we have

directory management 2 transmission

experimental private enterprises and so

on. And each of these numbers gets us

somewhere into the tree so that in the

end we can get to the box where we have

our information. as example if we would

be looking for something about the

interfaces the good old um interface

status uh operational status that I

talked about we need to provide this

long oid to actually get to the data

which would for us be like we can our

oid that we're monitoring can start with

a zero but it doesn't bring us anywhere

two also doesn't bring us anywhere so

for us it's going to be 1.36

6.1.2.1

and2 that is going to bring us into the

interfaces and further down like it

doesn't stop here. It just stops here on

the on the slide but actually it goes

much more deeper and under those

interfaces we would have even more data

about all sort of different stuff where

we could also find incoming traffic,

outgoing traffic, operational status and

all of the other stuff. And uh here how

it looks like from just uh different uh

perceptions. So 13612

management MIB system private Cisco

enterprise HP and and so on with the

explanation of like um what each

oid

index each box actually gives us like

system related information as example

device description or uptime interfaces

as I mentioned interface related

information example network interfaces

on the device. Some uh some MIBs and and

oids are vendor specific. As example

here you can see Cisco specific MIB,

Cisco devices, private MIB objects. And

when we talk about the SNMP monitoring,

even if we talk about the Zabix, let me

bring now a little bit of the Zabix on

the screen. Uh there we go.

We have if we talk about the templates

SNMP there's actually a lot of them

right we can see there's something from

brocade Aruba Cisco dealing Dell generic

HP and there are four pages and in total

151 uh different templates for all sort

of different SNMP devices and obviously

like not all of them you can find a lot

uh in the internet and uh there's also

integration page in asabics where you

can find a lot of community made

templates for network devices. But the

thing is that whenever we talk about the

basic data like stuff about interfaces

uh incoming traffic, outgoing traffic,

that stuff is going to work exactly the

same over all sort of different

um different vendors and different

devices. That's why in the zabix we also

have a template generic by SNMP which by

default uh probably this one will be

better network generic device by SNMP

which has 12 items and also discovery

rules that are discovering as example

network interfaces and for each

discovered inter discovered interface

they're going to create an item to

monitor um incoming octets

sent inbuilt packets, interface type,

operational status, uh discarded packets

with errors and and speed. And this is

going to be applicable for any device

may be microte, may it be Cisco again,

ubiquity where where anything else

because they are sharing the same

path and the same MIB that is shared

across all of the devices. But for each

of the vendor there usually also is

something specific and that specific

part is something that we cannot apply

to all of the devices and that's why

sometimes when we have some um if we

have some

requests from the management to set up

the monitoring of Cisco uh some specific

device model whatsoever and uh we don't

know how to create a template so we

search for something in the internet and

we find something which supposedly

matches what we are looking for and then

we import the template in a Zabix and we

see that some items work and those that

are working are probably those that are

common between all sort of uh different

vendors and some items are not supported

because those that are not supported are

most likely made to some specific

vendor, some specific device and uh

might be even also same device but just

uh different versions which also

sometimes happens because like vendors

make also some changes to um SNMP

uh libraries and and some things might

work different in between of the

versions