本节介绍如何配置 SNMP 集成。

有关 SNMP 配置的更多信息，请参阅 Net-SNMP 文档。要配置 SNMP 集成，请执行以下操作：

  1. 编辑 /etc/snmp/snmpd.conf。
  2. 将以下行添加到包含要连接到 SNMP 服务的系统源 IP 地址的配置文件中。您可以使用 SNMPv2c 或 SNMPv3 进行配置。
    • 以下示例将配置使用 SNMPv2c 版本通过社区字符串 vc-vcg 从 localhost 以及通过社区字符串 myentprisecommunity 从 10.0.0.0/8 对所有计数器的访问。 
      agentAddress udp:161
# com2sec sec.name source community
com2sec local localhost vc-vcg
 com2sec myenterprise 10.0.0.0/8 myentprisecommunity# group access.name sec.model sec.name 
group rogroup v2c local
 group rogroup v2c myenterpriseview all included .1 80 
# access access.name context sec.model sec.level match read write notif
access rogroup "" any noauth exact all none none#sysLocation Sitting on the Dock of the Bay
#sysContact Me <[email protected]>sysServices 72master agentx#
# Process Monitoring
## At least one 'gwd' process
proc gwd
# At least one 'mgd' process
proc mgd#
# Disk Monitoring
#
# 100MBs required on root disk, 5% free on /var, 10% free on all other disks
disk / 100000
disk /var 5%
includeAllDisks 10%#
# System Load
#
# Unacceptable 1-, 5-, and 15-minute load averages
load 12 10 5
#  "Pass-through" MIB extension command
pass_persist  .1.3.6.1.4.1.45346 /opt/vc/bin/snmpagent.py veloGateway
      注： 在上面的示例中，进程 gwd 包含网关的整个数据和控制平面。管理平面守护进程 (mgd) 负责与 Orchestrator 进行通信。该进程与 gwd 保持隔离，以便在 gwd 进程完全失败的情况下，仍然可以访问 Orchestrator 以进行所需的配置更改或软件更新，从而解决该失败问题。
    • 以下示例显示了使用 SNMPv3 版本的配置。 
      vcadmin:~$ cat /etc/snmp/snmpd.conf 
###############################################################################
#
# EXAMPLE.conf:
#  An example configuration file for configuring the Net-SNMP agent ('snmpd')
#  See the 'snmpd.conf(5)' man page for details
#
#  Some entries are deliberately commented out, and will need to be explicitly activated
#
###############################################################################
#
#  AGENT BEHAVIOUR
#

#  Listen for connections from the local system only
# agentAddress  udp:127.0.0.1:161
#  Listen for connections on all interfaces (both IPv4 *and* IPv6)
agentAddress udp:161

###############################################################################
#
#  SNMPv3 AUTHENTICATION
#
#  Note that these particular settings don't actually belong here.
#  They should be copied to the file /var/lib/snmp/snmpd.conf
#     and the passwords changed, before being uncommented in that file *only*.
#  Then restart the agent
#  createUser authOnlyUser  MD5 "remember to change this password"
#  createUser authPrivUser  SHA "remember to change this one too"  DES
#  createUser internalUser  MD5 "this is only ever used internally, but still change the password"

#  If you also change the usernames (which might be sensible),
#  then remember to update the other occurances in this example config file to match.



###############################################################################
#
#  ACCESS CONTROL
#

#  system + hrSystem groups only
   view   systemonly  included   .1.3.6.1.4.1.45346

#  Full access from the local host
#  rocommunity public  localhost
#  Default access to basic system info
   rocommunity public  default    -V systemonly

#  Full access from an example network
#  Adjust this network address to match your local settings, change the community string,
#  and check the 'agentAddress' setting above
   rocommunity secret  10.0.0.0/16

#  Full read-only access for SNMPv3
   rouser   authOnlyUser
#  Full write access for encrypted requests 
#  Remember to activate the 'createUser' lines above
   rwuser   authPrivUser   priv

#  It's no longer typically necessary to use the full 'com2sec/group/access' configuration
#  r[ow]user and r[ow]community, together with suitable views, should cover most requirements

###############################################################################
#
#  SYSTEM INFORMATION
#
#  Note that setting these values here, results in the corresponding MIB objects being 'read-only'
#  See snmpd.conf(5) for more details
sysLocation    Bay
sysContact     [email protected]
# Application + End-to-End layers
sysServices    72


#
#  Process Monitoring
#
# At least one  'mountd' process
proc  mountd

# No more than 4 'ntalkd' processes - 0 is OK
proc  ntalkd    4

# At least one 'sendmail' process, but no more than 10
proc  sendmail 10 1

#  Walk the UCD-SNMP-MIB::prTable to see the resulting output
#  Note that this table will be empty if there are no "proc" entries in the snmpd.conf file

#
#  Disk Monitoring
#
# 10MBs required on root disk, 5% free on /var, 10% free on all other disks
disk       /     10000
disk       /var  5%
includeAllDisks  10%

#  Walk the UCD-SNMP-MIB::dskTable to see the resulting output
#  Note that this table will be empty if there are no "disk" entries in the snmpd.conf file


#
#  System Load
#
# Unacceptable 1-, 5-, and 15-minute load averages
load   12 10 5

#  Walk the UCD-SNMP-MIB::laTable to see the resulting output
#  Note that this table *will* be populated, even without a "load" entry in the snmpd.conf file

###############################################################################
#
#  ACTIVE MONITORING
#
#   send SNMPv1  traps
  trapsink     localhost public
#   send SNMPv2c traps
  trap2sink    localhost public
#   send SNMPv2c INFORMs
  informsink   localhost public

#  Note that you typically only want *one* of these three lines
#  Uncommenting two (or all three) will result in multiple copies of each notification.

#
#  Event MIB - automatically generate alerts
#
# Remember to activate the 'createUser' lines above
iquerySecName   internalUser
rouser          internalUser
# generate traps on UCD error conditions
defaultMonitors          yes
# generate traps on linkUp/Down
linkUpDownNotifications  yes

###############################################################################
#
#  EXTENDING THE AGENT

#
#  Arbitrary extension commands
#
 extend    test1   /bin/echo  Hello, world!
 extend-sh test2   echo Hello, world! ; echo Hi there ; exit 35
#extend-sh test3   /bin/sh /tmp/shtest

#  Note that this last entry requires the script '/tmp/shtest' to be created first,
#    containing the same three shell commands, before the line is uncommented

#  Walk the NET-SNMP-EXTEND-MIB tables (nsExtendConfigTable, nsExtendOutput1Table
#     and nsExtendOutput2Table) to see the resulting output

#  Note that the "extend" directive supercedes the previous "exec" and "sh" directives
#  However, walking the UCD-SNMP-MIB::extTable should still returns the same output,
#     as well as the fuller results in the above tables.


#
#  "Pass-through" MIB extension command
#
#pass .1.3.6.1.4.1.8072.2.255  /bin/sh       PREFIX/local/passtest
#pass .1.3.6.1.4.1.8072.2.255  /usr/bin/perl PREFIX/local/passtest.pl

rocommunity velocloud localhost
#pass  .1.3.6.1.4.1.45346 /opt/vc/bin/snmpagent.py veloGateway
pass_persist  .1.3.6.1.4.1.45346 /opt/vc/bin/snmpagent.py veloGateway

# Note that this requires one of the two 'passtest' scripts to be installed first,
#    before the appropriate line is uncommented.
# These scripts can be found in the 'local' directory of the source distribution,
#     and are not installed automatically.

#  Walk the NET-SNMP-PASS-MIB::netSnmpPassExamples subtree to see the resulting output

#
#  AgentX Sub-agents
#
#  Run as an AgentX master agent
 master          agentx
#  Listen for network connections (from localhost)
#    rather than the default named socket /var/agentx/master
  3. 编辑 /etc/iptables/rules.v4。将以下行添加到包含要连接到 SNMP 服务的系统源 IP 的配置中。 
    # WARNING: only add targeted rules for addresses and ports
# do not add blanket drop or accept rules since Gateway will append its own rules
# and that may prevent it from functioning properly
*filter
:INPUT ACCEPT [0:0]
-A INPUT -p udp -m udp --source 127.0.0.1 --dport 161 -m comment --comment "allow SNMP port" -j ACCEPT
-A INPUT -p udp -m udp --source 10.0.0.0/8 --dport 161 -m comment --comment "allow SNMP port" -j ACCEPT
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
COMMIT
  4. 重新启动 snmp 和 iptables 服务： 
    service snmpd restart
service iptables-persistent restart
service vc_process_monitor restart