SNMP 統合

このセクションでは、SNMP 統合を設定する方法について説明します。

SNMP 設定の詳細については、Net-SNMP のドキュメントを参照してください。SNMP 統合を設定するには、次の手順を実行します。

1. /etc/snmp/snmpd.conf を編集します。
2. SNMP サービスに接続するシステムの送信元 IP アドレスを含む次の行を設定ファイルに追加します。SNMPv2c または SNMPv3 のいずれかを使用して設定できます。
   • 次の例では、ローカル ホスト（コミュニティ文字列 vc-vcg を経由）および 10.0.0.0/8（SNMPv2c バージョンでコミュニティ文字列 myentprisecommunity を使用）からすべてのカウンタにアクセスするように設定しています。

     agentAddress udp:161
     # com2sec sec.name source community
     com2sec local localhost vc-vcg
      com2sec myenterprise 10.0.0.0/8 myentprisecommunity# group access.name sec.model sec.name 
     group rogroup v2c local
      group rogroup v2c myenterpriseview all included .1 80 
     # access access.name context sec.model sec.level match read write notif
     access rogroup "" any noauth exact all none none#sysLocation Sitting on the Dock of the Bay
     #sysContact Me <[email protected]>sysServices 72master agentx#
     # Process Monitoring
     ## At least one 'gwd' process
     proc gwd
     # At least one 'mgd' process
     proc mgd#
     # Disk Monitoring
     #
     # 100MBs required on root disk, 5% free on /var, 10% free on all other disks
     disk / 100000
     disk /var 5%
     includeAllDisks 10%#
     # System Load
     #
     # Unacceptable 1-, 5-, and 15-minute load averages
     load 12 10 5
     #  "Pass-through" MIB extension command
     pass_persist  .1.3.6.1.4.1.45346 /opt/vc/bin/snmpagent.py veloGateway

     注： 上記の例では、プロセス gwd は Gateway のデータ プレーンと制御プレーン全体で構成されています。管理プレーン デーモン (mgd) は、Orchestrator との通信を行います。このプロセスは gwd から分離されています。これにより、gwd プロセス全体の障害が発生した場合でも、障害の解決に必要な設定の変更やソフトウェアの更新のために Orchestrator にアクセスできます。
   • 次の例は、SNMPv3 バージョンを使用した設定を示しています。

     vcadmin:~$ cat /etc/snmp/snmpd.conf 
     ###############################################################################
     #
     # EXAMPLE.conf:
     #  An example configuration file for configuring the Net-SNMP agent ('snmpd')
     #  See the 'snmpd.conf(5)' man page for details
     #
     #  Some entries are deliberately commented out, and will need to be explicitly activated
     #
     ###############################################################################
     #
     #  AGENT BEHAVIOUR
     #
     
     #  Listen for connections from the local system only
     # agentAddress  udp:127.0.0.1:161
     #  Listen for connections on all interfaces (both IPv4 *and* IPv6)
     agentAddress udp:161
     
     ###############################################################################
     #
     #  SNMPv3 AUTHENTICATION
     #
     #  Note that these particular settings don't actually belong here.
     #  They should be copied to the file /var/lib/snmp/snmpd.conf
     #     and the passwords changed, before being uncommented in that file *only*.
     #  Then restart the agent
     #  createUser authOnlyUser  MD5 "remember to change this password"
     #  createUser authPrivUser  SHA "remember to change this one too"  DES
     #  createUser internalUser  MD5 "this is only ever used internally, but still change the password"
     
     #  If you also change the usernames (which might be sensible),
     #  then remember to update the other occurances in this example config file to match.
     
     
     
     ###############################################################################
     #
     #  ACCESS CONTROL
     #
     
     #  system + hrSystem groups only
        view   systemonly  included   .1.3.6.1.4.1.45346
     
     #  Full access from the local host
     #  rocommunity public  localhost
     #  Default access to basic system info
        rocommunity public  default    -V systemonly
     
     #  Full access from an example network
     #  Adjust this network address to match your local settings, change the community string,
     #  and check the 'agentAddress' setting above
        rocommunity secret  10.0.0.0/16
     
     #  Full read-only access for SNMPv3
        rouser   authOnlyUser
     #  Full write access for encrypted requests 
     #  Remember to activate the 'createUser' lines above
        rwuser   authPrivUser   priv
     
     #  It's no longer typically necessary to use the full 'com2sec/group/access' configuration
     #  r[ow]user and r[ow]community, together with suitable views, should cover most requirements
     
     ###############################################################################
     #
     #  SYSTEM INFORMATION
     #
     #  Note that setting these values here, results in the corresponding MIB objects being 'read-only'
     #  See snmpd.conf(5) for more details
     sysLocation    Bay
     sysContact     [email protected]
     # Application + End-to-End layers
     sysServices    72
     
     
     #
     #  Process Monitoring
     #
     # At least one  'mountd' process
     proc  mountd
     
     # No more than 4 'ntalkd' processes - 0 is OK
     proc  ntalkd    4
     
     # At least one 'sendmail' process, but no more than 10
     proc  sendmail 10 1
     
     #  Walk the UCD-SNMP-MIB::prTable to see the resulting output
     #  Note that this table will be empty if there are no "proc" entries in the snmpd.conf file
     
     #
     #  Disk Monitoring
     #
     # 10MBs required on root disk, 5% free on /var, 10% free on all other disks
     disk       /     10000
     disk       /var  5%
     includeAllDisks  10%
     
     #  Walk the UCD-SNMP-MIB::dskTable to see the resulting output
     #  Note that this table will be empty if there are no "disk" entries in the snmpd.conf file
     
     
     #
     #  System Load
     #
     # Unacceptable 1-, 5-, and 15-minute load averages
     load   12 10 5
     
     #  Walk the UCD-SNMP-MIB::laTable to see the resulting output
     #  Note that this table *will* be populated, even without a "load" entry in the snmpd.conf file
     
     ###############################################################################
     #
     #  ACTIVE MONITORING
     #
     #   send SNMPv1  traps
       trapsink     localhost public
     #   send SNMPv2c traps
       trap2sink    localhost public
     #   send SNMPv2c INFORMs
       informsink   localhost public
     
     #  Note that you typically only want *one* of these three lines
     #  Uncommenting two (or all three) will result in multiple copies of each notification.
     
     #
     #  Event MIB - automatically generate alerts
     #
     # Remember to activate the 'createUser' lines above
     iquerySecName   internalUser
     rouser          internalUser
     # generate traps on UCD error conditions
     defaultMonitors          yes
     # generate traps on linkUp/Down
     linkUpDownNotifications  yes
     
     ###############################################################################
     #
     #  EXTENDING THE AGENT
     
     #
     #  Arbitrary extension commands
     #
      extend    test1   /bin/echo  Hello, world!
      extend-sh test2   echo Hello, world! ; echo Hi there ; exit 35
     #extend-sh test3   /bin/sh /tmp/shtest
     
     #  Note that this last entry requires the script '/tmp/shtest' to be created first,
     #    containing the same three shell commands, before the line is uncommented
     
     #  Walk the NET-SNMP-EXTEND-MIB tables (nsExtendConfigTable, nsExtendOutput1Table
     #     and nsExtendOutput2Table) to see the resulting output
     
     #  Note that the "extend" directive supercedes the previous "exec" and "sh" directives
     #  However, walking the UCD-SNMP-MIB::extTable should still returns the same output,
     #     as well as the fuller results in the above tables.
     
     
     #
     #  "Pass-through" MIB extension command
     #
     #pass .1.3.6.1.4.1.8072.2.255  /bin/sh       PREFIX/local/passtest
     #pass .1.3.6.1.4.1.8072.2.255  /usr/bin/perl PREFIX/local/passtest.pl
     
     rocommunity velocloud localhost
     #pass  .1.3.6.1.4.1.45346 /opt/vc/bin/snmpagent.py veloGateway
     pass_persist  .1.3.6.1.4.1.45346 /opt/vc/bin/snmpagent.py veloGateway
     
     # Note that this requires one of the two 'passtest' scripts to be installed first,
     #    before the appropriate line is uncommented.
     # These scripts can be found in the 'local' directory of the source distribution,
     #     and are not installed automatically.
     
     #  Walk the NET-SNMP-PASS-MIB::netSnmpPassExamples subtree to see the resulting output
     
     #
     #  AgentX Sub-agents
     #
     #  Run as an AgentX master agent
      master          agentx
     #  Listen for network connections (from localhost)
     #    rather than the default named socket /var/agentx/master

3. /etc/iptables/rules.v4 を編集します。SNMP サービスに接続するシステムの送信元 IP アドレスを含む次の行を設定ファイルに追加します。

   # WARNING: only add targeted rules for addresses and ports
   # do not add blanket drop or accept rules since Gateway will append its own rules
   # and that may prevent it from functioning properly
   *filter
   :INPUT ACCEPT [0:0]
   -A INPUT -p udp -m udp --source 127.0.0.1 --dport 161 -m comment --comment "allow SNMP port" -j ACCEPT
   -A INPUT -p udp -m udp --source 10.0.0.0/8 --dport 161 -m comment --comment "allow SNMP port" -j ACCEPT
   :FORWARD ACCEPT [0:0]
   :OUTPUT ACCEPT [0:0]
   COMMIT

4. snmp サービスと iptables サービスを再起動します。

   service snmpd restart
   service iptables-persistent restart
   service vc_process_monitor restart