cacti agents
 

Hello Everyone...

I've been working to setup up cacti here on my test server.

I've installed Fedora Core 6 with Cacti-0.8.6j

after installing all the required tools and figuring out how to setup the database, I'm a bit confused in setting up the agents.

The computers I want to identify are Windows Systems. I've enabled the snmp.

This is a guide that I have been following but am not fully certain if it is correct:

http://cactiusers.org/wiki/SNMPWindows

Under security: I added a community called cacti and assumed that it should be notify

Under traps: I again added a community called cacti and added the trap destination of my cacti server

When I go to add the system as a device in the Cacti Admin Panel, it informs me that there is an snmp error. I did ensure that it was under the cacti snmp community.

When I look at the settings, nothing shows being created for graphs. I tried different settings.

I am trying to have my Windows XP laptop that is wireless based communicate with the linux cacti server... and i used the settings for Associated Data Queries:

Karlnet
Netware
SNMP

Just to see if anything would show up. Debugging states Verbose Query and Status = Success

my question: How do i get it going for Windows to connect to my cacti server?

well your best bet is normally to divide the problem in to two, in order to see if it's a cacti issue or a windows issue. use a mib browser, any will do on either windows or linux, and just manually query the device. you'll then be able to see if windows snmp is responding correctly for what you want to be able to obtain. under linux you should already have snmpwalk installed, so try "snmpwalk -v2c -ccacti 1.2.3.4" where 1.2.3.4 is the windows box and cacti is the community name. if that starts spewing out snmp oids then you're fine from the windows side. often you can have issues in terms of versions of snmp in use. v3 is still rare (and complicated) but v1 and v2c are standard and simple to configure. check you can successfully walk with both versions, that can often be a point of difference.

Thanx Acid.

I'll see where the configuration problems are. Excellent information you shared. Honestly "ebarrasingly", I hadn't heard of the MIB browser.

I do know that I have SNMPwalk v2 installed on my linux box. It was one of the path requirments needed when I began the install process through the administration panel. I had to use yum to find the location for its "i believe" binary files. Once found, I corrected the path.

Lhlalyam.

Tried out the snmpwalk command on the linux server to the Windows IP address and it stated that it could not communicate with the requested ip.

So, I checked the snmp agent configuration on the Windows Agent and it all seemed good. So, I checked into the event logs and found the following:

SNMP Event Log Extension Agent has terminated

I also tried the MIB Browser on the Windows agent machine and nothing seem to happen at all. No activity that is.

[EDIT]I also pinged the Server machine from the Windows machine and had success. Still no SNMP though.

would anyone have any other ideas?

well if would look like an issue within the windows box then, not cacti etc... personal firewall or aynthing?

I've disabled the firewall but nothing yet. The only difference is that I'm on wireless. I'm not to sure if this makes a difference. Lastly, should community name be the same as a domain or workgroup? or does this really matter?

Lhlalyam

well many wireless adsl routers enable some forms of firewalled seperation incase the wireless is compromised, but i'd expect that to cover pings too. and no the community name is irrelevant, just as long as it's the same... it's just a nominal password-like string, (why would you think that an open standard had to relate to a M$ proprietary concept??)

Ok... I've done some research on the router. It is a WRT54GC. What I did find is that it doesn't accept incoming snmp requests but what I didn't find is if it didn't accept LAN wirless snmp requests.

With the MIB Browser, I received information when I entered the IP Address: 127.0.0.1 with an OID of .1.3.6.1.2.1.1.1.0 and Walk. This was to test if the machine itself could receive SNMP requests.

I also did the IP address which is 192.168.1.100 and an OID of .1.3.6.1.2.1.1.1.0 and this worked also.

When I went to the linux server and did the command:
snmpwalk -v2c -ccacti 192.168.1.100
I received the following error:
Timeout: No Response from 192.168.1.100


I also did a simple command of:
snmpwalk 192.168.1.100
An error that came up was:
snmpwalk: Timeout

so, i know snmp is working on the machine, i can only assume it is the router causing this. how would i get around this to make snmp available for the LAN?

Lhlalyam

last check would be to see if the server is recieveing the snmp packets. run wireshark on it and look for the incoming packets.

is wireshark available in text mode only? just curious because my server doesn't use any graphics... text only

Lhlalyam

yes, it's called tshark. wireshark comes normally in two packages, wireshark and wireshark-gnome. with just wireshark installed, you don't need X, and only have the tshark command to run in a console. the wireshark-gnome adds the actual wireshark program itself.

Could this be the problem? Try setting the security to 'read only' and see if you can see the computer in Cacti or the MIB browser.

I tried using tshark on the cacti server with the following commands:

tshark -n -i eth0 -x port 161

and

tshark -n -i eth1 -x port 161

both came up with the same error:

tshark: the capture session could not be initiated (ioctl: No such device).

I did this command through putty and as root.

I also changed the settings on my windows clients to remove cacti from security but nothing. Any other ideas? Would definitely be nice to get this system going. I've been taking my time at this... as you may note the slow responses by the dates of my posts

well does eth1 exist? that's clearly what the cited error is.

I know eth0 shows that it has a fixed IP address as shown in ifconfig. I setup the server with a static ipaddress and it is able to receive updates when I need. I've also started the service snmpd... not to sure if this makes a difference

Lhlalyam

eth0 is not eth1 though. does eth1 exist?

Acid_kepie

Sorry for the slowness on the obviousness of your question.... no... eth1 does not exist... it only has the one card...

Lhlalyam

right so don't tcpdump on a non existant interface and you might get somewhere :)

I don't understand why it would come up with the same error for both eth0 and eth1.

One thing that I want to try is access a windows machine for snmp information from my linux laptop. This way I can tell if my router is blocking such signals or ports.

Lhlalyam

are you running tshark as root?

Yes. Most of the work I do on the server is done as root. Would this cause the problem?

Lhlalyam

Ok... I installed MIB browser on the windows machine and pointed it to the address: 127.0.0.1.... but nothing came up.. so... i know the agent isn't working there...

I installed MIB browser on my linux desktop and did a 127.0.0.1 and it worked... so... I also did the server address and it came up as well... so I know that the snmp signals can go through the router...

when i log into the cacti server to add devices... it does the search and doesn't find anything... even though snmp agent is working on my linux desktop...

Would this mean security is set in server blocking snmp?

Lhlalyam

[success]
 

Hello Acid_Kewpie

At last, I finally figured this thing out. Very slow... process of discovery... mind you, I only worked at it maybe a few hours a week.

My solution was to keep everything to public... and then enter the IP address for HostName...

I want to change HostName in the snmpd.conf but not to sure which entry to adjust. This is where I think I need to change it:

# Here is a commented out example configuration that allows less
# restrictive access.

# YOU SHOULD CHANGE THE "COMMUNITY" TOKEN BELOW TO A NEW KEYWORD ONLY
# KNOWN AT YOUR SITE. YOU *MUST* CHANGE THE NETWORK TOKEN BELOW TO
# SOMETHING REFLECTING YOUR LOCAL NETWORK ADDRESS SPACE.

## sec.name source community
#com2sec local localhost COMMUNITY
#com2sec mynetwork NETWORK/24 COMMUNITY

## group.name sec.model sec.name
#group MyRWGroup any local
#group MyROGroup any mynetwork

This way I don't have to keep entering my ip address since my network is setup with a dynamic configuration. Is the red item the one I change?

Lhlalyam

Hello again.

I figured this one out also. Now I just need to figure out how to get cacti to identify the systems by hostname instead of ip address. Just such a hassle in a dynamic environment. Any suggestions?

Lhlalyam