SNMP Modular Input

Overview

Details

SNMP Modular Input to poll attribute values and catch traps

SNMP Modular Input v1.4.2

By Damien Dallimore

Overview

This is a Splunk modular input add-on for polling SNMP attributes and catching traps.

Activation Key

You require an activation key to use this App. Visit http://www.baboonbones.com/#activation to obtain a non-expiring key

Features

Simple UI based configuration
Capture SNMP traps (Splunk becomes a SNMP trap daemon in its own right)
Poll SNMP object attributes
SNMP version 1,2c and 3 support
Declare objects to poll in textual or numeric format
Ships with a wide selection of standard industry MIBs
Add in your own Custom MIBs
Walk object trees using GET BULK
Optionally index bulk results as individual events in Splunk
Monitor 1 or more Objects per stanza
Create as many SNMP input stanzas as you require
IPv4 and IPv6 support
Indexes SNMP events in key=value semantic format
Plug in your own custom response handler for formatting or pre-processing
Ships with some additional custom field extractions

Dependencies

Splunk 5.0+
Supported on Windows, Linux, MacOS, Solaris, FreeBSD, HP-UX, AIX

Setup

Untar the release to your $SPLUNK_HOME/etc/apps directory
Restart Splunk
If you are using a Splunk UI Browse to Settings -- Data Inputs -- SNMP to add a new Input stanza via the UI
If you are not using a Splunk UI (ie: you are running on a Universal Forwarder) , you need to add a stanza to inputs.conf directly as per the specification in README/inputs.conf.spec. The inputs.conf file should be placed in a local directory under an App or User context.

SNMP Version 3 Crypto Libraries

If you are using SNMP version 3 , you have to obtain, build and add the pycrypto package yourself :

https://pypi.python.org/pypi/pycrypto

The simplest way is to build pycrypto and drop the "Crypto" directory in $SPLUNK_HOME/etc/apps/snmp_ta/bin.
I don't recommend installing the pycrypto package to the Splunk Python runtime's site-packages, this could have unforeseen side effects.

Building and installing PyCrypto

I do not bundle the pycrypto module with the core release , because :

you need to build it for each separate platform
US export controls for encrypted software

So , here are a few instructions for building and installing pycrypto yourself :

Download the pycrypto package from https://pypi.python.org/pypi/pycrypto
Then run these 3 commands (note : you will need to use a System python 2.7 runtime , not the Splunk python runtime)
```
python setup.py build
python setup.py install
python setup.py test
```
Browse to where the Crypto module was installed to ie: /usr/local/lib/python2.7/dist-packages/Crypto
Copy the "Crypto" directory to $SPLUNK_HOME/etc/apps/snmp_ta/bin

Adding Custom MIBs

The pysnmp library is used under the hood so you need to convert your plain text MIB files into python modules.

Many industry standard MIBs ship with the Modular Input.
You can see which MIBs are available by looking in SPLUNK_HOME/etc/apps/snmp_ta/bin/mibs/pysnmp_mibs-0.1.4-py2.7.egg

Any additional custom MIBs need to be converted into Python Modules.

Follow the steps in this blog : https://www.baboonbones.com/blog/loading-custom-vendor-mibs-snmp-modular-input/

Custom Response Handlers

You can provide your own custom Response Handler. This is a Python class that you should add to the snmp_ta/bin/responsehandlers.py module.

You can then declare this class name and any parameters in the SNMP Modular Input setup page.

For the most part the Default Response Handler should suffice.

But there may be situations where you want to format the response in a manner that is more convenient for handling your data ie: CSV or JSON.

Furthermore , you can also use a custom Response Handler implementation to perform preprocessing of your raw response data before sending it to Splunk.

Logging

Any modular input log errors will get written to $SPLUNK_HOME/var/log/splunk/splunkd.log

These are also searchable in Splunk : index=_internal error snmp.py

Troubleshooting

You are using Splunk 5+
Look for any errors in $SPLUNK_HOME/var/log/splunk/splunkd.log

Release Notes

Version 1.4.2

April 23, 2019

updated docs

Version 1.4.1

April 19, 2019

added trial key functionality

Version 1.4

March 28, 2019

docs updated

Version 1.3

May 27, 2018

Added an activation key requirement , visit http://www.baboonbones.com/#activation to obtain a free,non-expiring key
Docs updated
Splunk 7.1 compatible

Version 1.2.7

Nov. 20, 2014

Merged in community Pull requests.

Add a new option to get subtree
Add a new option to perform rDNS for trap source
Fix to resolve missing server extractions on the SNMPv3 trap receiver

Version 1.2.6

June 16, 2014

In the destination field for polling attributes , you can now optionally specify a comma delimited list of hosts

Version 1.2.5

June 13, 2014

Fixed Bug in UI that prevented declaring custom MIB Names when in listen traps mode

Version 1.2.4

May 17, 2014

Fixed host field extraction for receiving v2 traps

Version 1.2.3

March 28, 2014

Minor code tweaks

Version 1.2.2

Feb. 23, 2014

Updated the Manager UI to be simpler and more intuitive

Version 1.2.1

Feb. 13, 2014

Minor Cosmetic fixes

Version 1.2

Oct. 30, 2013

SNMP v3 support , please follow the docs regarding pycrypto dependencies

pysnmp library update to 4.2.5

Support for plugging in custom response handlers that can format the raw SNMP data in a particular format or perform preprocessing on the raw SNMP data before indexing in Splunk. Has a default response handler which produces the same output as previous versions.Also ships with an example JSONFormatterResponseHandler.

Robustified exception handling

More detailed logging

Version 1.0.6beta

July 29, 2013

Added more lenient exception handling code so that the trap listener won't terminate when it can't resolve an OID , and will instead just index the raw OID and print the error message to splunkd.log

Version 1.0.5beta

July 15, 2013

For custom MIBS , added the ability to drop plain python(.py) files into the bin/mibs directory , no need to egg them up

Version 1.0.4beta

June 27, 2013

Tweaked the Manager UI list view

Version 1.0.3beta

June 23, 2013

Got MIB resolution working properly for traps and attribute polling , added a config field so you can declare any MIB names you want applied, any custom MIBs still need to be converted into Python modules first(see the docs) ++ Added a config option to split out "get bulk" results into individually indexed events ++ changed the setup screen layout to be better organised

Version 1.0.2beta

June 20, 2013

Renamed the manager xml file to avoid naming clashes

Version 1.0.1beta

May 30, 2013

Some minor script tweaks around custom MIB loading

Version 1.0beta

May 23, 2013

1,116

Installs

21,014

Downloads

Share Subscribe LOGIN TO DOWNLOAD

Version

Built by

BaboonBones Ltd

Contributors

BaboonBones Ltd

Support

Developer Supported

Contact Developer Questions on Splunk Answers Flag as inappropriate

App Contents: Inputs