一.SNMP概述
1.SNMP:Simple Network Management Protocol,简单网络管理协议,基于UDP协议;
2.能够获取远程主机上服务,资源等信息,还能向远程主机发送指令;
3.MIB:Management Information Base,管理信息库,简而言之就是被监控端(Agent)需要被管理的资源;
5.简单工作原理:可以由Agent打开UDP:161端口,等待NMS发起请求,也可以由Agent主动发送信息给NMS的UDP:162端口;
6.Communities:public,private,为了安全起见有时候private会被禁用,但是public一定可用,当然,可以在配置文件中修改,后续会提到;
二.MIBv2 sub tree
1.比如要监控system的信息,则OID(对象标识符)为:1.3.6.1.2.1.1;
2.Internet在SNMP中OID:1.3.6.1;
3.标准MIB库OID:1.3.6.1.2.1;
4.常用OID:
三.SNMP操作
1.get:获取一个指定OID的信息;
2.getnext:指定最终节点的上一层,获取该层及以下子类的信息;
3.getbulk:和getnext类似,但是getnext只能指定最终层的父节点,而getbulk没有限制;
4.set:向对方发起控制指令;
5.getresponse:获取回应;
四.snmp安装及配置
1.安装
net-snmp:客户端;
net-snmp-utils:监控端
根据主机要求直接用yum install安装即可;
2.服务启停
service snmpd start/stop/restart /etc/init.d/snmpd start/stop/restart
service snmptrapd start/stop/restart /etc/init.d/snmptrapd start/stop/restart
3.重要文件
/etc/rc.d/init.d/snmptrapd:服务端文件
/etc/snmp/snmpd.conf:主配置文件;
/usr/sbin/snmpd:snmp程序;
/usr/sbin/snmptrapd:trapd程序;
/usr/share/snmp/mibs/*:该目录下有很多MIB库文件,其中,标准库文件为SNMPv2-MIB.txt;
SNMPv2-MIB.txt:snmpMIBObjects OBJECT IDENTIFIER ::= { snmpMIB 1 },该条指定了OID为1.3.6.1.2.1.后面的1;
4.主配置文件中的简单配置项
# sec.name source community
com2sec notConfigUser default public ==========>指定community,此处可以修改默认的public以保证安全性,default处可以指定源IP或网络
# name incl/excl subtree mask(optional)
view systemview included .1.3.6.1.2.1.1 ==============>指定标准MIB库,即SNMPv2-MIB
view systemview included .1.3.6.1.2.1.25.1.1 ===========>指定HOST-RESOURCES-MIB库
五.snmp使用
1.使用snmpwalk:
snmpwalk [APPLICATION OPTIONS] [COMMON OPTIONS] [OID]
如:
#snmpwalk -v 2c -c public localhost
-v:指定版本;
-c:community;
这条输出中只有标准库和HOST-RESOURCES-MIB,因为主配置文件中的view配置项只有这两条;
2.也可以使用snmpget指定确定的IP和OID来获取对应MIB资源信息:
#snmpget -v 2c -c public 172.25.133.17 1.3.6.1.2.1.25.1.1
HOST-RESOURCES-MIB::hrSystemUptime.0 = Timeticks: (304403644) 35 days, 5:33:56.44
HOST-RESOURCES-MIB::hrSystemUptime.0 = No more variables left in this MIB View (It is past the end of the MIB tree)
比如要获取TCP类的资源信息,可以这么做,首先找到关于TCP MIB库文件--/usr/share/snmp/mibs/TCP-MIB.txt,在文件中找到OID的配置项:tcp OBJECT IDENTIFIER ::= { mib-2 6 },可以看到在1.3.6.1.2.1.后的值为6;然后配置主配置文件的view项:view systemview included .1.3.6.1.2.1.6,保存退出,重启进程后,执行snmpwalk会发现:出现了TCP-MIB库:TCP-MIB::
[root@localhost]# snmpwalk -v 2c -c public localhost
... //其他的省略
TCP-MIB::tcpRtoAlgorithm.0 = INTEGER: other(1)TCP-MIB::tcpRtoMin.0 = INTEGER: 200 milliseconds
TCP-MIB::tcpRtoMax.0 = INTEGER: 120000 milliseconds
TCP-MIB::tcpMaxConn.0 = INTEGER: -1
TCP-MIB::tcpActiveOpens.0 = Counter32: 3922
TCP-MIB::tcpPassiveOpens.0 = Counter32: 24262
TCP-MIB::tcpAttemptFails.0 = Counter32: 55
TCP-MIB::tcpEstabResets.0 = Counter32: 4843
TCP-MIB::tcpCurrEstab.0 = Gauge32: 2
TCP-MIB::tcpInSegs.0 = Counter32: 1498854
TCP-MIB::tcpOutSegs.0 = Counter32: 1117004
TCP-MIB::tcpRetransSegs.0 = Counter32: 10824
TCP-MIB::tcpConnState.0.0.0.0.22.0.0.0.0.0 = INTEGER: listen(2)
TCP-MIB::tcpConnState.172.25.133.17.22.172.25.232.225.6102 = INTEGER: established(5)
TCP-MIB::tcpConnState.172.25.133.17.22.172.25.232.225.14881 = INTEGER: established(5)
TCP-MIB::tcpConnState.192.168.122.1.53.0.0.0.0.0 = INTEGER: listen(2)
TCP-MIB::tcpConnLocalAddress.0.0.0.0.22.0.0.0.0.0 = IpAddress: 0.0.0.0
TCP-MIB::tcpConnLocalAddress.172.25.133.17.22.172.25.232.225.6102 = IpAddress: 172.25.133.17
TCP-MIB::tcpConnLocalAddress.172.25.133.17.22.172.25.232.225.14881 = IpAddress: 172.25.133.17
TCP-MIB::tcpConnLocalAddress.192.168.122.1.53.0.0.0.0.0 = IpAddress: 192.168.122.1
TCP-MIB::tcpConnLocalPort.0.0.0.0.22.0.0.0.0.0 = INTEGER: 22
TCP-MIB::tcpConnLocalPort.0.0.0.0.111.0.0.0.0.0 = INTEGER: 111
TCP-MIB::tcpConnLocalPort.192.168.122.1.53.0.0.0.0.0 = INTEGER: 53
TCP-MIB::tcpConnRemAddress.0.0.0.0.22.0.0.0.0.0 = IpAddress: 0.0.0.0
TCP-MIB::tcpConnRemPort.0.0.0.0.22.0.0.0.0.0 = INTEGER: 0
TCP-MIB::tcpConnRemPort.172.25.133.17.22.172.25.232.225.6102 = INTEGER: 6102
TCP-MIB::tcpConnRemPort.172.25.133.17.22.172.25.232.225.14881 = INTEGER: 14881
TCP-MIB::tcpConnRemPort.192.168.122.1.53.0.0.0.0.0 = INTEGER: 0
TCP-MIB::tcpInErrs.0 = Counter32: 0
TCP-MIB::tcpOutRsts.0 = Counter32: 46274
TCP-MIB::tcpConnectionState.ipv4."172.25.133.17".22.ipv4."172.25.232.225".6102 = INTEGER: established(5)
TCP-MIB::tcpConnectionState.ipv4."172.25.133.17".22.ipv4."172.25.232.225".14881 = INTEGER: established(5)
TCP-MIB::tcpConnectionProcess.ipv4."172.25.133.17".22.ipv4."172.25.232.225".6102 = Gauge32: 15094
TCP-MIB::tcpConnectionProcess.ipv4."172.25.133.17".22.ipv4."172.25.232.225".14881 = Gauge32: 17758
TCP-MIB::tcpListenerProcess.ipv4."0.0.0.0".22 = Gauge32: 5890
TCP-MIB::tcpListenerProcess.ipv6."00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00".22 = Gauge32: 5890
可以用这种方式获取远程主机的连接数;
3.也可以用snmpnetstat:
[root@localhost]# snmpnetstat -v 2c -c public -Can -Cp tcp 172.25.133.17
Active Internet (tcp) Connections (including servers)
Proto Local Address Remote Address (state)
tcp *.22 *.* LISTEN
tcp *.111 *.* LISTEN
tcp *.3306 *.* LISTEN
tcp *.60444 *.* LISTEN
tcp 127.0.0.1.25 *.* LISTEN
tcp 127.0.0.1.199 *.* LISTEN
tcp 127.0.0.1.631 *.* LISTEN
tcp 172.25.133.17.22 172.25.232.225.6102 ESTABLISHED
tcp 172.25.133.17.22 172.25.232.225.14881 ESTABLISHED
tcp 192.168.122.1.53 *.* LISTEN