您当前的位置： 首页 > 学无止境 > 心得笔记 网站首页心得笔记
企业级监控系列之一——SNMP原理和实战
发布时间：2019-08-03 14:01:37编辑：雪饮阅读（）
安装snmp
既是监控端，又是被监控端
被监控端是snmp，监控端是utills，这里用一台机器既做监控端又做被监控端，所以都给安装上
[root@localhost ~]# yum install net-snmp net-snmp-utils
[root@localhost ~]# service snmpd start
Starting snmpd: [ OK ]
发起监控
一个监控示例
[root@localhost ~]# snmpwalk -v 2c -c public localhost host
HOST-RESOURCES-MIB::hrSystemUptime.0 = Timeticks: (34274) 0:05:42.74
HOST-RESOURCES-MIB::hrSystemUptime.0 = No more variables left in this MIB View (It is past the end of the MIB tree)
-v:指定snmp协议版本
-c:指定基于社区认证时的共同体字符串
localhost:监控请求的地址
host:监控对象，这里示例监控对象为host
监控对象可以不显式声明，则如
[root@localhost ~]# snmpwalk -v 2c -c public localhost
SNMPv2-MIB::sysDescr.0 = STRING: Linux localhost.localdomain 2.6.18-308.el5 #1 SMP Fri Jan 27 17:21:15 EST 2012 i686
SNMPv2-MIB::sysObjectID.0 = OID: NET-SNMP-MIB::netSnmpAgentOIDs.10
DISMAN-EVENT-MIB::sysUpTimeInstance = Timeticks: (31994) 0:05:19.94
SNMPv2-MIB::sysContact.0 = STRING: Root <root@localhost> (configure /etc/snmp/snmp.local.conf)
SNMPv2-MIB::sysName.0 = STRING: localhost.localdomain
SNMPv2-MIB::sysLocation.0 = STRING: Unknown (edit /etc/snmp/snmpd.conf)
SNMPv2-MIB::sysORLastChange.0 = Timeticks: (2) 0:00:00.02
SNMPv2-MIB::sysORID.1 = OID: SNMPv2-MIB::snmpMIB
SNMPv2-MIB::sysORID.2 = OID: TCP-MIB::tcpMIB
SNMPv2-MIB::sysORID.3 = OID: IP-MIB::ip
SNMPv2-MIB::sysORID.4 = OID: UDP-MIB::udpMIB
SNMPv2-MIB::sysORID.5 = OID: SNMP-VIEW-BASED-ACM-MIB::vacmBasicGroup
SNMPv2-MIB::sysORID.6 = OID: SNMP-FRAMEWORK-MIB::snmpFrameworkMIBCompliance
SNMPv2-MIB::sysORID.7 = OID: SNMP-MPD-MIB::snmpMPDCompliance
SNMPv2-MIB::sysORID.8 = OID: SNMP-USER-BASED-SM-MIB::usmMIBCompliance
SNMPv2-MIB::sysORDescr.1 = STRING: The MIB module for SNMPv2 entities
SNMPv2-MIB::sysORDescr.2 = STRING: The MIB module for managing TCP implementations
SNMPv2-MIB::sysORDescr.3 = STRING: The MIB module for managing IP and ICMP implementations
SNMPv2-MIB::sysORDescr.4 = STRING: The MIB module for managing UDP implementations
SNMPv2-MIB::sysORDescr.5 = STRING: View-based Access Control Model for SNMP.
SNMPv2-MIB::sysORDescr.6 = STRING: The SNMP Management Architecture MIB.
SNMPv2-MIB::sysORDescr.7 = STRING: The MIB for Message Processing and Dispatching.
SNMPv2-MIB::sysORDescr.8 = STRING: The management information definitions for the SNMP User-based Security Model.
SNMPv2-MIB::sysORUpTime.1 = Timeticks: (2) 0:00:00.02
SNMPv2-MIB::sysORUpTime.2 = Timeticks: (2) 0:00:00.02
SNMPv2-MIB::sysORUpTime.3 = Timeticks: (2) 0:00:00.02
SNMPv2-MIB::sysORUpTime.4 = Timeticks: (2) 0:00:00.02
SNMPv2-MIB::sysORUpTime.5 = Timeticks: (2) 0:00:00.02
SNMPv2-MIB::sysORUpTime.6 = Timeticks: (2) 0:00:00.02
SNMPv2-MIB::sysORUpTime.7 = Timeticks: (2) 0:00:00.02
SNMPv2-MIB::sysORUpTime.8 = Timeticks: (2) 0:00:00.02
HOST-RESOURCES-MIB::hrSystemUptime.0 = Timeticks: (61582) 0:10:15.82
HOST-RESOURCES-MIB::hrSystemUptime.0 = No more variables left in this MIB View (It is past the end of the MIB tree)
获取指定oid的监控资源
[root@localhost ~]# snmpget -v 2c -c public localhost HOST-RESOURCES-MIB::hrSystemUptime.0
HOST-RESOURCES-MIB::hrSystemUptime.0 = Timeticks: (81769) 0:13:37.69
新增监控
查找某个mib的id(可选)
在文件/usr/share/snmp/mibs/SNMPv2-MIB.txt中找到局部内容：
snmpSet OBJECT IDENTIFIER ::= { snmpMIBObjects 6 }
则该mib的id是6
新增监控
在文件/etc/snmp/snmpd.conf中
view systemview included .1.3.6.1.2.1.25.1.1
下面添加如下项
view systemview included .1.3.6.1.2.1.6
然后重启服务后就能查看到新增的监控资源了,这里监控的是tcp
[root@localhost ~]# snmpwalk -v 2c -c public localhost tcp
配置社区认证
在文件/etc/snmp/snmpd.conf中
com2sec notConfigUser default public
下方新增两行如：
com2sec notConfigUser 127.0.0.1 mypublic
com2sec notConfigUser 192.168.2.0/24 mypublic
然后将default这行注释，然后保存并重启服务后，则原来的public将在社区认证中不可用。
但使用新的社区认证mypublic则可以，如：
[root@localhost ~]# snmpwalk -v 2c -c public localhost tcp
Timeout: No Response from localhost
[root@localhost ~]# snmpwalk -v 2c -c mypublic localhost tcp
通过snmp查看远程主机的网络状态和配置信息
[root@localhost ~]# snmpnetstat -v 2c -c mypublic -Ca -Cp tcp 192.168.2.140
Active Internet (tcp) Connections (including servers)
Proto Local Address Remote Address (state)
tcp *.ssh *.* LISTEN
tcp *.sunrpc *.* LISTEN
tcp *.855 *.* LISTEN
tcp localhost.smtp *.* LISTEN
tcp localhost.smux *.* LISTEN
tcp localhost.ipp *.* LISTEN
tcp localhost.2207 *.* LISTEN
tcp localhost.2208 *.* LISTEN
tcp localhost.x11-ssh- *.* LISTEN
tcp 192.168.2.140.ssh xy-PC.lan.62539 ESTABLISHED
Cp:指定协议类型
Ca：默认的 -a （-Ca）显示活跃的 sockets
n:网络地址以数字显示，如：
[root@localhost ~]# snmpnetstat -v 2c -c mypublic -Can -Cp tcp 192.168.2.140
Active Internet (tcp) Connections (including servers)
Proto Local Address Remote Address (state)
tcp *.22 *.* LISTEN
tcp *.111 *.* LISTEN
tcp *.855 *.* LISTEN
tcp 127.0.0.1.25 *.* LISTEN
tcp 127.0.0.1.199 *.* LISTEN
tcp 127.0.0.1.631 *.* LISTEN
tcp 127.0.0.1.2207 *.* LISTEN
tcp 127.0.0.1.2208 *.* LISTEN
tcp 127.0.0.1.6010 *.* LISTEN
tcp 192.168.2.140.22 192.168.2.247.62539 ESTABLISHED
rrdtool安装
依赖
[root@localhost src]# rpm -ivh lua-5.1.4-2.el5.rf.i386.rpm
warning: lua-5.1.4-2.el5.rf.i386.rpm: Header V3 DSA signature: NOKEY, key ID 6b8d79e6
Preparing... ########################################### [100%]
1:lua ########################################### [100%]
[root@localhost src]# rpm -ivh lua-devel-5.1.4-2.el5.rf.i386.rpm
warning: lua-devel-5.1.4-2.el5.rf.i386.rpm: Header V3 DSA signature: NOKEY, key ID 6b8d79e6
Preparing... ########################################### [100%]
1:lua-devel ########################################### [100%]
rrdtool安装
[root@localhost src]# yum -y --nogpgcheck localinstall rrdtool-1.4.7-1.el5.rf.i386.rpm perl-rrdtool-1.4.7-1.el5.rf.i386.rpm
创建rrd监控数据文件
[root@localhost src]# rrdtool create test.rrd --step 5 DS:testds:GAUGE:8:0:U RRA:AVERAGE:0.5:1:17280 RRA:AVERAGE:0.5:10:3456 RRA:AVERAGE:0.5:100:1210
test.rrd:rrd监控数据文件名
--step:监控数据写入间隔，这里配置为每5秒写入一次
DS:testds:GAUGE:8:0:U
DS声明数据源：
参数1为数据源名称
参数2为数据源的存入类型
共有3种类型：
GAUGE:直接按照接收到的数据存放
COMPUTE:按上次存放数据进行递减
DERIVE:按上次存放数据进行递减(有符号)
ABSOLUTE:绝对定位进行递减，直接基于默认数据递减
参数3声明数据超时，这里声明了只要数据在8秒之内能够收到就算合法数据
参数4声明数据的最小值
参数5声明数据的最大值，U表示随便
RRA:AVERAGE:0.5:1:17280
RRA声明聚合运算,RRA可以有多个
第一个参数声明聚合算法，这里声明为平均值
第二个参数声明未定义值占该区间所有值的百分比，当达到这个定义的百分比后则本聚合运算将采取自动对未定义值按周边数据采样分析规律后初始化每个未定义值
第三个参数声明本聚合运算每多少个数据进行一次聚合运算
第四个参数声明本聚合运算最大可以聚合出多少个数据，这里示例的是1天的数据，所以就是17280
查看rrd文件格式
[root@localhost src]# rrdtool info test.rrd
filename = "test.rrd"
rrd_version = "0003"
step = 5
last_update = 1564675032
header_size = 928
ds[testds].index = 0
ds[testds].type = "GAUGE"
ds[testds].minimal_heartbeat = 8
ds[testds].min = 0.0000000000e+00
ds[testds].max = NaN
ds[testds].last_ds = "U"
ds[testds].value = 0.0000000000e+00
ds[testds].unknown_sec = 2
rra[0].cf = "AVERAGE"
rra[0].rows = 17280
rra[0].cur_row = 14535
rra[0].pdp_per_row = 1
rra[0].xff = 5.0000000000e-01
rra[0].cdp_prep[0].value = NaN
rra[0].cdp_prep[0].unknown_datapoints = 0
rra[1].cf = "AVERAGE"
rra[1].rows = 3456
rra[1].cur_row = 3002
rra[1].pdp_per_row = 10
rra[1].xff = 5.0000000000e-01
rra[1].cdp_prep[0].value = NaN
rra[1].cdp_prep[0].unknown_datapoints = 6
rra[2].cf = "AVERAGE"
rra[2].rows = 1210
rra[2].cur_row = 33
rra[2].pdp_per_row = 100
rra[2].xff = 5.0000000000e-01
rra[2].cdp_prep[0].value = NaN
rra[2].cdp_prep[0].unknown_datapoints = 6
关键字词：snmp,监控