Search code examples
snmpnet-snmp

OID objects after PEN when using Net-SNMP extend in snmpd.conf

Linux Net-SNMP agent can be extended using a PEN (private Enterprise Number) on /etc/snmp/snmpd.conf (man snmpd.conf for details)

# from the man page: extend [MIBOID] NAME PROG ARGS
extend .1.3.6.1.4.1.32473 2 /tmp/snmp.sh

snmp.sh is a simple bash script that will echo the passed argument or current date otherwise with some weird exit codes

#!/bin/bash

if [ -n "$1" ]; then
    echo "$1"
    exit 51
fi

/bin/date '+%F %T'

exit 37

Running snmpwalk on that OID

snmpwalk -c public -v 2c 127.0.0.1 SNMPv2-SMI::enterprises.32473

Returns

SNMPv2-SMI::enterprises.32473.1.0 = INTEGER: 1
SNMPv2-SMI::enterprises.32473.2.1.2.1.50 = STRING: "/tmp/snmp.sh"
SNMPv2-SMI::enterprises.32473.2.1.3.1.50 = ""
SNMPv2-SMI::enterprises.32473.2.1.4.1.50 = ""
SNMPv2-SMI::enterprises.32473.2.1.5.1.50 = INTEGER: 5
SNMPv2-SMI::enterprises.32473.2.1.6.1.50 = INTEGER: 1
SNMPv2-SMI::enterprises.32473.2.1.7.1.50 = INTEGER: 1
SNMPv2-SMI::enterprises.32473.2.1.20.1.50 = INTEGER: 4
SNMPv2-SMI::enterprises.32473.2.1.21.1.50 = INTEGER: 1
SNMPv2-SMI::enterprises.32473.3.1.1.1.50 = STRING: "2018-06-07 20:53:44"
SNMPv2-SMI::enterprises.32473.3.1.2.1.50 = STRING: "2018-06-07 20:53:44"
SNMPv2-SMI::enterprises.32473.3.1.3.1.50 = INTEGER: 1
SNMPv2-SMI::enterprises.32473.3.1.4.1.50 = INTEGER: 37
SNMPv2-SMI::enterprises.32473.4.1.2.1.50.1 = STRING: "2018-06-07 20:53:44"

Trying to interpret the numbers 32473 is the PEN reserved for examples and documentation that can be used locally for testing purposes 50 is the decimal value of the ascii character 2, the NAME.

Using -Of or-Os with snmpwalk or snmptranslate to provide an explanation of the tree does not work and output shows the plain numbers 

snmptranslate -OS -Td SNMPv2-SMI::enterprises.32473.2.1.1.50

Result 

SNMPv2-SMI::enterprises.32473.2.1.1.50
enterprises OBJECT-TYPE
-- FROM       SNMPv2-SMI
::= { iso(1) org(3) dod(6) internet(1) private(4) enterprises(1) 32473 2 1 1 50 }

What the objects (numbers) after 32473 mean?

Solution

  • Those object numbers can be explained by comparing with the snmpwalk result of the another form of the extend option that does not use a PEN OID

    extend 3 /tmp/snmp.sh 787878

    Running a snmpwalkto get symbolic names

    snmpwalk -c public -v 2c localhost NET-SNMP-EXTEND-MIB::nsExtendObjects

    Result: 

    NET-SNMP-EXTEND-MIB::nsExtendNumEntries.0 = INTEGER: 1
NET-SNMP-EXTEND-MIB::nsExtendCommand."3" = STRING: /tmp/snmp.sh
NET-SNMP-EXTEND-MIB::nsExtendArgs."3" = STRING: 787878
NET-SNMP-EXTEND-MIB::nsExtendInput."3" = STRING:
NET-SNMP-EXTEND-MIB::nsExtendCacheTime."3" = INTEGER: 5
NET-SNMP-EXTEND-MIB::nsExtendExecType."3" = INTEGER: exec(1)
NET-SNMP-EXTEND-MIB::nsExtendRunType."3" = INTEGER: run-on-read(1)
NET-SNMP-EXTEND-MIB::nsExtendStorage."3" = INTEGER: permanent(4)
NET-SNMP-EXTEND-MIB::nsExtendStatus."3" = INTEGER: active(1)
NET-SNMP-EXTEND-MIB::nsExtendOutput1Line."3" = STRING: 787878
NET-SNMP-EXTEND-MIB::nsExtendOutputFull."3" = STRING: 787878
NET-SNMP-EXTEND-MIB::nsExtendOutNumLines."3" = INTEGER: 1
NET-SNMP-EXTEND-MIB::nsExtendResult."3" = INTEGER: 51
NET-SNMP-EXTEND-MIB::nsExtendOutLine."3".1 = STRING: 787878

    Adding -On to get the numeric output gives

    .1.3.6.1.4.1.8072.1.3.2.1.0 = INTEGER: 1
.1.3.6.1.4.1.8072.1.3.2.2.1.2.1.51 = STRING: /tmp/snmp.sh
.1.3.6.1.4.1.8072.1.3.2.2.1.3.1.51 = STRING: 787878
.1.3.6.1.4.1.8072.1.3.2.2.1.4.1.51 = STRING: 
.1.3.6.1.4.1.8072.1.3.2.2.1.5.1.51 = INTEGER: 5
.1.3.6.1.4.1.8072.1.3.2.2.1.6.1.51 = INTEGER: exec(1)
.1.3.6.1.4.1.8072.1.3.2.2.1.7.1.51 = INTEGER: run-on-read(1)
.1.3.6.1.4.1.8072.1.3.2.2.1.20.1.51 = INTEGER: permanent(4)
.1.3.6.1.4.1.8072.1.3.2.2.1.21.1.51 = INTEGER: active(1)
.1.3.6.1.4.1.8072.1.3.2.3.1.1.1.51 = STRING: 787878
.1.3.6.1.4.1.8072.1.3.2.3.1.2.1.51 = STRING: 787878
.1.3.6.1.4.1.8072.1.3.2.3.1.3.1.51 = INTEGER: 1
.1.3.6.1.4.1.8072.1.3.2.3.1.4.1.51 = INTEGER: 55
.1.3.6.1.4.1.8072.1.3.2.4.1.2.1.51.1 = STRING: 787878

    The numeric output for the PEN exercise is

     snmpwalk -On -c public -v 2c 127.0.0.1 SNMPv2-SMI::enterprises.32473

.1.3.6.1.4.1.32473.1.0 = INTEGER: 1
.1.3.6.1.4.1.32473.2.1.2.1.50 = STRING: "/tmp/snmp.sh"
.1.3.6.1.4.1.32473.2.1.3.1.50 = ""
.1.3.6.1.4.1.32473.2.1.4.1.50 = ""
.1.3.6.1.4.1.32473.2.1.5.1.50 = INTEGER: 5
.1.3.6.1.4.1.32473.2.1.6.1.50 = INTEGER: 1
.1.3.6.1.4.1.32473.2.1.7.1.50 = INTEGER: 1
.1.3.6.1.4.1.32473.2.1.20.1.50 = INTEGER: 4
.1.3.6.1.4.1.32473.2.1.21.1.50 = INTEGER: 1
.1.3.6.1.4.1.32473.3.1.1.1.50 = STRING: "2018-06-07 20:24:36"
.1.3.6.1.4.1.32473.3.1.2.1.50 = STRING: "2018-06-07 20:24:36"
.1.3.6.1.4.1.32473.3.1.3.1.50 = INTEGER: 1
.1.3.6.1.4.1.32473.3.1.4.1.50 = INTEGER: 33
.1.3.6.1.4.1.32473.4.1.2.1.50.1 = STRING: "2018-06-07 20:24:36"

    Now we can compare both exercises line by line by keeping the common part at the end and adding some convenience formatting

    Ex1: .1.3.6.1.4.1.32473. 1.0 = INTEGER: 1
    Ex2: .1.3.6.1.4.1.8072.1.3.2.1.0 = INTEGER: 1

    Doing the same for all entries and comparing line by line:

    nsExtendNumEntries   .1.0 = INTEGER: 1
nsExtendCommand      .2.1.2.1.50 = STRING: "/tmp/snmp.sh"
nsExtendArgs         .2.1.3.1.50 = ""
nsExtendInput        .3.2.1.4.1.50 = ""
nsExtendCacheTime    .2.1.5.1.50 = INTEGER: 5
nsExtendExecType     .2.1.6.1.50 = INTEGER: 1
nsExtendRunType      .2.1.7.1.50 = INTEGER: 1
nsExtendStorage      .2.1.20.1.50 = INTEGER: 4
nsExtendStatus       .2.1.21.1.50 = INTEGER: 1
nsExtendOutput1Line  .3.1.1.1.50 = STRING: "2018-06-07 20:24:36"
nsExtendOutputFull   .3.1.2.1.50 = STRING: "2018-06-07 20:24:36"
nsExtendOutNumLines  .3.1.3.1.50 = INTEGER: 1
nsExtendResult       .3.1.4.1.50 = INTEGER: 37
nsExtendOutLine      .4.1.2.1.50.1 = STRING: "2018-06-07 20:24:36"