How to obtain useful SNMP OIDs the 'sane' way

[snappy]

What is the sane way of obtaining OIDs to poll for systems/network equipment/etc.?

The only way that I've ever used is do snmpwalks on the target system on the root OID, and filter & decipher all the OIDs to find exactly what I need.

However, do companies (such as Foundry and Cisco) give an easy to understand representation of OIDs?

I've downloaded the MIB specifications from Foudnry's website, but I cannot understand it at all. It seems to be used in conjunction with another program.

Let me just end with, I'm new to SNMP based monitoring tools, and SNMP really. All I really understand (for monitoring purposes) is to setup SNMP as read-only and use an encrypted public string, and use snmpwalk/snmpget for values which are used in monitoring programs.

Any help on my quest for useful OIDs would be much appreciated.

Thanks.

[khutton]

for cisco mibs, which contain usefull descriptions of the oid's go here

ftp://ftp.cisco.com/pub/mibs/

I suggest you install the mibs you want into the mibs dir under your installation of snmp. Put the mib files in the mib directory, and edit your snmp.conf file to include those files. Check out the documentation of your version of snmp. It is very straight forward. Thsi will makes it much easier to write a query

snmpget -OvU -c community router.yourdomain.com .ciscoMemoryPoolUsed.1

This query will return the amount of memory used on the router queried. Also if there is a missing dependency, another mib that is referenced, it will tell you what mib is missing. For example:
I have a pix515 and a 2620 router. Here are the mibs necessay to get cpu and memory info.

CISCO-MEMORY-POOL-MIB.my
CISCO-PROCESS-MIB.mib
CISCO-SMI.mib

My snmp.conf file has these entries in it:

mibfile /usr/local/snmp/share/snmp/mibs/CISCO-SMI.mib
mibfile /usr/local/snmp/share/snmp/mibs/CISCO-PROCESS-MIB.mib
mibfile /usr/local/snmp/share/snmp/mibs/CISCO-MEMORY-POOL-MIB.my

With this info, you can write mush simpler queries, like the one above.

[snappy]

What do MIB files do?

I mean, doesn't snmpwalk give you the OIDs in the first place, then you find out what ones you like, and use those with snmpget?

[Guest]

A mib file is a human readable oid. Here is the portion of the mib file that deals with the snmp query above.

ciscoMemoryPoolUsed OBJECT-TYPE
SYNTAX Gauge32
UNITS "bytes"
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"Indicates the number of bytes from the memory pool
that are currently in use by applications on the
managed device."
::= { ciscoMemoryPoolEntry 5 }

As you can see, ciscoMemoryPoolUsed, it gives you the human readable name of the value your looking for and a nice concise definition of the value. It also allows you to just look for ".ciscoMemoryPoolUsed." rather than .1.2.1.4.9.9.244.blah blah blah. Sometimes you have to be careful because you may need to add a number afterward. The example above requires the additional 1. On some queries you may need to add different numbers to correspond to... say processor "1" or processor "2" if the device is a multi processor unit. Also, snmpwalk doesnt always return all values you can request via snmp. Cisco also has a oid lookup tool if you prefer to just use numerical oid's. Search cisco's site for mib an doid and you should find it. Mib's are not mandatory for snmp, but I find them much easier to use.

[snappy]

First of all guys, let me say, thank you very much for your help so far. It is seriously much appreciated. Understanding SNMP (at least for me) is not as simple as the acronym sounds. A lot of history to it and concepts to properly understand.


So if I use an MIB file, my understanding is, that I can get access to new OIDs that snmpwalk might not catch. Also it defines a standard for that vendors product.



So for example (my understanding) I load up the cisco MIB file.

I have a cisco switch, router, firewall:

Using the OID defined in the MIB files ".ciscoMemoryPoolUsed.1" will retrieve the memory used on all 3 devices.

Whereas if I didn't have the MIB files handy, I would most likely end up with 3 different numerical OIDs that point to memory used?

Is this correct?

[Deano]

Unfortnuately not.

The MIB merely gives a mapping from an easy to read name to the numerical OID (with some explanation etc aswell in there).

If each device has a differnt numerical OID, then there is a different "descriptive" (i.e. word) oid for each aswell. There's no ability in SNMP for to simply things the way you describe. As you're learning SNMP is one of the least "simple" things around.

The MIB merely outlines in a common format the structure of the numerical OIDS and what the return vlaue signifies.

Deano

[khutton]

In the above case the single .ciscoMemoryPoolUsed.1 works for my pix and router. But Deano is correct you must understand what platforms the individual mibs work for. In my case with my cisco equipement, I have found that the majority of the oid's work on multiple platforms. Cisco has a relatively painless way or looking up mib's and the platforms they work on. Notice the word "relatively". As Deano says, you must come to an understanding that snmp is not simple and there really is nothing that should be taken as standard, since most of the time you will be working on the exception.

Here is a cisco page that allows you to view mib contents and dependencies.
http://www.cisco.com/pcgi-bin/Support/M ... o.pl?tab=4

Try working with this until you get a sense on how to use mibs. A lot of other vendors don't have a nice way of looking up mib info and you will need to be able to parse them yourself. This can be very difficult.

[snappy]

Ok, thanks guys.

I understand, vendors may or may not keep standard conventions. However certain devices could have an mib file that is not the same conventions as the other mib files for other other devices the same vendor provides.

Unfortunately I don't have Cisco equipment, but I'll try foundrys MIBs, and HOPEFULLY, poll some good traffic stats.

Btw - ifInOctets/ifOutOctets on devices are MIBs that are standard RFC ones right? Therefore the ones on Ciscos/Foundries/etc. are all the same.

Also are these values, bytes-in/sec and bytes-out/sec?

Again... thanks for the info.