[SOLVED]-Windows WebServer2008 R2 doesn't snmpwalk...

[Habitual]

Hello, and Happy New Year...

I have a Windows WebServer2008 R2 that I monitor, but recently, the snmp data grab has failed.
Walking the IP gives me a "Timeout: No Response from xxx.xxx.xxx.xxx".
Firewall rules haven't changed.
I have the Informant Std installed on the Windows box.

Everything was golden up to about Dec 28 when an "event" occurred on the target. The client hasn't said what may have caused this event and I haven't found anything in the logs. The Windows Service Manager restarts the SNMP Service w\out issue.

I have the W32 - Data and Graph templates installed. (I think these are the g0dSmack Templates)
I have the Windows 2000/XP Host template installed.

I don't think I want to start changing anything on the cacti server just yet, but I'm kinda of stuck on what to
look for next. Suggestions please!

Thank you for your time and have a Great New Year!

[Rno]

Start on the server (even if nothing is suppose to have changed):
check the snmp config (community, list of ip authorized to do a snmp request)
check via nestat -anp udp
that you have listener on 0.0.0.0:161 or <IP of your server>:161
just do a snmpwalk on OID .1 locally (if you have snmpwalk on it)
do again remotly, and in the same time check with netstat that you can see the udp session

[Habitual]

Thanks Rno:

The Cacti server/host is on an AWS Instance and they just did some sort of "update" (mandatory) a week, or so ago...and I am thinking that it "may" be no coincidence.

This "event" occurred on 12/25/2011 at 08:30 AM PST and perhaps the 'user' wasn't involved at all.
"last reboot" doesn't show anything for 12/25/2011, so now the plot thickens.
I gotta check my sysstat logs next...

"netstat -anp udp" doesn't show anything snmp-related at all on the cacti server.

Thanks!

[Habitual]

I believe that my INSSLR appliance is not allowed to send out upd/161 requests but I'm not certain. * see edit:

This sure looks like I should be getting data from snmpwalk:

Code: Select all

tcpdump -i eth0 dst 216.240.xxx.xxx and port 161 -c3
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on eth0, link-type EN10MB (Ethernet), capture size 65535 bytes
16:34:57.242942 IP ip-10-12-101-132.ec2.internal.55795 > lwdc.ar06.fa3-73.host10.24873.americanis.net.snmp:  C=c9cacti GetRequest(78)  E:9600.1.1.3.1.3.45.105.115.97.116.97.112.46.123.65.68.65.52.68.49.56.51.45.70.66.70.57.45.52.68.70.65.45.65.51.50.52.45.55.52.54.65.65.69.51.53.52.55.50.68.125
16:35:01.877472 IP ip-10-12-101-132.ec2.internal.56504 > lwdc.ar06.fa3-73.host10.24873.americanis.net.snmp:  C=c9cacti GetRequest(32)  E:9600.1.1.2.14.0
16:35:02.243124 IP ip-10-12-101-132.ec2.internal.55795 > lwdc.ar06.fa3-73.host10.24873.americanis.net.snmp:  C=c9cacti GetRequest(78)  E:9600.1.1.3.1.3.45.105.115.97.116.97.112.46.123.65.68.65.52.68.49.56.51.45.70.66.70.57.45.52.68.70.65.45.65.51.50.52.45.55.52.54.65.65.69.51.53.52.55.50.68.125
3 packets captured
3 packets received by filter
0 packets dropped by kernel

Still banging away...

HNY!

Edit: Doesn't wash, I get other snmp data from these templates:
SNMP - Informant Network Statistics
SNMP - Informant Memory Statistics
SNMP - Informant CPU Statistics

Still banging away...

[Habitual]

Net Informant STD - Step 10.) click Accept SNMP packets from any host.

Thanks for putting up with me.

[gandalf]

Moving to Windows Forum
R.