This is an update for existing article entitled How to enable SNMP in RSA NetWitness NextGen 9.6 and above or in RSA Security Analytics.
Testing: A common method for testing SNMP is to perform an snmpwalk. It is part of the net-snmp-utils package. You can see that base MIB and netwitness-specific MIB query are working fine with following commands.
# snmpwalk -v2c -Of -c netwitness 127.0.0.1 # snmpwalk -v2c -Of -c netwitness 127.0.0.1 .1.3.6.1.4.1.36807
You can also check swap, disk usage and process using the commands below.
# snmpwalk -v2c -Of -c netwitness 127.0.0.1 .1.3.6.1.4.1.2021|grep -i swap .iso.org.dod.internet.private.enterprises.ucdavis.memory.memErrorName.0 = STRING: swap .iso.org.dod.internet.private.enterprises.ucdavis.memory.memTotalSwap.0 = INTEGER: 4194300 kB .iso.org.dod.internet.private.enterprises.ucdavis.memory.memAvailSwap.0 = INTEGER: 4194300 kB .iso.org.dod.internet.private.enterprises.ucdavis.memory.memMinimumSwap.0 = INTEGER: 1258291 kB .iso.org.dod.internet.private.enterprises.ucdavis.memory.memSwapError.0 = INTEGER: noError(0) .iso.org.dod.internet.private.enterprises.ucdavis.memory.memSwapErrorMsg.0 = STRING: .iso.org.dod.internet.private.enterprises.ucdavis.systemStats.ssRawSwapIn.0 = Counter32: 0 .iso.org.dod.internet.private.enterprises.ucdavis.systemStats.ssRawSwapOut.0 = Counter32: 0
# snmpwalk -v2c -Of -c netwitness 127.0.0.1 .1.3.6.1.4.1.2021.9 .iso.org.dod.internet.private.enterprises.ucdavis.dskTable.dskEntry.dskIndex.1 = INTEGER: 1 .iso.org.dod.internet.private.enterprises.ucdavis.dskTable.dskEntry.dskPath.1 = STRING: /var/netwitness .iso.org.dod.internet.private.enterprises.ucdavis.dskTable.dskEntry.dskDevice.1 = STRING: /dev/mapper/netwitness_vg00-nwhome .iso.org.dod.internet.private.enterprises.ucdavis.dskTable.dskEntry.dskMinimum.1 = INTEGER: -1 .iso.org.dod.internet.private.enterprises.ucdavis.dskTable.dskEntry.dskMinPercent.1 = INTEGER: 10 .iso.org.dod.internet.private.enterprises.ucdavis.dskTable.dskEntry.dskTotal.1 = INTEGER: 466282036 .iso.org.dod.internet.private.enterprises.ucdavis.dskTable.dskEntry.dskAvail.1 = INTEGER: 442960528 .iso.org.dod.internet.private.enterprises.ucdavis.dskTable.dskEntry.dskUsed.1 = INTEGER: 23321508 .iso.org.dod.internet.private.enterprises.ucdavis.dskTable.dskEntry.dskPercent.1 = INTEGER: 5 .iso.org.dod.internet.private.enterprises.ucdavis.dskTable.dskEntry.dskPercentNode.1 = INTEGER: 0 .iso.org.dod.internet.private.enterprises.ucdavis.dskTable.dskEntry.dskTotalLow.1 = Gauge32: 466282036 .iso.org.dod.internet.private.enterprises.ucdavis.dskTable.dskEntry.dskTotalHigh.1 = Gauge32: 0 .iso.org.dod.internet.private.enterprises.ucdavis.dskTable.dskEntry.dskAvailLow.1 = Gauge32: 442960528 .iso.org.dod.internet.private.enterprises.ucdavis.dskTable.dskEntry.dskAvailHigh.1 = Gauge32: 0 .iso.org.dod.internet.private.enterprises.ucdavis.dskTable.dskEntry.dskUsedLow.1 = Gauge32: 23321508 .iso.org.dod.internet.private.enterprises.ucdavis.dskTable.dskEntry.dskUsedHigh.1 = Gauge32: 0 .iso.org.dod.internet.private.enterprises.ucdavis.dskTable.dskEntry.dskErrorFlag.1 = INTEGER: noError(0) .iso.org.dod.internet.private.enterprises.ucdavis.dskTable.dskEntry.dskErrorMsg.1 = STRING:
# snmpwalk -v2c -Of -c netwitness 127.0.0.1 .1.3.6.1.4.1.2021.2 .iso.org.dod.internet.private.enterprises.ucdavis.prTable.prEntry.prIndex.1 = INTEGER: 1 .iso.org.dod.internet.private.enterprises.ucdavis.prTable.prEntry.prIndex.2 = INTEGER: 2 .iso.org.dod.internet.private.enterprises.ucdavis.prTable.prEntry.prNames.1 = STRING: NwAppliance .iso.org.dod.internet.private.enterprises.ucdavis.prTable.prEntry.prNames.2 = STRING: NwBroker .iso.org.dod.internet.private.enterprises.ucdavis.prTable.prEntry.prMin.1 = INTEGER: 1 .iso.org.dod.internet.private.enterprises.ucdavis.prTable.prEntry.prMin.2 = INTEGER: 1 .iso.org.dod.internet.private.enterprises.ucdavis.prTable.prEntry.prMax.1 = INTEGER: 1 .iso.org.dod.internet.private.enterprises.ucdavis.prTable.prEntry.prMax.2 = INTEGER: 1 .iso.org.dod.internet.private.enterprises.ucdavis.prTable.prEntry.prCount.1 = INTEGER: 1 .iso.org.dod.internet.private.enterprises.ucdavis.prTable.prEntry.prCount.2 = INTEGER: 1 .iso.org.dod.internet.private.enterprises.ucdavis.prTable.prEntry.prErrorFlag.1 = INTEGER: noError(0) .iso.org.dod.internet.private.enterprises.ucdavis.prTable.prEntry.prErrorFlag.2 = INTEGER: noError(0) .iso.org.dod.internet.private.enterprises.ucdavis.prTable.prEntry.prErrMessage.1 = STRING: .iso.org.dod.internet.private.enterprises.ucdavis.prTable.prEntry.prErrMessage.2 = STRING: .iso.org.dod.internet.private.enterprises.ucdavis.prTable.prEntry.prErrFix.1 = INTEGER: noError(0) .iso.org.dod.internet.private.enterprises.ucdavis.prTable.prEntry.prErrFix.2 = INTEGER: noError(0) .iso.org.dod.internet.private.enterprises.ucdavis.prTable.prEntry.prErrFixCmd.1 = STRING: .iso.org.dod.internet.private.enterprises.ucdavis.prTable.prEntry.prErrFixCmd.2 = STRING:
# systemctl stop nwbroker <-- stop nwbroker service for the test
# snmpwalk -v2c -Of -c netwitness 127.0.0.1 .1.3.6.1.4.1.2021.2 .iso.org.dod.internet.private.enterprises.ucdavis.prTable.prEntry.prIndex.1 = INTEGER: 1 .iso.org.dod.internet.private.enterprises.ucdavis.prTable.prEntry.prIndex.2 = INTEGER: 2 .iso.org.dod.internet.private.enterprises.ucdavis.prTable.prEntry.prNames.1 = STRING: NwAppliance .iso.org.dod.internet.private.enterprises.ucdavis.prTable.prEntry.prNames.2 = STRING: NwBroker .iso.org.dod.internet.private.enterprises.ucdavis.prTable.prEntry.prMin.1 = INTEGER: 1 .iso.org.dod.internet.private.enterprises.ucdavis.prTable.prEntry.prMin.2 = INTEGER: 1 .iso.org.dod.internet.private.enterprises.ucdavis.prTable.prEntry.prMax.1 = INTEGER: 1 .iso.org.dod.internet.private.enterprises.ucdavis.prTable.prEntry.prMax.2 = INTEGER: 1 .iso.org.dod.internet.private.enterprises.ucdavis.prTable.prEntry.prCount.1 = INTEGER: 1 .iso.org.dod.internet.private.enterprises.ucdavis.prTable.prEntry.prCount.2 = INTEGER: 0 .iso.org.dod.internet.private.enterprises.ucdavis.prTable.prEntry.prErrorFlag.1 = INTEGER: noError(0) .iso.org.dod.internet.private.enterprises.ucdavis.prTable.prEntry.prErrorFlag.2 = INTEGER: error(1) .iso.org.dod.internet.private.enterprises.ucdavis.prTable.prEntry.prErrMessage.1 = STRING: .iso.org.dod.internet.private.enterprises.ucdavis.prTable.prEntry.prErrMessage.2 = STRING: No NwBroker process running .iso.org.dod.internet.private.enterprises.ucdavis.prTable.prEntry.prErrFix.1 = INTEGER: noError(0) .iso.org.dod.internet.private.enterprises.ucdavis.prTable.prEntry.prErrFix.2 = INTEGER: noError(0) .iso.org.dod.internet.private.enterprises.ucdavis.prTable.prEntry.prErrFixCmd.1 = STRING: .iso.org.dod.internet.private.enterprises.ucdavis.prTable.prEntry.prErrFixCmd.2 = STRING:
|