11.2. 配置 snmptrapd

在部署 snmp-gateway 前务必要配置简单的网络管理协议(SNMP)目标，因为 snmptrapd 守护进程包含您在创建 snmp-gateway 服务时指定的 auth 设置。

SNMP 网关功能提供了将 Prometheus 堆栈中生成的警报公开给 SNMP 管理平台的方法。您可以根据 snmptrapd 工具配置 SNMP 陷入目的地。此工具允许您建立一个或多个 SNMP 陷阱监听程序。

以下参数对于配置非常重要：

engine-id 是设备的唯一标识符，hex 格式，SNNV3 网关需要。红帽建议在此参数中使用 '8000C53F_CLUSTER_FSID_WITHOUT_DASHES_'。
snmp-community 是 SNMP_COMMUNITY_FOR_SNMPV2 参数，对于 SNMPV2c 网关是 public。
auth-protocol 是 AUTH_PROTOCOL，它是 SNMPV3 网关的强制性，默认情况下是 SHA。
对于 SNMPV3 网关，privacy-protocol（为 PRIVACY_PROTOCOL）是必须的。
PRIVACY_PASSWORD 是 SNMPV3 网关使用加密所必需的。
SNMP_V3_AUTH_USER_NAME 是用户名，是 SNMPV3 网关所必需的。
SNMP_V3_AUTH_PASSWORD 是密码，是 SNMPV3 网关所必需的。

先决条件

一个正在运行的 Red Hat Ceph Storage 集群。
对节点的根级别访问权限。
在 Red Hat Enterprise Linux 系统上安装 firewalld。

流程

在 SNMP 管理主机上，安装 SNMP 软件包：
示例
```
dnf install -y net-snmp-utils net-snmp
```
```
[root@host01 ~]# dnf install -y net-snmp-utils net-snmp
```
Copy to Clipboard Toggle word wrap

为 SNMP 打开端口 162 以接收警报：

示例

firewall-cmd --zone=public --add-port=162/udp
firewall-cmd --zone=public --add-port=162/udp --permanent

[root@host01 ~]# firewall-cmd --zone=public --add-port=162/udp
[root@host01 ~]# firewall-cmd --zone=public --add-port=162/udp --permanent

Copy to Clipboard

Toggle word wrap

实施管理信息基础(MIB)，以便对 SNMP 通知有意义，并增强目的地主机上的 SNMP 支持。从主存储库复制 raw 文件：https://github.com/ceph/ceph/blob/master/monitoring/snmp/CEPH-MIB.txt

示例

curl -o CEPH_MIB.txt -L https://raw.githubusercontent.com/ceph/ceph/master/monitoring/snmp/CEPH-MIB.txt
scp CEPH_MIB.txt root@host02:/usr/share/snmp/mibs

[root@host01 ~]# curl -o CEPH_MIB.txt -L https://raw.githubusercontent.com/ceph/ceph/master/monitoring/snmp/CEPH-MIB.txt
[root@host01 ~]# scp CEPH_MIB.txt root@host02:/usr/share/snmp/mibs

Copy to Clipboard

Toggle word wrap

创建 snmptrapd 目录。
示例
```
mkdir /root/snmptrapd/
```
```
[root@host01 ~]# mkdir /root/snmptrapd/
```
Copy to Clipboard Toggle word wrap

根据 SNMP 版本为每个协议创建 snmptrapd 目录中的配置文件：

语法

format2 %V\n% Agent Address: %A \n Agent Hostname: %B \n Date: %H - %J - %K - %L - %M - %Y \n Enterprise OID: %N \n Trap Type: %W \n Trap Sub-Type: %q \n Community/Infosec Context: %P \n Uptime: %T \n Description: %W \n PDU Attribute/Value Pair Array:\n%v \n -------------- \n
createuser -e 0x_ENGINE_ID_ SNMPV3_AUTH_USER_NAME AUTH_PROTOCOL SNMP_V3_AUTH_PASSWORD PRIVACY_PROTOCOL PRIVACY_PASSWORD
authuser log,execute SNMP_V3_AUTH_USER_NAME
authCommunity   log,execute,net SNMP_COMMUNITY_FOR_SNMPV2

format2 %V\n% Agent Address: %A \n Agent Hostname: %B \n Date: %H - %J - %K - %L - %M - %Y \n Enterprise OID: %N \n Trap Type: %W \n Trap Sub-Type: %q \n Community/Infosec Context: %P \n Uptime: %T \n Description: %W \n PDU Attribute/Value Pair Array:\n%v \n -------------- \n
createuser -e 0x_ENGINE_ID_ SNMPV3_AUTH_USER_NAME AUTH_PROTOCOL SNMP_V3_AUTH_PASSWORD PRIVACY_PROTOCOL PRIVACY_PASSWORD
authuser log,execute SNMP_V3_AUTH_USER_NAME
authCommunity   log,execute,net SNMP_COMMUNITY_FOR_SNMPV2

Copy to Clipboard

Toggle word wrap

对于 SNMPV2c，按如下所示创建 snmptrapd_public.conf 文件：

示例

format2 %V\n% Agent Address: %A \n Agent Hostname: %B \n Date: %H - %J - %K - %L - %M - %Y \n Enterprise OID: %N \n Trap Type: %W \n Trap Sub-Type: %q \n Community/Infosec Context: %P \n Uptime: %T \n Description: %W \n PDU Attribute/Value Pair Array:\n%v \n -------------- \n

authCommunity   log,execute,net public

format2 %V\n% Agent Address: %A \n Agent Hostname: %B \n Date: %H - %J - %K - %L - %M - %Y \n Enterprise OID: %N \n Trap Type: %W \n Trap Sub-Type: %q \n Community/Infosec Context: %P \n Uptime: %T \n Description: %W \n PDU Attribute/Value Pair Array:\n%v \n -------------- \n

authCommunity   log,execute,net public

Copy to Clipboard

Toggle word wrap

此处的 public 设置必须与部署 snmp-gateway 服务时使用的 snmp_community 设置匹配。

对于仅限通过身份验证的 SNMPV3，请创建 snmptrapd_auth.conf 文件，如下所示：

示例

format2 %V\n% Agent Address: %A \n Agent Hostname: %B \n Date: %H - %J - %K - %L - %M - %Y \n Enterprise OID: %N \n Trap Type: %W \n Trap Sub-Type: %q \n Community/Infosec Context: %P \n Uptime: %T \n Description: %W \n PDU Attribute/Value Pair Array:\n%v \n -------------- \n
createuser -e 0x8000C53Ff64f341c655d11eb8778fa163e914bcc myuser SHA mypassword
authuser log,execute myuser

format2 %V\n% Agent Address: %A \n Agent Hostname: %B \n Date: %H - %J - %K - %L - %M - %Y \n Enterprise OID: %N \n Trap Type: %W \n Trap Sub-Type: %q \n Community/Infosec Context: %P \n Uptime: %T \n Description: %W \n PDU Attribute/Value Pair Array:\n%v \n -------------- \n
createuser -e 0x8000C53Ff64f341c655d11eb8778fa163e914bcc myuser SHA mypassword
authuser log,execute myuser

Copy to Clipboard

Toggle word wrap

0x8000C53Ff64f341c655d11eb8778fa163e914bcc 字符串是 engine_id，myuser 和 mypassword 是凭证。密码安全性由 SHA 算法定义。

这与部署 snmp-gateway 守护进程的设置对应。

示例

snmp_v3_auth_username: myuser
snmp_v3_auth_password: mypassword

snmp_v3_auth_username: myuser
snmp_v3_auth_password: mypassword

Copy to Clipboard

Toggle word wrap

对于带有身份验证和加密的 SNMPV3，请创建 snmptrapd_authpriv.conf 文件，如下所示：

示例

format2 %V\n% Agent Address: %A \n Agent Hostname: %B \n Date: %H - %J - %K - %L - %M - %Y \n Enterprise OID: %N \n Trap Type: %W \n Trap Sub-Type: %q \n Community/Infosec Context: %P \n Uptime: %T \n Description: %W \n PDU Attribute/Value Pair Array:\n%v \n -------------- \n
createuser -e 0x8000C53Ff64f341c655d11eb8778fa163e914bcc myuser SHA mypassword DES mysecret
authuser log,execute myuser

format2 %V\n% Agent Address: %A \n Agent Hostname: %B \n Date: %H - %J - %K - %L - %M - %Y \n Enterprise OID: %N \n Trap Type: %W \n Trap Sub-Type: %q \n Community/Infosec Context: %P \n Uptime: %T \n Description: %W \n PDU Attribute/Value Pair Array:\n%v \n -------------- \n
createuser -e 0x8000C53Ff64f341c655d11eb8778fa163e914bcc myuser SHA mypassword DES mysecret
authuser log,execute myuser

Copy to Clipboard

Toggle word wrap

0x8000C53Ff64f341c655d11eb8778fa163e914bcc 字符串是 engine_id，myuser 和 mypassword 是凭证。密码安全性由 SHA 算法定义，而 DES 是隐私加密的类型。

这与部署 snmp-gateway 守护进程的设置对应。

示例

snmp_v3_auth_username: myuser
snmp_v3_auth_password: mypassword
snmp_v3_priv_password: mysecret

snmp_v3_auth_username: myuser
snmp_v3_auth_password: mypassword
snmp_v3_priv_password: mysecret

Copy to Clipboard

Toggle word wrap

在 SNMP 管理主机上运行守护进程：

语法

/usr/sbin/snmptrapd -M /usr/share/snmp/mibs -m CEPH-MIB.txt -f -C -c /root/snmptrapd/CONFIGURATION_FILE -Of -Lo :162

/usr/sbin/snmptrapd -M /usr/share/snmp/mibs -m CEPH-MIB.txt -f -C -c /root/snmptrapd/CONFIGURATION_FILE -Of -Lo :162

Copy to Clipboard

Toggle word wrap

示例

/usr/sbin/snmptrapd -M /usr/share/snmp/mibs -m CEPH-MIB.txt -f -C -c /root/snmptrapd/snmptrapd_auth.conf -Of -Lo :162

[root@host01 ~]# /usr/sbin/snmptrapd -M /usr/share/snmp/mibs -m CEPH-MIB.txt -f -C -c /root/snmptrapd/snmptrapd_auth.conf -Of -Lo :162

Copy to Clipboard

Toggle word wrap

如果存储集群上触发了任何警报，您可以监控 SNMP 管理主机上的输出。验证 SNMP 陷阱以及 MIB 解码的陷阱。

示例

NET-SNMP version 5.8
 Agent Address: 0.0.0.0
 Agent Hostname: <UNKNOWN>
 Date: 15 - 5 - 12 - 8 - 10 - 4461391
 Enterprise OID: .
 Trap Type: Cold Start
 Trap Sub-Type: 0
 Community/Infosec Context: TRAP2, SNMP v3, user myuser, context
 Uptime: 0
 Description: Cold Start
 PDU Attribute/Value Pair Array:
.iso.org.dod.internet.mgmt.mib-2.1.3.0 = Timeticks: (292276100) 3 days, 19:52:41.00
.iso.org.dod.internet.snmpV2.snmpModules.1.1.4.1.0 = OID: .iso.org.dod.internet.private.enterprises.ceph.cephCluster.cephNotifications.prometheus.promMgr.promMgrPrometheusInactive
.iso.org.dod.internet.private.enterprises.ceph.cephCluster.cephNotifications.prometheus.promMgr.promMgrPrometheusInactive.1 = STRING: "1.3.6.1.4.1.50495.1.2.1.6.2[alertname=CephMgrPrometheusModuleInactive]"
.iso.org.dod.internet.private.enterprises.ceph.cephCluster.cephNotifications.prometheus.promMgr.promMgrPrometheusInactive.2 = STRING: "critical"
.iso.org.dod.internet.private.enterprises.ceph.cephCluster.cephNotifications.prometheus.promMgr.promMgrPrometheusInactive.3 = STRING: "Status: critical
- Alert: CephMgrPrometheusModuleInactive
  Summary: Ceph's mgr/prometheus module is not available
  Description: The mgr/prometheus module at 10.70.39.243:9283 is unreachable. This could mean that the module has been disabled or the mgr itself is down.
Without the mgr/prometheus module metrics and alerts will no longer function. Open a shell to ceph and use 'ceph -s' to determine whether the mgr is active. If the mgr is not active, restart it, otherwise you can check the mgr/prometheus module is loaded with 'ceph mgr module ls'  and if it's not listed as enabled, enable it with 'ceph mgr module enable prometheus'"

NET-SNMP version 5.8
 Agent Address: 0.0.0.0
 Agent Hostname: <UNKNOWN>
 Date: 15 - 5 - 12 - 8 - 10 - 4461391
 Enterprise OID: .
 Trap Type: Cold Start
 Trap Sub-Type: 0
 Community/Infosec Context: TRAP2, SNMP v3, user myuser, context
 Uptime: 0
 Description: Cold Start
 PDU Attribute/Value Pair Array:
.iso.org.dod.internet.mgmt.mib-2.1.3.0 = Timeticks: (292276100) 3 days, 19:52:41.00
.iso.org.dod.internet.snmpV2.snmpModules.1.1.4.1.0 = OID: .iso.org.dod.internet.private.enterprises.ceph.cephCluster.cephNotifications.prometheus.promMgr.promMgrPrometheusInactive
.iso.org.dod.internet.private.enterprises.ceph.cephCluster.cephNotifications.prometheus.promMgr.promMgrPrometheusInactive.1 = STRING: "1.3.6.1.4.1.50495.1.2.1.6.2[alertname=CephMgrPrometheusModuleInactive]"
.iso.org.dod.internet.private.enterprises.ceph.cephCluster.cephNotifications.prometheus.promMgr.promMgrPrometheusInactive.2 = STRING: "critical"
.iso.org.dod.internet.private.enterprises.ceph.cephCluster.cephNotifications.prometheus.promMgr.promMgrPrometheusInactive.3 = STRING: "Status: critical
- Alert: CephMgrPrometheusModuleInactive
  Summary: Ceph's mgr/prometheus module is not available
  Description: The mgr/prometheus module at 10.70.39.243:9283 is unreachable. This could mean that the module has been disabled or the mgr itself is down.
Without the mgr/prometheus module metrics and alerts will no longer function. Open a shell to ceph and use 'ceph -s' to determine whether the mgr is active. If the mgr is not active, restart it, otherwise you can check the mgr/prometheus module is loaded with 'ceph mgr module ls'  and if it's not listed as enabled, enable it with 'ceph mgr module enable prometheus'"

Copy to Clipboard

Toggle word wrap

在上例中，在禁用 Prometheus 模块后生成一个警报。

11.2. 配置 snmptrapd

学习

尝试、购买和销售

社区

关于红帽文档

让开源更具包容性

關於紅帽

Theme

Red Hat legal and privacy links

Red Hat legal and privacy links