How to detect incorrect OID in SNMP input plugin?

When using the SNMP input plugin, I am trying to detect when an OID does not work on the given host. For instance, when using snmpget in the command line with an OID that does not correspond to the given host, it would return

No Such Object available on this agent at this OID

However, when attempting this via logstash, there are no error logs or anything that would indicate anything is failing. However, no logs come through either. Using, for instance, a host that does not support SNMP does throw an error, such as

request has timed out

But for the case of an incorrect OID, nothing occurs. Is this just a missing feature?
Here is the pipeline:

INPUT

input {
  snmp {
    get => ["<random-oid-that-does-not-work-on-given-host>"]
    hosts => [
   {host => "udp:<host-ip-that-responds-properly-to-correct-OIDs:161>" community => "<community>" version => "2c"  retries => 2 timeout => 5000}
    ]
    mib_paths => ["/usr/share/logstash/MIB"]
    add_field => {
      "msg_type" => "<value>"
    }
  }
}

Filter left blank to minimize any bugs

OUTPUT

output {
  kafka {
    codec => json
    bootstrap_servers => "kafka01:9092,kafka02:9092"
    topic_id => "%<field>"
  }


This output works for all of our other logs that we want to send to kafka. SNMP logs that are supposed to work come through fine, and SNMP logs that break because of hosts that do not support SNMP appear in the logstash container's docker logs as exception=>#<LogStash::SnmpClientError: timeout sending snmp get request to target .

But again, nothing comes through if we intentionally use an OID that does not correspond to a host that accepts SNMP. No logs, and no errors.

Looking at the code, it looks like the plugin does not return an event unless there is data. If you enable --log.level debug you should see messages indicating where it is deciding there is no data.

1 Like

Hi Badger, Thanks for the response! Thank you for getting to the bottom of it! Question: I am using docker compose to deploy. Where can I escalate the log level to debug, and if I do, will errors and warnings still come through? Thank you so much!

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.