Logstash with snmp does not run for multiple 'GET' requests

Elastic Stack Logstash
1

Good morning everyone,
I have a problem when running my configuration file in logstash, it does not show me the metrics that I am requesting with the GET method, I've been doing some tests and I realized that when I try to add two more oids there begins the failure, but if I remove those two there if I serve me all right. That is, the problem occurs when I add more OIDS with the GET method.

image
image1728×887 99.8 KB

This works fine for me, but if I add more oid in this field, the problem starts in the execution.

This is my code :

input {
  snmp {
    get => ["1.3.6.1.2.1.1.5.0", "1.3.6.1.4.1.9.9.109.1.1.1.1.7.1", "1.3.6.1.4.1.9.2.1.57.0", "1.3.6.1.4.1.9.9.48.1.1.1.5.1", "1.3.6.1.4.1.9.9.109.1.1.1.1.12.1"]
    get => ["1.3.6.1.4.1.9.9.109.1.1.1.1.13.1", "1.3.6.1.4.1.9.9.48.1.1.1.6.1"]
    get => ["1.3.6.1.2.1.31.1.1.1.1.2", "1.3.6.1.2.1.31.1.1.1.1.7", "1.3.6.1.2.1.31.1.1.1.1.44", "1.3.6.1.2.1.31.1.1.1.1.46", "1.3.6.1.2.1.31.1.1.1.1.47", "1.3.6.1.2.1.31.1.1.1.1.61", "1.3.6.1.2.1.31.1.1.1.1.62", "1.3.6.1.2.1.31.1.1.1.1.37", "1.3.6.1.2.1.31.1.1.1.1.38"]
    get => ["1.3.6.1.2.1.31.1.1.1.18.2", "1.3.6.1.2.1.31.1.1.1.18.7", "1.3.6.1.2.1.31.1.1.1.18.44", "1.3.6.1.2.1.31.1.1.1.18.46", "1.3.6.1.2.1.31.1.1.1.18.47", "1.3.6.1.2.1.31.1.1.1.18.61", "1.3.6.1.2.1.31.1.1.1.18.62", "1.3.6.1.2.1.31.1.1.1.18.37", "1.3.6.1.2.1.31.1.1.1.18.38"]
    get => ["1.3.6.1.2.1.31.1.1.1.15.2", "1.3.6.1.2.1.31.1.1.1.15.7", "1.3.6.1.2.1.31.1.1.1.15.44", "1.3.6.1.2.1.31.1.1.1.15.46", "1.3.6.1.2.1.31.1.1.1.15.47", "1.3.6.1.2.1.31.1.1.1.15.61", "1.3.6.1.2.1.31.1.1.1.15.62", "1.3.6.1.2.1.31.1.1.1.15.37", "1.3.6.1.2.1.31.1.1.1.15.38"]
   # get => ["1.3.6.1.2.1.2.2.1.10.2", "1.3.6.1.2.1.2.2.1.10.7", "1.3.6.1.2.1.2.2.1.10.44", "1.3.6.1.2.1.2.2.1.10.46", "1.3.6.1.2.1.2.2.1.10.47", "1.3.6.1.2.1.2.2.1.10.61", "1.3.6.1.2.1.2.2.1.10.62", "1.3.6.1.2.1.2.2.1.10.37", "1.3.6.1.2.1.2.2.1.10.38"]
    get => ["1.3.6.1.2.1.2.2.1.16.2", "1.3.6.1.2.1.2.2.1.16.7", "1.3.6.1.2.1.2.2.1.16.44"]
    get => ["1.3.6.1.2.1.2.2.1.8.2", "1.3.6.1.2.1.2.2.1.8.7", "1.3.6.1.2.1.2.2.1.8.44", "1.3.6.1.2.1.2.2.1.8.46", "1.3.6.1.2.1.2.2.1.8.47", "1.3.6.1.2.1.2.2.1.8.61", "1.3.6.1.2.1.2.2.1.8.62", "1.3.6.1.2.1.2.2.1.8.37", "1.3.6.1.2.1.2.2.1.8.38"]
    hosts => [{host => "udp:157.253.91.6/161" community => "UA_ETB_R" version => "2c"}]
    interval => 60
       }
     }


filter {
 if [host] == "157.253.91.6" {
mutate { add_field => {"State" => 0}}
mutate { add_field => {"Estado" => "Normal"}}
  mutate {
    convert => {"MemUsagePerc" => "integer"}
        rename => ["host", "IP"]
        rename => ["iso.org.dod.internet.mgmt.mib-2.system.sysName.0", "Sysname"]
#       rename => ["iso.org.dod.internet.private.enterprises.9.9.109.1.1.1.1.7.1", ""]
        rename => ["iso.org.dod.internet.private.enterprises.9.2.1.57.0", "Cpu"]
#       rename => ["iso.org.dod.internet.private.enterprises.9.9.109.1.1.1.1.12.1", ""]
        rename => ["iso.org.dod.internet.private.enterprises.9.9.48.1.1.1.5.1", "MemUsed"]
        rename => ["iso.org.dod.internet.private.enterprises.9.9.48.1.1.1.6.1", "MemFree"]
#       rename => ["iso.org.dod.internet.private.enterprises.9.9.109.1.1.1.1.13.1", ""]
	rename => ["iso.org.dod.internet.mgmt.mib-2.ifMIB.ifMIBObjects.ifXTable.ifXEntry.ifAlias.2", "InterfazDesc1"]
	rename => ["iso.org.dod.internet.mgmt.mib-2.ifMIB.ifMIBObjects.ifXTable.ifXEntry.ifAlias.7", "InterfazDesc2"]
	rename => ["iso.org.dod.internet.mgmt.mib-2.ifMIB.ifMIBObjects.ifXTable.ifXEntry.ifAlias.44", "InterfazDesc3"]
	rename => ["iso.org.dod.internet.mgmt.mib-2.ifMIB.ifMIBObjects.ifXTable.ifXEntry.ifAlias.46", "InterfazDesc4"]
	rename => ["iso.org.dod.internet.mgmt.mib-2.ifMIB.ifMIBObjects.ifXTable.ifXEntry.ifAlias.47", "InterfazDesc5"]
	rename => ["iso.org.dod.internet.mgmt.mib-2.ifMIB.ifMIBObjects.ifXTable.ifXEntry.ifAlias.61", "InterfazDesc6"]
	rename => ["iso.org.dod.internet.mgmt.mib-2.ifMIB.ifMIBObjects.ifXTable.ifXEntry.ifAlias.62", "InterfazDesc7"]
	rename => ["iso.org.dod.internet.mgmt.mib-2.ifMIB.ifMIBObjects.ifXTable.ifXEntry.ifAlias.37", "InterfazDesc8"]
	rename => ["iso.org.dod.internet.mgmt.mib-2.ifMIB.ifMIBObjects.ifXTable.ifXEntry.ifAlias.38", "InterfazDesc9"]
	rename => ["iso.org.dod.internet.mgmt.mib-2.ifMIB.ifMIBObjects.ifXTable.ifXEntry.ifName.2", "InterfazName1"]
	rename => ["iso.org.dod.internet.mgmt.mib-2.ifMIB.ifMIBObjects.ifXTable.ifXEntry.ifName.7", "InterfazName2"]
	rename => ["iso.org.dod.internet.mgmt.mib-2.ifMIB.ifMIBObjects.ifXTable.ifXEntry.ifName.44", "InterfazName3"]
	rename => ["iso.org.dod.internet.mgmt.mib-2.ifMIB.ifMIBObjects.ifXTable.ifXEntry.ifName.46", "InterfazName4"]
	rename => ["iso.org.dod.internet.mgmt.mib-2.ifMIB.ifMIBObjects.ifXTable.ifXEntry.ifName.47", "InterfazName5"]
	rename => ["iso.org.dod.internet.mgmt.mib-2.ifMIB.ifMIBObjects.ifXTable.ifXEntry.ifName.61", "InterfazName6"]
	rename => ["iso.org.dod.internet.mgmt.mib-2.ifMIB.ifMIBObjects.ifXTable.ifXEntry.ifName.62", "InterfazName7"]
	rename => ["iso.org.dod.internet.mgmt.mib-2.ifMIB.ifMIBObjects.ifXTable.ifXEntry.ifName.37", "InterfazName8"]
	rename => ["iso.org.dod.internet.mgmt.mib-2.ifMIB.ifMIBObjects.ifXTable.ifXEntry.ifName.38", "InterfazName9"]
	rename => ["iso.org.dod.internet.mgmt.mib-2.ifMIB.ifMIBObjects.ifXTable.ifXEntry.ifHighSpeed.2", "InterfazSpeed1"]
	rename => ["iso.org.dod.internet.mgmt.mib-2.ifMIB.ifMIBObjects.ifXTable.ifXEntry.ifHighSpeed.7", "InterfazSpeed2"]
	rename => ["iso.org.dod.internet.mgmt.mib-2.ifMIB.ifMIBObjects.ifXTable.ifXEntry.ifHighSpeed.44", "InterfazSpeed3"]
	rename => ["iso.org.dod.internet.mgmt.mib-2.ifMIB.ifMIBObjects.ifXTable.ifXEntry.ifHighSpeed.46", "InterfazSpeed4"]
	rename => ["iso.org.dod.internet.mgmt.mib-2.ifMIB.ifMIBObjects.ifXTable.ifXEntry.ifHighSpeed.47", "InterfazSpeed5"]
	rename => ["iso.org.dod.internet.mgmt.mib-2.ifMIB.ifMIBObjects.ifXTable.ifXEntry.ifHighSpeed.61", "InterfazSpeed6"]
	rename => ["iso.org.dod.internet.mgmt.mib-2.ifMIB.ifMIBObjects.ifXTable.ifXEntry.ifHighSpeed.62", "InterfazSpeed7"]
	rename => ["iso.org.dod.internet.mgmt.mib-2.ifMIB.ifMIBObjects.ifXTable.ifXEntry.ifHighSpeed.37", "InterfazSpeed8"]
	rename => ["iso.org.dod.internet.mgmt.mib-2.ifMIB.ifMIBObjects.ifXTable.ifXEntry.ifHighSpeed.38", "InterfazSpeed9"]
	rename => ["iso.org.dod.internet.mgmt.mib-2.interfaces.ifTable.ifEntry.ifInOctets.2", "InterfazIn1"]
	rename => ["iso.org.dod.internet.mgmt.mib-2.interfaces.ifTable.ifEntry.ifInOctets.7", "InterfazIn2"]
	rename => ["iso.org.dod.internet.mgmt.mib-2.interfaces.ifTable.ifEntry.ifInOctets.44", "InterfazIn3"]
	rename => ["iso.org.dod.internet.mgmt.mib-2.interfaces.ifTable.ifEntry.ifInOctets.46", "InterfazIn4"]
	rename => ["iso.org.dod.internet.mgmt.mib-2.interfaces.ifTable.ifEntry.ifInOctets.47", "InterfazIn5"]
	rename => ["iso.org.dod.internet.mgmt.mib-2.interfaces.ifTable.ifEntry.ifInOctets.61", "InterfazIn6"]
	rename => ["iso.org.dod.internet.mgmt.mib-2.interfaces.ifTable.ifEntry.ifInOctets.62", "InterfazIn7"]
	rename => ["iso.org.dod.internet.mgmt.mib-2.interfaces.ifTable.ifEntry.ifInOctets.37", "InterfazIn8"]
	rename => ["iso.org.dod.internet.mgmt.mib-2.interfaces.ifTable.ifEntry.ifInOctets.38", "InterfazIn9"]
	rename => ["iso.org.dod.internet.mgmt.mib-2.interfaces.ifTable.ifEntry.ifOutOctets.2", "InterfazOut1"]
	rename => ["iso.org.dod.internet.mgmt.mib-2.interfaces.ifTable.ifEntry.ifOutOctets.7", "InterfazOut2"]
	rename => ["iso.org.dod.internet.mgmt.mib-2.interfaces.ifTable.ifEntry.ifOutOctets.44", "InterfazOut3"]
	rename => ["iso.org.dod.internet.mgmt.mib-2.interfaces.ifTable.ifEntry.ifOutOctets.46", "InterfazOut4"]
	#rename => ["iso.org.dod.internet.mgmt.mib-2.interfaces.ifTable.ifEntry.ifOutOctets.47", "InterfazOut5"]
	#rename => ["iso.org.dod.internet.mgmt.mib-2.interfaces.ifTable.ifEntry.ifOutOctets.61", "InterfazOut6"]
	#rename => ["iso.org.dod.internet.mgmt.mib-2.interfaces.ifTable.ifEntry.ifOutOctets.62", "InterfazOut7"]
	#rename => ["iso.org.dod.internet.mgmt.mib-2.interfaces.ifTable.ifEntry.ifOutOctets.37", "InterfazOut8"]
	#rename => ["iso.org.dod.internet.mgmt.mib-2.interfaces.ifTable.ifEntry.ifOutOctets.38", "InterfazOut9"]
	
}
ruby {
        code => "event.set('MemTotal', event.get('MemUsed') + event.get('MemFree'))"
}
ruby {
        code => "event.set('MemUsagePerc', (event.get('MemUsed') * 100 ) / event.get('MemTotal'))"
}
if [MemUsagePerc] > 75 {
   mutate {
    update => {"State" => 1}
    update => {"Estado" => "Alert"}
convert => { "State" => "integer" }
 }
  if [MemUsagePerc] > 85 {
   mutate { update => {"State" => 2 }
        update => {"Estado" => "Warning"}
convert => { "State" => "integer" }
 }
 if [MemUsagePerc] > 90 {
  mutate { update => {"State" => 3 }
        update => {"Estado" => "Critical"}
convert => { "State" => "integer" }}
   }
 }
}
else if [Cpu] > 70 {
  mutate {
 update => {"State" => 1}
    update => {"Estado" => "Alert"}
convert => { "State" => "integer" }
}
if [Cpu] > 80 {
 mutate { update => {"State" => 2 }
        update => {"Estado" => "Warning"}
convert => { "State" => "integer" }
}
if [Cpu] > 90 {
mutate { update => {"State" => 3 }
        update => {"Estado" => "Critical"}
convert => { "State" => "integer" }}
}
}
}
}
}

output {
stdout{}
}
2

What problem?

3

does not show me anything. It stays like this:

image
image1905×905 84.1 KB

and that happens when I add more OIDs in GET method.
if I remove the oids, then it works...

image
image1612×996 152 KB

4

Can you time a snmpwalk on the specific OIDs that are not working on logstash?

Maybe the device is taking longer to answer on those OIDs.

5

I can't, because it must be a get request since it is not an array but a specific oid.

6

It is happening when you add more OIDs or it is happening when you add an specific OID?

You can run snmpget or snmpwalk to query an specific OID if you want.

7

Just as a general FYI, please don't post pictures of text or code. They are difficult to read, impossible to search and replicate (if it's code), and some people may not be even able to see them :slight_smile:

8

when i add a specific oid, i mean it lets me add an oid up to a certain point, because if i add more through the GET method, it doesn't execute that INPUT, i don't know if it is because i pass the GET request threshold or something because it doesn't let me add more, i would like to know and get more details about that. thanks.
9

what happens is that I don't get any error from it, that's why I post an image, just so you can see the behavior, that when I add an OID, it stops working. sorry.

10

The issue is still confusing.

By specific OID I mean for example, if you add this OID 1.3.6.1.2.1.2.2.1.16.44 it won't return anything, but if you remove it then it will work?

This is happening with an specific OID number or doesn't matter what is the OID after you added a certain number of OIDs?

Those are two different issues.

As I said, maybe your device is slow to answer to some OIDs and logstash is hanging.

I would suggest that you add your OIDs one by one, and when it stop workings, run a snmpget or snmpwalk in the command line on the last OID you added to see if it is not an issue with your device.

Also, I do not know if having multiple get settings can influence something, normally I would expect them to be merged, but I didn't read the code of this input to be sure, I would also suggest to use only one get option to be sure.

11

it works. but my problem is when I add several oids like this. i.e. it does not allow many oids in a single entry in the file:

input {
  snmp {
    get => ["1.3.6.1.2.1.1.5.0", "1.3.6.1.4.1.9.9.109.1.1.1.1.7.1", "1.3.6.1.4.1.9.2.1.57.0", "1.3.6.1.4.1.9.9.48.1.1.1.5.1", "1.3.6.1.4.1.9.9.109.1.1.1.1.12.1"]
    get => ["1.3.6.1.4.1.9.9.109.1.1.1.1.13.1", "1.3.6.1.4.1.9.9.48.1.1.1.6.1"]
    get => ["1.3.6.1.2.1.31.1.1.1.1.2", "1.3.6.1.2.1.31.1.1.1.1.7", "1.3.6.1.2.1.31.1.1.1.1.44", "1.3.6.1.2.1.31.1.1.1.1.46", "1.3.6.1.2.1.31.1.1.1.1.47", "1.3.6.1.2.1.31.1.1.1.1.61", "1.3.6.1.2.1.31.1.1.1.1.62", "1.3.6.1.2.1.31.1.1.1.1.37", "1.3.6.1.2.1.31.1.1.1.1.38"]
    get => ["1.3.6.1.2.1.31.1.1.1.18.2", "1.3.6.1.2.1.31.1.1.1.18.7", "1.3.6.1.2.1.31.1.1.1.18.44", "1.3.6.1.2.1.31.1.1.1.18.46", "1.3.6.1.2.1.31.1.1.1.18.47", "1.3.6.1.2.1.31.1.1.1.18.61", "1.3.6.1.2.1.31.1.1.1.18.62", "1.3.6.1.2.1.31.1.1.1.18.37", "1.3.6.1.2.1.31.1.1.1.18.38"]
    get => ["1.3.6.1.2.1.31.1.1.1.15.2", "1.3.6.1.2.1.31.1.1.1.15.7", "1.3.6.1.2.1.31.1.1.1.15.44", "1.3.6.1.2.1.31.1.1.1.15.46", "1.3.6.1.2.1.31.1.1.1.15.47", "1.3.6.1.2.1.31.1.1.1.15.61", "1.3.6.1.2.1.31.1.1.1.15.62", "1.3.6.1.2.1.31.1.1.1.15.37", "1.3.6.1.2.1.31.1.1.1.15.38"]
   # get => ["1.3.6.1.2.1.2.2.1.10.2", "1.3.6.1.2.1.2.2.1.10.7", "1.3.6.1.2.1.2.2.1.10.44", "1.3.6.1.2.1.2.2.1.10.46", "1.3.6.1.2.1.2.2.1.10.47", "1.3.6.1.2.1.2.2.1.10.61", "1.3.6.1.2.1.2.2.1.10.62", "1.3.6.1.2.1.2.2.1.10.37", "1.3.6.1.2.1.2.2.1.10.38"]
    get => ["1.3.6.1.2.1.2.2.1.16.2", "1.3.6.1.2.1.2.2.1.16.7", "1.3.6.1.2.1.2.2.1.16.44"]
    get => ["1.3.6.1.2.1.2.2.1.8.2", "1.3.6.1.2.1.2.2.1.8.7", "1.3.6.1.2.1.2.2.1.8.44", "1.3.6.1.2.1.2.2.1.8.46", "1.3.6.1.2.1.2.2.1.8.47", "1.3.6.1.2.1.2.2.1.8.61", "1.3.6.1.2.1.2.2.1.8.62", "1.3.6.1.2.1.2.2.1.8.37", "1.3.6.1.2.1.2.2.1.8.38"]
    hosts => [{host => "udp:157.253.91.6/161" community => "UA_ETB_R" version => "2c"}]
    interval => 60
       }
     }

for example here I had to comment this line because it doesn't work if I have many OIDS.

   # get => ["1.3.6.1.2.1.2.2.1.10.2", "1.3.6.1.2.1.2.2.1.10.7", "1.3.6.1.2.1.2.2.1.10.44", "1.3.6.1.2.1.2.2.1.10.46", "1.3.6.1.2.1.2.2.1.10.47", "1.3.6.1.2.1.2.2.1.10.61", "1.3.6.1.2.1.2.2.1.10.62", "1.3.6.1.2.1.2.2.1.10.37", "1.3.6.1.2.1.2.2.1.10.38"]
12

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.