Multiple SNMP Inputs or Pipelines

Elastic Stack Logstash
1

Hi,

I need to use multiple SNMP Inputs but always running into the same problem. Whether I use one pipeline with two inputs or two pipelines with one input - I always get an error for one input like:

[2020-05-22T08:12:43,418][ERROR][logstash.inputs.snmp     ][main][pa_interfaces] error invoking table operation on OID: interfaces, ignoring {:exception=>#<LogStash::SnmpClientError: error sending snmp table request to target 10.3.0.110/161: Request timed out.>, :backtrace=>["/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-input-snmp-1.2.2/lib/logstash/inputs/snmp/base_client.rb:119:in `block in table'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-input-snmp-1.2.2/lib/logstash/inputs/snmp/base_client.rb:114:in `table'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-input-snmp-1.2.2/lib/logstash/inputs/snmp.rb:189:in `block in run'", "org/jruby/RubyArray.java:1809:in `each'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-input-snmp-1.2.2/lib/logstash/inputs/snmp.rb:187:in `block in run'", "org/jruby/RubyArray.java:1809:in `each'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-input-snmp-1.2.2/lib/logstash/inputs/snmp.rb:167:in run'", "/usr/share/logstash/logstash-core/lib/logstash/java_pipeline.rb:346:in inputworker'", "/usr/share/logstash/logstash-core/lib/logstash/java_pipeline.rb:337:in block in start_input'"]}

If I disable one of the inputs/pipelines everything works fine. My Configuration:

    input {
      snmp {
        id => "pa_interfaces"
        tags => "pa_interfaces"
        hosts => [{host => "udp:10.0.0.1/161" version => "3"}]
        tables => [ {"name" => "interfaces" "columns" => ["1.3.6.1.2.1.31.1.1.1.1","1.3.6.1.2.1.31.1.1.1.18","1.3.6.1.2.1.31.1.1.1.6","1.3.6.1.2.1.31.1.1.1.10"]} ]
        security_name => "my_user"
        auth_protocol => "sha"
        auth_pass => "*"
        priv_protocol => "aes"
        priv_pass => "*"
        security_level => "authPriv"
        interval => 300
        oid_root_skip => 10
      }
      snmp {
        id => "wan_interfaces"
        tags => "wan_interfaces"
        hosts => [{host => "udp:10.0.0.2/161" version => "3"}]
        tables => [ {"name" => "interfaces" "columns" => ["1.3.6.1.2.1.31.1.1.1.1","1.3.6.1.2.1.31.1.1.1.18","1.3.6.1.2.1.31.1.1.1.6","1.3.6.1.2.1.31.1.1.1.10"]} ]
        security_name => "my_user"
        auth_protocol => "sha"
        auth_pass => "*"
        priv_protocol => "des"
        priv_pass => "*"
        security_level => "authPriv"
        interval => 300
        oid_root_skip => 10
      }
    }

    output {
      elasticsearch {
        hosts => ["http://10.0.0.3:9200"]
        index => "logstash-snmp-interfaces-%{+YYYY.MM.dd}"
      }
    }

I also tried to split it to one Configurationfiles and used pipelines.yml:

    - pipeline.id: pa_interfaces
      path.config: "/etc/logstash/conf.d/snmp_pa_interfaces.conf"
    - pipeline.id: wan_interfaces
      path.config: "/etc/logstash/conf.d/snmp_wan_interfaces.conf"
2

have you tried putting the config in different directory and updates your pipelines accordingly?

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.