Multiple SNMP Inputs

Elastic Stack Logstash
1

Hey folks,
I am running into an issue with the snmp plugin dealing with multiple hosts. Whatever host is loaded 2nd is the one that actually works while the other always times out, so in my confige file hostA world work but hostB would not.

Config:

input {
  snmp {
    get => ["1.3.6.1.4.1.2620.1.6.7.2.4.0"]
    hosts => [{host => "udp:hostB/161" version => "3"}]
    auth_pass => ["***********"]
    auth_protocol => ["md5"]
    security_name => ["monitor"]
    priv_pass => ["***********"]
    priv_protocol => ["des"]
    security_level => ["authPriv"]
    type => "snmp"
  }
  snmp {
    hosts => [{host => "udp:hostA/161" version => "3"}]
    get => ["1.3.6.1.4.1.2620.1.6.7.2.4.0"]
    auth_pass => ["*******"]
    auth_protocol => ["md5"]
    security_name => ["monitor"]
    priv_pass => ["*******"]
    priv_protocol => ["des"]
    security_level => ["authPriv"]
	type => "snmp"
  }
}

Log:

May 28 13:26:32 heartbeat logstash: [2019-05-28T13:26:32,477][ERROR][logstash.inputs.snmp     ] error invoking get operation on hostB for OIDs: ["1.3.6.1.4.1.2620.1.6.7.2.4.0"], ignoring {:exception=>#<LogStash::SnmpClientError: timeout sending snmp get request>, :backtrace=>["/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-input-snmp-1.0.1/lib/logstash/inputs/snmp/base_client.rb:59:in `get'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-input-snmp-1.0.1/lib/logstash/inputs/snmp.rb:160:in `block in run'", "org/jruby/RubyArray.java:1792:in `each'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-input-snmp-1.0.1/lib/logstash/inputs/snmp.rb:156:in `run'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:426:in `inputworker'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:420:in `block in start_input'"]}

Since each host has a different priv_pass and auth_pass I need to do two separate snmp inputs but I have no clue why this is not working.

Edit:
Also looking in wireshark it is using the same username and password combination for each one rather than the other account provided.

2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.