SNMP input (how to configure)

inter07 · May 28, 2019, 1:13pm

Hi!
Could You please help to configure SNMP input in the Logstash.
I 've tried to use the official documentation, but got some problems.(
My input configuration is:

{
    input {
      snmp {

    get => ["1.3.6.1.4.1.14876"]
    hosts => [{host => "udp:10.10.108.17/161"}]

    mib_paths => ["/root/mib/RFC1213-MIB.dic"]
    oid_root_skip => 0
    interval => 30
  }
}

And in logs I'm getting the next errors:

[2019-05-28T16:04:06,720][ERROR][logstash.pipeline        ] Error registering plugin {:pipeline_id=>"main", :plugin=>"<LogStash::Inputs::Snmp mib_paths=>[\"root/mib/RFC1213-MIB.dic\"], oid_root_skip=>0, interval=>30, id=>\"1008b99d29004ebd8e92048301b71e1b78c7305817d63883182fe7b216d9b4d7\", hosts=>[{\"host\"=>\"udp:10.10.108.17/161\"}], get=>[\"1.3.6.1.4.1.14876\"], enable_metric=>true, codec=><LogStash::Codecs::Plain id=>\"plain_cad67756-c145-4779-8765-c6f81e2dd0cd\", enable_metric=>true, charset=>\"UTF-8\">, add_field=>{\"host\"=>\"%{[@metadata][host_address]}\"}, use_provided_mibs=>true>", :error=>"file or directory path expected: root/mib/RFC1213-MIB.dic", :thread=>"#<Thread:0x5ac66d61 run>"}
[2019-05-28T16:04:15,786][ERROR][logstash.pipeline        ] Pipeline aborted due to error {:pipeline_id=>"main", :exception=>#<LogStash::SnmpMibError: file or directory path expected: root/mib/RFC1213-MIB.dic>, :backtrace=>["/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-input-snmp-1.0.1/lib/logstash/inputs/snmp/mib.rb:108:in `add_mib_path'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-input-snmp-1.0.1/lib/logstash/inputs/snmp.rb:106:in `block in register'", "org/jruby/RubyArray.java:1792:in `each'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-input-snmp-1.0.1/lib/logstash/inputs/snmp.rb:104:in `register'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:259:in `register_plugin'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:270:in `block in register_plugins'", "org/jruby/RubyArray.java:1792:in `each'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:270:in `register_plugins'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:413:in `start_inputs'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:311:in `start_workers'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:217:in `run'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:176:in `block in start'"], :thread=>"#<Thread:0x5ac66d61 run>"}
[2019-05-28T16:04:15,810][ERROR][logstash.agent           ] Failed to execute action {:id=>:main, :action_type=>LogStash::ConvergeResult::FailedAction, :message=>"Could not execute action: PipelineAction::Create<main>, action_result: false", :backtrace=>nil}

What should I check?
Thank you in advance!

inter07 · May 28, 2019, 1:27pm

If I'm using some software like SNMPWALK I'm getting some results (like below)

logger · May 28, 2019, 1:45pm

I have never uses snmp input before, but you are missing an "/" before root
Maybe that´s it

inter07 · May 28, 2019, 1:54pm

Thanks, but it didn't help. The error is the same. Do you have any other ideas?

[2019-05-28T16:51:45,092][ERROR][logstash.pipeline        ] Error registering plugin {:pipeline_id=>"main", :plugin=>"<LogStash::Inputs::Snmp mib_paths=>[\"/root/mib/RFC1213-MIB.dic\"], oid_root_skip=>0, interval=>30, id=>\"e89b6b460a73217f7ae4f43ad6d7d7768d8bbac170d5c6a0f1c46f3dea6e1d85\", hosts=>[{\"host\"=>\"udp:10.10.108.17/161\"}], get=>[\"1.3.6.1.4.1.14876\"], enable_metric=>true, codec=><LogStash::Codecs::Plain id=>\"plain_6df6c2c8-7409-4fd6-a37e-92a5e280e643\", enable_metric=>true, charset=>\"UTF-8\">, add_field=>{\"host\"=>\"%{[@metadata][host_address]}\"}, use_provided_mibs=>true>", :error=>"file or directory path expected: /root/mib/RFC1213-MIB.dic", :thread=>"#<Thread:0x2b8f94d5 run>"}
[2019-05-28T16:51:56,280][ERROR][logstash.pipeline        ] Pipeline aborted due to error {:pipeline_id=>"main", :exception=>#<LogStash::SnmpMibError: file or directory path expected: /root/mib/RFC1213-MIB.dic>, :backtrace=>["/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-input-snmp-1.0.1/lib/logstash/inputs/snmp/mib.rb:108:in `add_mib_path'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-input-snmp-1.0.1/lib/logstash/inputs/snmp.rb:106:in `block in register'", "org/jruby/RubyArray.java:1792:in `each'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-input-snmp-1.0.1/lib/logstash/inputs/snmp.rb:104:in `register'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:259:in `register_plugin'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:270:in `block in register_plugins'", "org/jruby/RubyArray.java:1792:in `each'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:270:in `register_plugins'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:413:in `start_inputs'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:311:in `start_workers'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:217:in `run'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:176:in `block in start'"], :thread=>"#<Thread:0x2b8f94d5 run>"}
[2019-05-28T16:51:56,326][ERROR][logstash.agent           ] Failed to execute action {:id=>:main, :action_type=>LogStash::ConvergeResult::FailedAction, :message=>"Could not execute action: PipelineAction::Create<main>, action_result: false", :backtrace=>nil}

logger · May 28, 2019, 1:59pm

mib_paths should be a path. not an array. maybe it is just the brackets which are resulting in an error.

inter07 · May 28, 2019, 3:30pm

It also doesn't work
The error is the same.

[2019-05-28T18:28:16,703][INFO ][logstash.inputs.snmp     ] using user provided MIB path /root/mib/RFC1213-MIB.dic
[2019-05-28T18:28:16,720][ERROR][logstash.pipeline        ] Error registering plugin {:pipeline_id=>"main", :plugin=>"<LogStash::Inputs::Snmp mib_paths=>[\"/root/mib/RFC1213-MIB.dic\"], oid_root_skip=>0, interval=>30, id=>\"87afd06f4aa949b7c26235725875e1230291d565b92cad9f16a6229b256e8371\", hosts=>[{\"host\"=>\"udp:10.10.108.17/161\"}], get=>[\"1.3.6.1.4.1.14876\"], enable_metric=>true, codec=><LogStash::Codecs::Plain id=>\"plain_8c8c9ada-4494-4aec-8844-88d01d91e293\", enable_metric=>true, charset=>\"UTF-8\">, add_field=>{\"host\"=>\"%{[@metadata][host_address]}\"}, use_provided_mibs=>true>", :error=>"file or directory path expected: /root/mib/RFC1213-MIB.dic", :thread=>"#<Thread:0x556efb2e run>"}
[2019-05-28T18:28:25,810][ERROR][logstash.pipeline        ] Pipeline aborted due to error {:pipeline_id=>"main", :exception=>#<LogStash::SnmpMibError: file or directory path expected: /root/mib/RFC1213-MIB.dic>, :backtrace=>["/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-input-snmp-1.0.1/lib/logstash/inputs/snmp/mib.rb:108:in `add_mib_path'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-input-snmp-1.0.1/lib/logstash/inputs/snmp.rb:106:in `block in register'", "org/jruby/RubyArray.java:1792:in `each'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-input-snmp-1.0.1/lib/logstash/inputs/snmp.rb:104:in `register'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:259:in `register_plugin'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:270:in `block in register_plugins'", "org/jruby/RubyArray.java:1792:in `each'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:270:in `register_plugins'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:413:in `start_inputs'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:311:in `start_workers'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:217:in `run'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:176:in `block in start'"], :thread=>"#<Thread:0x556efb2e run>"}
[2019-05-28T18:28:25,859][ERROR][logstash.agent           ] Failed to execute action {:id=>:main, :action_type=>LogStash::ConvergeResult::FailedAction, :message=>"Could not execute action: PipelineAction::Create<main>, action_result: false", :backtrace=>nil}
[2019-05-28T18:28:26,589][INFO ][logstash.agent           ] Successfully started Logstash API endpoint {:port=>9600}
[2019-05-28T18:28:31,230][INFO ][logstash.runner          ] Logstash shut down.

logger · May 28, 2019, 4:04pm

ok, second thought would be that logstash has no read permission in /root/

So maybe you could change it to:

mib_paths => "/etc/logstash/mib/RFC1213-MIB.dic"

and give the read permissions to user logstash.

If this doesn´t help, then hopefully someone else knows the solution.

inter07 · May 28, 2019, 4:27pm

Thanks! The problem was with permissions to the root directory. Now it becomes working. The next step -> I will investigate how to operate with this info) I mean how to "grok it"

Few additional troubles to be fixed:

Problem:

object mapping for [host] tried to parse field [host] as object, but found a concrete value

Solution:

mutate {
          remove_field => [ "host" ]
        }

Problem:

Limit of total fields [3000] in index [unknown_messages] has been exceeded

Solution:

PUT unknown_messages/_settings
{
"index.mapping.total_fields.limit": 9000
}

Result:

system · June 25, 2019, 4:28pm

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.