Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

updated to support snmp config from redis configdb #6134

Merged
merged 11 commits into from
Jan 5, 2021

Conversation

tsvanduyn
Copy link
Contributor

@tsvanduyn tsvanduyn commented Dec 5, 2020

- Why I did it
I'm updating the jinja2 template to support getting SNMP information from the redis configdb.
I'm using the format approved here:
sonic-net/SONiC#718

This will pave the way for us to decrement using the snmp.yml in the future.
Right now we will still be using both the snmp.yml and configdb to get variable information in order to create the snmpd.conf via the sonic-cfggen tool.

- How I did it
I first updated the SNMP Schema in PR #718 to get that approved as a standardized format.
Then I verified I could add snmp configs to the configdb using this standard schema. Once the configs were added to the configdb then I updated the snmpd.conf.j2 file to support the updates via the configdb while still using the variables in the snmp.yml file in parallel. This way we will have backward compatibility until we can fully migrate to the configdb only.

By updating the snmpd.conf.j2 template and running the sonic-cfggen tool the snmpd.conf gets generated with using the values in both the configdb and snmp.yml file.

- How to verify it

  1. Added new snmp parameters using the new approved schema to configdb.
  2. updated snmpd.conf.j2 templates to support using the new configdb values.
  3. ran this command:
sonic-cfggen  -d -y /etc/sonic/sonic_version.yml -t /usr/share/sonic/templates/sysDescription.j2,/etc/ssw/sysDescription -y /etc/sonic/snmp.yml -t /usr/share/sonic/templates/snmpd.conf.j2,/etc/snmp/snmpd.conf

That will generate a new snmpd.conf file that the system will use for access via snmp.

SAMPLE CONFIGDB Configs:

SNMPv2 Community Configs:

admin@str-s6000-acs-11:~$ redis-cli -n 4 keys "*" | grep -i SNMP_COMMUNITY 
SNMP_COMMUNITY|Edet
SNMP_COMMUNITY|BOWLING
SNMP_COMMUNITY|testcomm4
SNMP_COMMUNITY|blah
SNMP_COMMUNITY|testcomm6
SNMP_COMMUNITY|testcomm5
admin@str-s6000-acs-11:~$ 
admin@str-s6000-acs-11:~$ redis-cli -n 4 hgetall "SNMP_COMMUNITY|testcomm4"
1) "TYPE"
2) "RO"
admin@str-s6000-acs-11:~$ redis-cli -n 4 hgetall "SNMP_COMMUNITY|testcomm5"
1) "TYPE"
2) "RW"
admin@str-s6000-acs-11:~$ redis-cli -n 4 hgetall "SNMP_COMMUNITY|testcomm6"
1) "TYPE"
2) "RO"
admin@str-s6000-acs-11:~$ redis-cli -n 4 hgetall "SNMP_COMMUNITY|Edet"
1) "TYPE"
2) "RO"
admin@str-s6000-acs-11:~$ redis-cli -n 4 hgetall "SNMP_COMMUNITY|BOWLING"
1) "TYPE"
2) "RO"
admin@str-s6000-acs-11:~$ 

SNMPv3 User Configs:

admin@str-s6000-acs-11:~$ redis-cli -n 4 hgetall "SNMP_USER|Billy"
 1) "SNMP_USER_ENCRYPTION_TYPE"
 2) ""
 3) "SNMP_USER_AUTH_TYPE"
 4) "SHA"
 5) "SNMP_USER_ENCRYPTION_PASSWORD"
 6) ""
 7) "SNMP_USER_AUTH_PASSWORD"
 8) "BillyAuthPass"
 9) "SNMP_USER_TYPE"
10) "AuthNoPriv"
11) "SNMP_USER_PERMISSION"
12) "RO"
admin@str-s6000-acs-11:~$ redis-cli -n 4 hgetall "SNMP_USER|Jack"
 1) "SNMP_USER_ENCRYPTION_TYPE"
 2) "AES"
 3) "SNMP_USER_AUTH_TYPE"
 4) "SHA"
 5) "SNMP_USER_ENCRYPTION_PASSWORD"
 6) "TrentEncryptPass"
 7) "SNMP_USER_AUTH_PASSWORD"
 8) "TrentAuthPass"
 9) "SNMP_USER_TYPE"
10) "Priv"
11) "SNMP_USER_PERMISSION"
12) "RW"
admin@str-s6000-acs-11:~$ redis-cli -n 4 hgetall "SNMP_USER|Beth"
 1) "SNMP_USER_ENCRYPTION_TYPE"
 2) ""
 3) "SNMP_USER_AUTH_TYPE"
 4) ""
 5) "SNMP_USER_ENCRYPTION_PASSWORD"
 6) ""
 7) "SNMP_USER_AUTH_PASSWORD"
 8) ""
 9) "SNMP_USER_TYPE"
10) "noAuthNoPriv"
11) "SNMP_USER_PERMISSION"
12) "RO"

These configs were put into the configdb.

Here is what we have in the snmp.yml file

admin@str-s6000-acs-11:~$ cat /etc/sonic/snmp.yml
snmp_rocommunity: public
snmp_location: public

Using what we have in the snmp.yml file and what we have in the configdb this allows us to use sonic-cfggen tool to reference the snmp.conf.j2 file to create the snmpd.conf file.

The snmpd.conf file shows this after generation:

root@str-s6000-acs-11:/# cd /etc/snmp
root@str-s6000-acs-11:/etc/snmp# cat snmpd.conf 
###############################################################################
# Managed by sonic-config-engine
###############################################################################
#
# EXAMPLE.conf:
#   An example configuration file for configuring the Net-SNMP agent ('snmpd')
#   See the 'snmpd.conf(5)' man page for details
#
#  Some entries are deliberately commented out, and will need to be explicitly activated
#
###############################################################################
#
#  AGENT BEHAVIOUR
#

#  Listen for connections on all ip addresses, including eth0, ipv4 lo
#
agentAddress udp:161
agentAddress udp6:161

###############################################################################
#
#  ACCESS CONTROL
#

                                                 #  system + hrSystem groups only
view   systemonly  included   .1.3.6.1.2.1.1
view   systemonly  included   .1.3.6.1.2.1.25.1

                                                 #  Default access to basic system info
rocommunity public
rocommunity6 public


rwcommunity testcomm5
rwcommunity6 testcomm5
rocommunity testcomm4
rocommunity6 testcomm4
rocommunity testcomm6
rocommunity6 testcomm6
rocommunity blah
rocommunity6 blah
rocommunity BOWLING
rocommunity6 BOWLING
rocommunity Edet
rocommunity6 Edet


rouser Beth noAuthNoPriv
CreateUser Beth    
rwuser Jack Priv
CreateUser Jack SHA TrentAuthPass AES TrentEncryptPass
rouser Billy AuthNoPriv
CreateUser Billy SHA BillyAuthPass  




###############################################################################
#
#  SYSTEM INFORMATION
#

#  Note that setting these values here, results in the corresponding MIB objects being 'read-only'
#  See snmpd.conf(5) for more details
sysLocation    public
sysContact     Joe [email protected]
                                                 # Application + End-to-End layers
sysServices    72


#
#  Process Monitoring
#
# todo: should we enable snmp based monitoring of sswsyncd and other processes?

# At least one 'sendmail' process, but no more than 10
#proc  sendmail 10 1

#  Walk the UCD-SNMP-MIB::prTable to see the resulting output
#  Note that this table will be empty if there are no "proc" entries in the snmpd.conf file


#
#  Disk Monitoring
#
                               # 10MBs required on root disk, 5% free on /var, 10% free on all other disks
disk       /     10000
disk       /var  5%
includeAllDisks  10%

#  Walk the UCD-SNMP-MIB::dskTable to see the resulting output
#  Note that this table will be empty if there are no "disk" entries in the snmpd.conf file


#
#  System Load
#
                               # Unacceptable 1-, 5-, and 15-minute load averages
load   12 10 5

#  Walk the UCD-SNMP-MIB::laTable to see the resulting output
#  Note that this table *will* be populated, even without a "load" entry in the snmpd.conf file



###############################################################################
#
#  ACTIVE MONITORING
#
# Note: disabled snmp traps due to side effect of causing snmpd to listen on all ports (0.0.0.0)
#
#   send SNMPv1  traps
#trapsink     localhost public
#   send SNMPv2c traps
#trap2sink    localhost public
#   send SNMPv2c INFORMs
#informsink   localhost public

#  Note that you typically only want *one* of these three lines
#  Uncommenting two (or all three) will result in multiple copies of each notification.


#
#  Event MIB - automatically generate alerts
#
# Remember to activate the 'createUser' lines above
#iquerySecName   internalUser
#rouser          internalUser
# generate traps on UCD error conditions
#defaultMonitors          yes
#note, this release of snmpd does not support linkUpDownNotifications
# generate traps on linkUp/Down
#linkUpDownNotifications  yes


#
#  AgentX Sub-agents
#
                                           #  Run as an AgentX master agent
master          agentx
# internal socket to allow extension to other docker containers
# Currently the other container using this is docker-fpm-frr
# make sure this line matches bgp:/etc/snmp/frr.conf 
# please see testing procedure in the same file to verify this works
# to verify the SNMP docker side look for the following string in the log file:
# INFO snmp-subagent [ax_interface] INFO: Using agentx socket type tcp with path tcp:localhost:3161
# INFO supervisord snmp-subagent INFO:ax_interface:Using agentx socket type tcp with path tcp:localhost:3161
agentxsocket    tcp:localhost:3161

#
#  SysDescription pass-through
#

pass -p 10 .1.3.6.1.2.1.1.1 /usr/share/snmp/sysDescr_pass.py
root@str-s6000-acs-11:/etc/snmp# 

Then to verify this worked I ran some snmpwalk's to the device:

trvanduy@netdev1-westus2-v2:~$ snmpwalk -v 2c -c testcomm6 10.3.147.239 .1
Unlinked OID in IPATM-IPMC-MIB: marsMIB ::= { mib-2 57 }
Undefined identifier: mib-2 near line 18 of /usr/share/mibs/ietf/IPATM-IPMC-MIB
iso.0.8802.1.1.2.1.3.1 = INTEGER: 4
iso.0.8802.1.1.2.1.3.2 = STRING: "ec:f4:bb:fe:80:a1"
iso.0.8802.1.1.2.1.3.3 = STRING: "str-s6000-acs-11"
iso.0.8802.1.1.2.1.3.4 = STRING: "Debian GNU/Linux 10 (buster) Linux 4.19.0-9-2-amd64 #1 SMP Debian 4.19.118-2+deb10u1 (2020-06-07) x86_64"


trvanduy@netdev1-westus2-v2:~$ snmpwalk -v 2c -c public 10.3.147.239 .1
Unlinked OID in IPATM-IPMC-MIB: marsMIB ::= { mib-2 57 }
Undefined identifier: mib-2 near line 18 of /usr/share/mibs/ietf/IPATM-IPMC-MIB
iso.0.8802.1.1.2.1.3.1 = INTEGER: 4
iso.0.8802.1.1.2.1.3.2 = STRING: "ec:f4:bb:fe:80:a1"
iso.0.8802.1.1.2.1.3.3 = STRING: "str-s6000-acs-11"
iso.0.8802.1.1.2.1.3.4 = STRING: "Debian GNU/Linux 10 (buster) Linux 4.19.0-9-2-amd64 #1 SMP Debian 4.19.118-2+deb10u1 (2020-06-07) x86_64"


trvanduy@netdev1-westus2-v2:~$ snmpwalk -v 2c -c BOWLING 10.3.147.239 .1
Unlinked OID in IPATM-IPMC-MIB: marsMIB ::= { mib-2 57 }
Undefined identifier: mib-2 near line 18 of /usr/share/mibs/ietf/IPATM-IPMC-MIB
iso.0.8802.1.1.2.1.3.1 = INTEGER: 4
iso.0.8802.1.1.2.1.3.2 = STRING: "ec:f4:bb:fe:80:a1"
iso.0.8802.1.1.2.1.3.3 = STRING: "str-s6000-acs-11"
iso.0.8802.1.1.2.1.3.4 = STRING: "Debian GNU/Linux 10 (buster) Linux 4.19.0-9-2-amd64 #1 SMP Debian 4.19.118-2+deb10u1 (2020-06-07) x86_64"


trvanduy@netdev1-westus2-v2:~$ snmpwalk -v 2c -c Edet 10.3.147.239 .1
Unlinked OID in IPATM-IPMC-MIB: marsMIB ::= { mib-2 57 }
Undefined identifier: mib-2 near line 18 of /usr/share/mibs/ietf/IPATM-IPMC-MIB
iso.0.8802.1.1.2.1.3.1 = INTEGER: 4
iso.0.8802.1.1.2.1.3.2 = STRING: "ec:f4:bb:fe:80:a1"
iso.0.8802.1.1.2.1.3.3 = STRING: "str-s6000-acs-11"
iso.0.8802.1.1.2.1.3.4 = STRING: "Debian GNU/Linux 10 (buster) Linux 4.19.0-9-2-amd64 #1 SMP Debian 4.19.118-2+deb10u1 (2020-06-07) x86_64"


trvanduy@netdev1-westus2-v2:~$ snmpwalk -v 2c -c blah 10.3.147.239 .1
Unlinked OID in IPATM-IPMC-MIB: marsMIB ::= { mib-2 57 }
Undefined identifier: mib-2 near line 18 of /usr/share/mibs/ietf/IPATM-IPMC-MIB
iso.0.8802.1.1.2.1.3.1 = INTEGER: 4
iso.0.8802.1.1.2.1.3.2 = STRING: "ec:f4:bb:fe:80:a1"
iso.0.8802.1.1.2.1.3.3 = STRING: "str-s6000-acs-11"
iso.0.8802.1.1.2.1.3.4 = STRING: "Debian GNU/Linux 10 (buster) Linux 4.19.0-9-2-amd64 #1 SMP Debian 4.19.118-2+deb10u1 (2020-06-07) x86_64"

trvanduy@netdev1-westus2-v2:~$ snmpwalk -v 3 -u Beth -l noAuthNoPriv 10.3.147.239 .1
Unlinked OID in IPATM-IPMC-MIB: marsMIB ::= { mib-2 57 }
Undefined identifier: mib-2 near line 18 of /usr/share/mibs/ietf/IPATM-IPMC-MIB
iso.0.8802.1.1.2.1.3.1 = INTEGER: 4
iso.0.8802.1.1.2.1.3.2 = STRING: "ec:f4:bb:fe:80:a1"
iso.0.8802.1.1.2.1.3.3 = STRING: "str-s6000-acs-11"
iso.0.8802.1.1.2.1.3.4 = STRING: "Debian GNU/Linux 10 (buster) Linux 4.19.0-9-2-amd64 #1 SMP Debian 4.19.118-2+deb10u1 (2020-06-07) x86_64"


trvanduy@netdev1-westus2-v2:~$ snmpwalk -v 3 -u Jack -l Priv -a SHA -A TrentAuthPass -x AES -X TrentEncryptPass 10.3.147.239 .1
Unlinked OID in IPATM-IPMC-MIB: marsMIB ::= { mib-2 57 }
Undefined identifier: mib-2 near line 18 of /usr/share/mibs/ietf/IPATM-IPMC-MIB
iso.0.8802.1.1.2.1.3.1 = INTEGER: 4
iso.0.8802.1.1.2.1.3.2 = STRING: "ec:f4:bb:fe:80:a1"
iso.0.8802.1.1.2.1.3.3 = STRING: "str-s6000-acs-11"
iso.0.8802.1.1.2.1.3.4 = STRING: "Debian GNU/Linux 10 (buster) Linux 4.19.0-9-2-amd64 #1 SMP Debian 4.19.118-2+deb10u1 (2020-06-07) x86_64"


trvanduy@netdev1-westus2-v2:~$ snmpwalk -v 3 -u Billy -l authNoPriv -a SHA -A BillyAuthPass 10.3.147.239 .1
Unlinked OID in IPATM-IPMC-MIB: marsMIB ::= { mib-2 57 }
Undefined identifier: mib-2 near line 18 of /usr/share/mibs/ietf/IPATM-IPMC-MIB
iso.0.8802.1.1.2.1.3.1 = INTEGER: 4
iso.0.8802.1.1.2.1.3.2 = STRING: "ec:f4:bb:fe:80:a1"
iso.0.8802.1.1.2.1.3.3 = STRING: "str-s6000-acs-11"
iso.0.8802.1.1.2.1.3.4 = STRING: "Debian GNU/Linux 10 (buster) Linux 4.19.0-9-2-amd64 #1 SMP Debian 4.19.118-2+deb10u1 (2020-06-07) x86_64"

- Which release branch to backport (provide reason below if selected)

  • 201811
  • 201911
  • 202006

I'm not sure on this part. I know the whole reason for this is so we can get to the point where we are automation snmp community string rotation. I'll need to discuss this with you further.

- Description for the changelog

Update snmp.conf.j2 to support getting variable from configDB.

- A picture of a cute animal (not mandatory but encouraged)

Copy link
Contributor

@SuvarnaMeenakshi SuvarnaMeenakshi left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

As comments.

dockers/docker-snmp/snmpd.conf.j2 Show resolved Hide resolved
dockers/docker-snmp/snmpd.conf.j2 Show resolved Hide resolved
Copy link
Collaborator

@qiluo-msft qiluo-msft left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

As comment

qiluo-msft
qiluo-msft previously approved these changes Dec 11, 2020
Copy link
Collaborator

@qiluo-msft qiluo-msft left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM. Please also check with other reviewers.

@tsvanduyn
Copy link
Contributor Author

Updated Jinja2 snmpd.conf.j2 template to use ConfigDB as the main source and only fall back to snmp.yml if a particular community does not exist in the ConfigDB. This allows us to use both but eventually when we cutover to only using ConfigDB this will just work.

root@str-s6000-acs-11:/usr/share/sonic/templates# vim snmpd.conf.j2
root@str-s6000-acs-11:/usr/share/sonic/templates# sonic-cfggen  -d -y /etc/sonic/sonic_version.yml -t /usr/share/sonic/templates/sysDescription.j2,/etc/ssw/sysDescription -y /etc/sonic/snmp.yml -t /usr/share/sonic/templates/snmpd.conf.j2,/etc/snmp/snmpd.conf
root@str-s6000-acs-11:/usr/share/sonic/templates# head -70 /etc/snmp/snmpd.conf                 
###############################################################################
# Managed by sonic-config-engine
###############################################################################
#
# EXAMPLE.conf:
#   An example configuration file for configuring the Net-SNMP agent ('snmpd')
#   See the 'snmpd.conf(5)' man page for details
#
#  Some entries are deliberately commented out, and will need to be explicitly activated
#
###############################################################################
#
#  AGENT BEHAVIOUR
#

#  Listen for connections on all ip addresses, including eth0, ipv4 lo
#
agentAddress udp:161
agentAddress udp6:161

###############################################################################
#
#  ACCESS CONTROL
#

                                                 #  system + hrSystem groups only
view   systemonly  included   .1.3.6.1.2.1.1
view   systemonly  included   .1.3.6.1.2.1.25.1

                                                 #  Default access to basic system info


rocommunity Qi
rocommunity6 Qi
rocommunity Travis
rocommunity6 Travis
rocommunity Bill
rocommunity6 Bill
rwcommunity Jack
rwcommunity6 Jack

rocommunity public
rocommunity6 public

rwcommunity Joker
rwcommunity6 Joker






###############################################################################
#
#  SYSTEM INFORMATION
#

#  Note that setting these values here, results in the corresponding MIB objects being 'read-only'
#  See snmpd.conf(5) for more details
sysLocation    public
sysContact     Azure Cloud Switch vteam <[email protected]>
                                                 # Application + End-to-End layers
sysServices    72

#
#  Process Monitoring
#
# todo: should we enable snmp based monitoring of sswsyncd and other processes?

# At least one 'sendmail' process, but no more than 10
root@str-s6000-acs-11:/usr/share/sonic/templates# 
root@str-s6000-acs-11:/usr/share/sonic/templates# 
root@str-s6000-acs-11:/usr/share/sonic/templates# cat /etc/sonic/snmp.yml
snmp_location: public
snmp_rocommunities: [public, Bill, Travis, Qi]
snmp_rwcommunities: [Joker, Jack]
root@str-s6000-acs-11:/usr/share/sonic/templates# 
root@str-s6000-acs-11:/usr/share/sonic/templates# 
root@str-s6000-acs-11:/usr/share/sonic/templates# redis-cli -n 4 keys "*" | grep -i snmp 
SNMP|LOCATION
SNMP_COMMUNITY|Qi
SNMP_COMMUNITY|Travis
SNMP_COMMUNITY|Bill
SNMP_COMMUNITY|Jack
FEATURE|snmp
root@str-s6000-acs-11:/usr/share/sonic/templates# redis-cli -n 4 hgetall "SNMP_COMMUNITY|Qi"
1) "TYPE"
2) "RO"
root@str-s6000-acs-11:/usr/share/sonic/templates# redis-cli -n 4 hgetall "SNMP_COMMUNITY|Travis"
1) "TYPE"
2) "RO"
root@str-s6000-acs-11:/usr/share/sonic/templates# redis-cli -n 4 hgetall "SNMP_COMMUNITY|Bill"  
1) "TYPE"
2) "RO"
root@str-s6000-acs-11:/usr/share/sonic/templates# redis-cli -n 4 hgetall "SNMP_COMMUNITY|Jack"
1) "TYPE"
2) "RW"
root@str-s6000-acs-11:/usr/share/sonic/templates# 

Copy link
Collaborator

@qiluo-msft qiluo-msft left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

As comments

trvanduy added 4 commits December 29, 2020 10:42
Copy link
Contributor

@SuvarnaMeenakshi SuvarnaMeenakshi left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

Copy link
Collaborator

@qiluo-msft qiluo-msft left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

As comments

@tsvanduyn
Copy link
Contributor Author

retest this please

@lguohan lguohan merged commit d769ef2 into sonic-net:master Jan 5, 2021
qiluo-msft pushed a commit that referenced this pull request Dec 13, 2021
**- Why I did it**
I'm updating the jinja2 template to support getting SNMP information from the redis configdb. 
I'm using the format approved here: 
sonic-net/SONiC#718

This will pave the way for us to decrement using the snmp.yml in the future.  
Right now we will still be using both the snmp.yml and configdb to get variable information in order to create the snmpd.conf via the sonic-cfggen tool. 

**- How I did it**
I first updated the SNMP Schema in PR #718 to get that approved as a standardized format. 
Then I verified I could add snmp configs to the configdb using this standard schema.  Once the configs were added to the configdb then I updated the snmpd.conf.j2 file to support the updates via the configdb while still using the variables in the snmp.yml file in parallel.  This way we will have backward compatibility until we can fully migrate to the configdb only. 

By updating the snmpd.conf.j2 template and running the sonic-cfggen tool the snmpd.conf gets generated with using the values in both the configdb and snmp.yml file. 

Co-authored-by: trvanduy <[email protected]>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

4 participants