Monitoroing: Missing SNMP Agent support

[misch42]

Hi,

I tried to setup monitoring for my opnsense 23.1. But all the firewall specific tables are not implemented any more. So support for enterprises.12325 (BEGEMOT MIB)  seems to be gone.

I found some posts having the same problem. So I just want to confirm that this SNMP agent is deprected and the new net-snmp does not provide any of the firewall related monitoring information. Or is it possible to connect via a subagent (AgentX), or similar.

Michael

[aaron.axvig]

I also find myself missing these SNMP values.  In my case for Zabbix monitoring...you can see in the Zabbix template (docs) that it uses many of these 12325 / BEGEMOT-MIB OIDs to report statistics.  I was planning to have a graph of IPv4 vs. IPv6 traffic but it appears that will not be simple.

The Zabbix template as it comes in the box generates errors for these items like this:

Cannot find index of "em0" in ".1.3.6.1.4.1.12325.1.200.1.8.2.1.2".
Cannot find index of "em1" in ".1.3.6.1.4.1.12325.1.200.1.8.2.1.2".

[testo_cz]

it looks like since 19.1 , bsnmp is superseded

https://forum.opnsense.org/index.php?topic=11398.msg51514#msg51514


has been discussed already

https://forum.opnsense.org/index.php?topic=19753.0


I'm dealing with Zabbix monitoring of OPNsense via snmp too these days.

T.

[gcorre]

Hi,

I struggled as well to understand how to monitor my OPNSense using Zabbix and here is what worked for me.

Do not install any SNMP plugin (ie: os-net-snmp)
It will result in a conflict with bsnmp.

Steps on OPNSense

• Open an OPNSense console (CLI)
• Enable bsnmpd daemon by creating new config file "/etc/rc.conf.d/bsnmpd" with the following content :

Code: [Select]

bsnmpd_enable="YES"

• Uncomment the following lines in "/etc/snmpd.config" file to enable required SNMP modules:

Code: [Select]

read := "your_snmp_community"
begemotSnmpdModulePath."hostres" = "/usr/lib/snmp_hostres.so"
begemotSnmpdModulePath."pf" = "/usr/lib/snmp_pf.so"


• Start bsnmpd daemon with the following command:

Code: [Select]

/etc/rc.d/bsnmpd start

• Setup a firewall rule to get access from Zabbix proxy or Zabbix server by SNMP (https://docs.opnsense.org/manual/firewall.html).

   
Steps on Zabbix

• Create your host
• Link "OPNSense template" to your host
• Link "Template / Network devices" group to your host
• Configure name, IP etc. for your host
• Smile because it works.

Refence for above steps : https://www.zabbix.com/integrations/opnsense

Hope this help.

[testo_cz]

Nice @gcorre !
Can you confirm that bsnmpd runs fine on the current OPNsense , please ?

Me personally, searched forums and got the impression, that bsnmpd is not preferred in OPNsense (since some troubles), however it is default in FreeBSD.
I took this Zabbix template (https://www.zabbix.com/integrations/opnsense) and disabled all those BEGEMOT-MIB items, and basically lost PF monitoring. Instead of BEGEMOT-MIB items for PF , I've tried collectd and Telegraf features to PF monitoring . Both output Prometheus format and so pluggable into Zabbix.

Well, for now, I use Telegraf's PF metrics via Prometheus output to Zabbix. The metrics include PF state table only, that is less  than BEGEMOT-MIB.

Cheers

[gcorre]

Hello testo !

So far, so good, bsnmpd is working fine. The only issue is that bsnmp service does not show up in the GUI which is not optimal for checking its status.

I only found documentation around snmp plugin for opnsense but they were not compatible with BEGEMOT-MIB. That's why I tried bsnmp with the same zabbix template as yours (https://www.zabbix.com/integrations/opnsense). And that's working perfectly fine.

Well I had to make one adjusment in this template otherwise interfaces weren't discover correctly.
Go to :

 - Configuration / Templates / OPNSENSE SNMP / MACROS
 - Change the value of the field {$NET.IF.IFADMINSTATUS.MATCHES} to ^·*

I contacted the author and he may have already changed it!

Cheers

[spetrillo]

Are you able to get good data from 23.7? I am showing alot of No Such Object available on this agent at this OID when using this template.

[spetrillo]

Hi,

I struggled as well to understand how to monitor my OPNSense using Zabbix and here is what worked for me.

Do not install any SNMP plugin (ie: os-net-snmp)
It will result in a conflict with bsnmp.

Steps on OPNSense

• Open an OPNSense console (CLI)
• Enable bsnmpd daemon by creating new config file "/etc/rc.conf.d/bsnmpd" with the following content :

Code: [Select]

bsnmpd_enable="YES"

• Uncomment the following lines in "/etc/snmpd.config" file to enable required SNMP modules:

Code: [Select]

read := "your_snmp_community"
begemotSnmpdModulePath."hostres" = "/usr/lib/snmp_hostres.so"
begemotSnmpdModulePath."pf" = "/usr/lib/snmp_pf.so"


• Start bsnmpd daemon with the following command:

Code: [Select]

/etc/rc.d/bsnmpd start

• Setup a firewall rule to get access from Zabbix proxy or Zabbix server by SNMP (https://docs.opnsense.org/manual/firewall.html).

   
Steps on Zabbix

• Create your host
• Link "OPNSense template" to your host
• Link "Template / Network devices" group to your host
• Configure name, IP etc. for your host
• Smile because it works.

Refence for above steps : https://www.zabbix.com/integrations/opnsense

Hope this help.

Was following your instructions, as I had os-net-snmp loaded as a plugin. I removed it but Zabbix is now complaining that there is no SNMP collection. I validated bsnmpd is running, so not sure why this is happening?

[gcorre]

I am a bit behind schedule for updating. My OPNsense is still in 23.4.

I will wait for 24.1 before upgrading and hope that it still works...

Are you sure that you have the same community configured between your OPNsense and Zabbix?
Have you restarted bsnmpd ?

[spetrillo]

I am a bit behind schedule for updating. My OPNsense is still in 23.4.

I will wait for 24.1 before upgrading and hope that it still works...

Are you sure that you have the same community configured between your OPNsense and Zabbix?
Have you restarted bsnmpd ?

Could you provide a screenshot of the OPNsense rule you have setup for this? I am missing this and wonder if that is the missing link.

[gcorre]

Zabbix is in my PRODUCTION network and is communicating with OPNsense in ADMINISTRATION network.

From PRODUCTION to ADMINISTRATION : check attachment.
From ADMINISTRATION to PRODUCTION : check attachment.

"Services_Supervision" = ports 10050 and 10051.

If you want to be sure that it's not a rule issue, you could allow all communication between zabbix and your OPNsense but don't forget to be more restrictive once your test is over.

Logs are your friend as well

[spetrillo]

Yes I got the General log open and noticing that SNMPD does not start, even if the plugin shows green in the GUI. I am trying to find out why its not starting. More to come...

[gcorre]

I'm not sure which plugin you are using, here is mine : (attachment).
 

[gcorre]

I just remember that I had an issue between os-net-snmp plugin and bsmpd.

When os-net-snmpd was installed it was listenning on port 161 and when I started bsnmpd it said "Starting bsnmpd." But it did not started as the port was already in use.

[mdella]

net-snmp and bsnmpd are two DIFFERENT snmpd applications. Both run on port 161/udp and are in conflict with one another. Why is this important?  The plugin that is the currently supported SNMPd system is the UCD-snmp application (now called net-snmpd). The OS level plugin (bsnmpd) included the BEGEMOT-PF-MIB with it that allows for a ton of performance monitoring, alerting on failed applications, etc.  Most of these options were not duplicated with the net-snmpd plugin (there are other threads on the missing Enterprise level monitoring that disappeared with this change).

I've personally been experimenting trying to get one of the daemons to run on a non-standard port so that I can make use of both but so far am running into other problems/issues.

Note that despite multiple requests, there still is no published documentation on what MIBs the net-snmpd plugin is presenting and I didn't have the time to go thru the source code of the pluging to see what is being incorporated.

Monitoring and alerting of these things from an Enterprise level has not been a priority for the development team. I can understand why, but it has relegated this product to the back seat for many of our suggested customer deployments due to the inability to alert based on off the shelf monitoring and alerting systems.

Marcos