os-net-snmp: OID for pending firmware updates?

[DanielD]

I manage several OPNsense firewalls for clients and monitor them through our RMM (NinjaOne) using SNMPv3 via os-net-snmp, on 26.7.7.

"Display Version in OID" works well. The installed version comes through as an nsExtend entry, and we monitor it. What we'd really like is an alert when a firewall has pending updates, raised on the firewall itself, the same way a Synology DSM exposes an "upgrade available" OID.

The data is there (dashboard update notice / /api/core/firmware/status), but our RMM's network monitoring can only poll SNMP, not the REST API, and I'd rather not hand-edit snmpd.conf across a fleet.

Is there an existing way to do this that I've missed? If not, would a "Display update status in OID" option be feasible, similar to the version option? For example, an extend returning none / update / upgrade from the last firmware check, or simply an integer (0 = no updates, 1 = updates available), which is easier to alert on.

Happy to test.

[franco]

Hi,

In theory there is a latest script output you can use to display the last version it can find vs. the current version installed.

In reality there's a number of factors that may end up ruining the experience:

- hotfix level wanted or not
- non-core fixes never show in release notes
- e.g. current PHP out of band update shows no detectable updates other than what the package manager says
- the package manager can lie too


last know to the box:

# configctl firmware changelog latest

vs. last installed on the box:

# configctl firmware changelog current

Is the most stable form, but it will only tell you about minor updates that are pending when it knows about them.

Building a matrix for everyone is a problem we're not looking at solving.


Cheers,
Franco