matching number.

Note You can also run this command in reverse: give it a numerical MIB and it will spell out the whole named MIB.

Setting Up Snmpd

Before you can use SNMP to monitor your system, you need to set up the snmp daemon. Rather than installing a default configuration file, the net−snmp port installs a default configuration file in /usr/local/share/examples/ucd−snmp/ EXAMPLE.conf. In addition to having default communities of "public" and "private", this default configuration includes a variety of possible security holes.

Fortunately, net−snmp includes a program to create an SNMP daemon configuration file, snmpconf(1). To use snmpconf to create a standard configuration for your system, run this command:

...............................................................................................

# snmpconf −i −g basic_setup

...............................................................................................

This command will take you through a basic snmpd configuration, which will install the file in the proper place. (Since we'll be using snmpconf only once, we won't go over each part of this command.) The configuration is fairly straightforward, but we'll walk through it to be sure you've set everything properly. (While this program lets you set all sorts of advanced stuff, we'll only configure what we need in order to perform basic monitoring.)

Snmpconf will ask many "yes" or "no" questions. You should first see something like this:

...............................................................................................

************************************************

*** Beginning basic system information setup ***

************************************************

Do you want to configure the information returned in the system MIB group (contact info, etc)? (default = y):

...............................................................................................

You do want to provide some basic system information, so type y.

...............................................................................................

Configuring: syslocation Description:

The [typically physical] location of the system. arguments: location_string

The location of the system:

...............................................................................................

Enter a system location here, like "server room" or "server room A−30", or whatever works. This designation can be helpful if you have multiple servers in multiple locations, but if you have only one server it's almost moot. But beware: Whatever you enter will show up in monitoring software, so be sure to not put anything offensive or irrelevant here.

437

The script will then ask you for a "syscontact", the person responsible for the system. If you have multiple server administrators, this is an excellent place to put the email address of the person who should be contacted regarding problems or issues. You might also put in an alias that forwards to multiple people, so that you don't have to reconfigure snmpd when your contact person leaves or is reassigned.

...............................................................................................

Do you want to properly set the value of the sysServices.0 OID? (default =

y):

...............................................................................................

Yes, you do. This section describes extremely basic properties of the system, but not ones that accept a "y" or "n" answer. Because you'll be filling in actual values to be used in the SNMP configuration, you'll enter 0 for no and 1 for yes.

...............................................................................................

Configuring: sysservices Description:

The proper value for the sysServices object. arguments: sysservices_number

does this host offer physical services (eg, like a repeater) [answer 0 or 1]:

...............................................................................................

Some people have telco cards for FreeBSD that allow them to hook a standard x86 PC into a telephone switch to handle phone−company−level operations. If you're not one of them, enter 0 for the preceding question.

...............................................................................................

does this host offer datalink/subnetwork services (eg, like a bridge):

...............................................................................................

FreeBSD can be configured as a bridge, but if you haven't done so, answer 0.

...............................................................................................

does this host offer internet services (eg, supports IP): 1

does this host offer end−to−end services (eg, supports TCP): 1

does this host offer application services (eg, supports SMTP): 1

...............................................................................................

Answer 1 to all of the three preceding questions. A FreeBSD Internet server supports them all.

...............................................................................................

**************************************

*** BEGINNING ACCESS CONTROL SETUP ***

**************************************

Do you want to configure the agent's access control? (default = y):

...............................................................................................

You don't want just anyone to be able to access your system, so answer y.

...............................................................................................

Do you want to allow SNMPv3 read−write user based access (default = y):

438

Do you want to allow SNMPv3 read−only user based access (default = y):

Do you want to allow SNMPv1/v2c read−write community access (default = y):

...............................................................................................

SNMP version 3 is fairly advanced stuff, and far beyond what we need for basic monitoring. Also, we are not using read−write SNMP; we want our monitor to only be able to read information, not issue commands on the system! Answer n to all of the above. You'll get your read−only access by answering y to the next option.

...............................................................................................

Do you want to allow SNMPv1/v2c read−only community access (default = y): y Configuring: rocommunity

Description:

a SNMPv1/SNMPv2c read−only access community name

arguments: community [default|hostname|network/bits] [oid]

The community name to add read−only access for:

...............................................................................................

Those of you experienced with SNMP are familiar with the default communities of "public" and "private", but don't use them: they're the first thing an intruder will look for. Choose community names like you would a good password; don't use ones that are easily guessed, and don't use common words; do mix letters and other characters, and so on. If you don't intend to allow anyone to write SNMP commands on your system, then you probably only need one community name.

...............................................................................................

The hostname or network address to accept this community name from [RETURN for all]:

...............................................................................................

Enter the IP address of your network monitoring system as the answer to the preceding question. If you're monitoring only this machine, from itself, put the loopback IP address (127.0.0.1). You can list an entire network in the standard slash format discussed in Chapter 5 (for example, 192.168.0.0/16). Finally, if you put "0.0.0.0/0", anyone on the Internet can read SNMP values from your system if they have (or guess) the correct community name.

...............................................................................................

The OID that this community should be restricted to [RETURN for no−restriction]:

...............................................................................................

You can restrict different SNMP communities to subportions of the MIB tree. Though you don't need to bother doing so for our purposes, you might choose to restrict communities in more complex setups than this one.

...............................................................................................

Finished Output: rocommunity public 127.0.0.1

Do another rocommunity line? (default = y):

...............................................................................................

If you're doing only the monitoring we discuss in this chapter, you only need one SNMP community. Answer n to the preceding question.

...............................................................................................

****************************************

*** Beginning trap destination setup ***

****************************************

Do you want to configure where and if the agent will send traps? (default = y):

...............................................................................................

439

A trap is where the system will send a notice to another system when a MIB is set or unset. We aren't using them. Answer n.

...............................................................................................

****************************************

*** Beginning monitoring setup ***

****************************************

Do you want to configure the agent's ability to monitor various aspects of your system? (defaul

...............................................................................................

We aren't using process monitoring right now, but we will monitor disk space. Answer y to both the preceding question and the following one.

...............................................................................................

Do you want to configure the agents ability to monitor disk space? (default = y): Configuring: disk

Description:

Check for disk space usage of a partition.

The agent can check the amount of available disk space, and make sure it is above a set limit.

disk PATH [MIN=100000]

PATH: mount path to the disk in question.

MIN: Disks with space below this value will have the Mib's errorFlag set. Can be a raw byte value or a percentage followed by the %

symbol. Default value = 100000.

The results are reported in the dskTable section of the UCD−SNMP−MIB tree Enter the mount point for the disk partion to be checked on: /usr

Enter the minimum amount of space that should be available on /usr: 10% Finished Output: disk /usr 10%

...............................................................................................

Enter each partition you have on your system above. If you're unsure, check /etc/fstab or df(1). Generally speaking, it's a good idea to warn the user if the system has less than 10 percent free space on any one partition.

...............................................................................................

Do you want to configure the agents ability to monitor load average? (default = y):

n

Do you want to configure the agents ability to monitor file sizes? (default = y): n

...............................................................................................

We aren't monitoring load average or file size, so answer n to the previous two questions. You can set this up later when you understand more about SNMP and monitoring.

...............................................................................................

The following files were created:

snmpd.conf installed in /usr/local/share/snmp

#

Stop and start snmpd to read the new configuration.

# killall snmpd && snmpd

#

...............................................................................................

Congratulations! You now have a complete SNMP configuration. Break out snmpwalk and see what

440