Community
- Command Central
- MVP Program
- Monthly Mission
- Blogs
- Groups
- Events
- Media Vault
Products
- Observability
- Network Management
- Application Management
- IT Security
- IT Service Management
- System Management
- Database Management
Content Exchange
- SolarWinds Platform
- Server & Application Monitor
- Database Performance Analyzer
- Server Configuration Monitor
- Network Performance Monitor
- Network Configuration Manager
- SQL Sentry
- Web Help Desk
Free Tools & Trials

SNMP not working on some nodes

Good morning people.

I am a little confused about something. So I have about 25% of my infrastructure not being discovered via SNMP. It will not autodiscover, nor can I manually add it. As a test I set an any-any rule on our firewalls to allow all traffic (I know, it's a stupid risk, but I turned it off when I finished) and it will not poll. I can poll via ICMP and via WMI, but SNMP will not budge. You would think it was something to do with vlans, but nodes are being added on the same vlan that some nodes are not being added.

I have an GPO that (surprisingly) worked on out entire infrastructure so I know it cannot be that. I thought it might have been an issue with maybe the routers/switches only allowing traffic to a specific IP address. Networks checked this and it seems fine. I did some monitoring via wireshark/the network devices themselves and it appears that data is being sent to the nodes, but for some reason the switches indicate that packets are being dropped

Save local firewalls (which are not turned on via gpo) I cannot understand why it is not polling. While I do some research on this site, would anyone have a clue why it's not polling?

Thank you in advanced

Find more posts tagged with

Accepted answers

shaun_9999

Just as an update - everything seems to be working fine now. It was all due to an issue on some firewalls that will be scrapped eventually. But it's still a pain in the bottom. I was getting frustrated and angry because I have devised an almost military like plan and expected it to work as intended. After about six weeks and being behind I realised that my plan had literally been thrown to the bottom of the ocean.

All comments

fazl-e-azeem

Hi shaun, can you be more specific? what are the devices that you are trying to add?

shaun_9999

They're all windows 2k8.2k12 boxes. Nothing special about them, they don't have any magical properties. They just don't poll.

fazl-e-azeem

windows machines are polled by WMI, not snmp.

shaun_9999

I thought that, but I read that is uses upto 5 times more resources than SNMP. If you have first hand experience on this (I did quite a lot of research on this forum and on other internet-based search engines.)

mprobus

Have you ensured that you allowed the poller to poll the device in the SNMP settings? With Windows, you not only have to define the community strings, but which devices can collect data.

mbird

Yep, check this 100%.

As far as WMI and SNMP, you can absolutely monitor Windows servers via SNMP, fazl-e-azeem, I have a mix of SNMP and WMI for the nodes I monitor.

vinay.by

Post SNMP Configuration did you restart the SNMP Service on the device end ? Give it a try - sometimes when you set the attributes on snmp security tab and try to test the same on Solarwinds the test fails - try restarting the SNMP Service and then check if the snmp test is passing on Solarwinds

shaun_9999

Yep. Ergo my GPO change.

shaun_9999

Tried that. As an update. networks did something that now allows me to poll the remaining devices. (Well - 65. So about a third.) They won't tell me what they did, but that seems a lot better. So we will see what comes from this.

mbird

Do you have a few nodes you could pull the policy off of, then set the SNMP values manually? Force policy referesh, then reboot? Just to see if that makes a difference? Sometimes replication can get iffy and this would rule out any kind of issue with GPO if it still doesn't work.

The network change is something to consider as well, I've been there before. Easy to have different parts of the department forget about stuff or make changes. I had a network engineer asking me about port security notifications yesterday only to discover it was a new switch that they didn't request that I monitor... that explains why there were no alerts.

bsciencefiction.tv

Are you polling through a fire wall? If so, do the rules allow sNMP traffic?

mprobus

Have you tried to a SNMPWalk throughout your network? Run it locally from the server to make sure it can connect. Then back it out to a different spot in the network. Repeat until you reach your Solarwinds server.

You will of course have to update the SNMP settings for each location you try to run it from.

kurtrh

If this is the case that Network did something. They may have an ACL (Access Control List) on the switches. Make sure they know what your polling device IP address is, and what device you are trying to poll. Then they can add that in the ACL that they may have on the switch or on a particular VLAN.

rhidians

This was what struck me also. If you can use wmi to those servers, then I would presume you can ping them?

If the devices are all in the same section of the infrastructure then it sounds like a device is dropping SNMP... probably a security device ....

Also SNMP vs WMI for those that fancy a read

SNMP vs WMI polling - SolarWinds Worldwide, LLC. Help and Support

shaun_9999

I can ping the servers.

Incidentally, I still don't know what networks did. I did a little on the f/w config, all of the GPO, and pretty much everything else, but I didn't touch the ACL as I haven't ever done that in a real-life environment.

They have always used SNMP for monitoring (minus switches/ect) but it's always been like that. Though after the migration it's still slow as hell. I need a little more investigation in this.

tigger2

I'm not sure if this is still the case, but SNMP is deprecated in windows 2012: The death of SNMP

thwack link contains link to MS tecnet article, indicating:

SNMP

SNMP is deprecated. Instead, use the Common Information Model (CIM), which is supported by the WS-Management web services protocol and implemented as Windows Remote Management.

rhidians

Good point tigger2 , SNMP would need to be enabled on 2012 servers.

Another thing you could do on one the servers to be monitored is put wireshark on it and see if the snmp protocol even gets to the Windows server. It doesn't sound like the SNMP get requests are getting to the server. If you are not familure with wireshark, ask a friendly Network engineer to give you a hand

And yup, CIM got morphed into wmi by MS. One problem with wmi is if you are going through a firewall wmi will auto negotiate on port 135 and then use random ports higher than the common ports. So firewalls and wmi... not always the best, it really is down to the customers situation

mbird

Definitely check firewall config in a case like that. Big mess for me monitoring remote sites and having firewalls opened up to monitor nodes and applications via WMI. Eventually got sorted but was the subject of a lot of phone calls.

rhidians

I can believe it. There are ways to reduce the number of ports required such as using a GPO to curtail the windows servers to only use this 100 ports or this range or if you use agents then that will poll on WMI locally and send the info back to through a firewall on set ports... or if there is enough to monitor on the other side of the firewall then you could pop an additional poller on the far side of the firewall and again that would limit what ports are required to be opened. However, that could be over kill

rhidians

Well if the machines are all on the same segment it may be wise to have that ACL checked out as that could be blocking things on port 161 (snmp get port) so again a friendly network engineer maybe the best bet on that

jlim13

Try issuing a telnet command from one of the affected servers using port 161/162 going to your Orion Server; More often than not, this is a Firewall Issue ( Network Device not Windows Firewall).

jamison.jennings

Are all of your failing nodes on the same poller?

aLTeReGo

Telnet is a TCP based protocol. SNMP is a UDP based protocol (connectionless). Unfortunately you cannot troubleshoot SNMP connectivity issues in the manner you describe.

rsandoval

On the servers you are wanting to poll, can you confirm that they are listening on port UDP 161? Start->cmd->netstat -an | find ":161 ".

Ex:

M:\>netstat -an | find ":161 "

UDP 0.0.0.0:161 *:*

UDP [::]:161 *:*

If you do not get a similar result, then SNMP is not properly configured or the service has not started.

If you do get this result, ensure that your server is accepting your poller's IP for SNMP as mprobus suggested and confirm your community string.

If your server is allowing your poller's IP and you have the proper community string, you can try disabling Windows Firewall to see if perhaps that is the culprit.

If all of this still causes you to fail the SNMPwalk from the poller (with the correct community string), then the issue is somewhere between the server and the poller.

JaroslawLadyga

I'd suggest to check ports 161 and 162 if they are accessible on servers which not responding and firewalls/switches in between. Additionally try to setup SNMP on those servers to accept SNMP packets from any host (at least temporarily).

shaun_9999

So speaking to networks, it appears that ACL's and some firewalls (d'oh! to myself) were not opened. I did a poll with both WMI and SNMP and polled about 150 nodes, which is over half the missing nodes.

Though I have about 50 ish nodes that cannot communicate via SNMP/WMI for some reason. Some are on the same VLAN as ones that won't be polled. I know for a fact that it has to be on the node. It cant (I hope) be a network problem. Though looking at some of the rules that have been in place from very historical time, they either were extremely lucky to get anything polling, or, they knew what they were doing and made it horribly complex.

Eg..

If you want to poll from node a to solarwinds b, you would add SNMP, apply your config and then poll via solarwinds.

Node a ------------------------- SNMP -----------------> SolarWinds.

Though, how the rules are in place as follows:

Comples design.png

shaun_9999

That's why it has made it so complex. It's not an easy combination of adding a new rule on a f/w and then off we go. It was through several switches because that's how it was laid down initially.

shaun_9999