Help with monitoring esx 4.0 hosts with Npm

linkmfg

I have two 4.0 esx hosts I would like to monitor with Npm. Each has about 5 vms.

Vmware's instructions on how to configure the hosts with snmp were not clear.

Does anyone have clear concise instructions (Step by Step) on how to do that?

Thanks for your time.

Find more posts tagged with

Accepted answers

mrxinu

Run: netstat -an | grep :161

Do you get something like this?

xinu@xv:~$ netstat -an | grep :161

udp 0 0 127.0.0.1:161 0.0.0.0:*

All comments

mcbridea

What version of ESX are you using?

mrxinu

Set up snmp on ESX:

Log into the server as root.
Change directory to the /etc/snmp directory. [cd /etc/snmp]
Open the snmpd.conf file in your favorite editor (vi, emacs, pico, etc). [vi snmpd.conf]
Change the password, contact, and location and save the file.
Add the snmpd service so it starts on reboot. [chkconfig –-level 345 snmpd on]
Start the snmpd service. [service snmpd start]
Disable the ESX firewall service to allow SNMP from the monitoring server. [esxcfg-firewall –-allowIncoming]

mrxinu

You can be more surgical about the firewall, too. I think it's 'esxcfg-firewall -e snmpd' or something similar. Check out the options for esxcfg-firewall.

linkmfg

esx 4.0

mcbridea

See this thread ->

linkmfg

Thanks to all of you who took the time to help,

Mrxinu

Finally I got to my snmpd.conf file but I don't see where to "Change the password, contact, and location"

Here it is below. Could please pinpoint where to do that change? Thanks.

snmpd.conf:
# An example configuration file for configuring the ucd-snmp snmpd agent.
#
###############################################################################
#
# This file is intended to only be as a starting point. Many more
# configuration directives exist than are mentioned in this file. For
# full details, see the snmpd.conf(5) manual page.
#
# All lines beginning with a '#' are comments and are intended for you
# to read. All other lines are configuration commands for the agent.

###############################################################################
# Access Control
###############################################################################

# As shipped, the snmpd demon will only respond to queries on the
# system mib group until this file is replaced or modified for
# security purposes. Examples are shown below about how to increase the
# level of access.

# By far, the most common question I get about the agent is "why won't
# it work?", when really it should be "how do I configure the agent to
# allow me to access it?"
#
# By default, the agent responds to the "public" community for read
# only access, if run out of the box without any configuration file in
# place. The following examples show you other ways of configuring
# the agent so that you can change the community names, and give
# yourself write access to the mib tree as well.
#
# For more information, read the FAQ as well as the snmpd.conf(5)
# manual page.

####
# First, map the community name "public" into a "security name"

# sec.name source community
com2sec notConfigUser default public

####
# Second, map the security name into a group name:

#       groupName      securityModel securityName
group   notConfigGroup v1           notConfigUser
group   notConfigGroup v2c           notConfigUser

####
# Third, create a view for us to let the group have rights to:

# Make at least snmpwalk -v 1 localhost -c public system fast again.
#       name           incl/excl     subtree         mask(optional)
view    systemview    included   .1.3.6.1.2.1.1
view    systemview    included   .1.3.6.1.2.1.25.1.1

####
# Finally, grant the group read-only access to the systemview view.

# group context sec.model sec.level prefix read write notif

mrxinu

Ah, you have the newer version of the snmpd.conf file. That's fine, it just gives you more granular control than the version I was thinking of that only gives you a few lines to modify. What you're doing is building up access given a particular community string. So there are two parts to this: the information like contact and location, and then the security bits.

We'll start with the easy part first - add the following lines to the bottom:

syslocation Las Vegas, NV (or whatever you want - spaces are allowed here)
syscontact Some User <someuser@example.com> (again, any characters are allowed here)

On to the slightly more complicated part. Here's how the security bit it goes: com2sec -> group -> view -> access. So what you want to do it build it up one step at a time. I would suggest commenting out (adding a # mark to the beginning of the line) any of the existing com2sec, group, and view lines you currently have and add the following at the very bottom (passed the syslocation & syscontact bits):

com2sec readonly default your_community_string
group myROGroup v2c readonly
view all included .1 80
access MyROGroup "" any noauth exact all none none

For the 'your_community_string' bit you'll want to choose something else of course. When you get done with the file, if the snmpd service is already running, you'll want to restart it with: service snmpd restart. Then use snmpwalk to test: snmpwalk -cyour_community_string -v2c localhost system. If you get something back, you win.

linkmfg

Done it and I got " no response from loacalhost"

Here is the edited snmpd.conf

####

# First, map the community name "public" into a "security name"
# sec.name source community
#com2sec notConfigUser default public

####

# Second, map the security name into a group name:
#       groupName      securityModel securityName
#group   notConfigGroup v1           notConfigUser
#group   notConfigGroup v2c           notConfigUser

####
# Third, create a view for us to let the group have rights to:
# Make at least snmpwalk -v 1 localhost -c public system fast again.
# name incl/excl subtree mask(optional)
#view systemview included .1.3.6.1.2.1.1

#view systemview included .1.3.6.1.2.1.25.1.1

####

# Finally, grant the group read-only access to the systemview view.
# group context sec.model sec.level prefix read write notif
#access notConfigGroup "" any noauth exact systemview none none
syslocation Sioux Center, IA
syscontact sbensaida@linkmfg.com
com2sec readonly default azzaouia
group myROGroup v2c readonly
view all included .1 80
access MyROGroup ""any noauth exact all none none

Did

linkmfg

Done it and I got " no response from loacalhost"

Here is the edited snmpd.conf

####

# First, map the community name "public" into a "security name"
# sec.name source community
#com2sec notConfigUser default public

####

#view systemview included .1.3.6.1.2.1.25.1.1

####

# Finally, grant the group read-only access to the systemview view.
# group context sec.model sec.level prefix read write notif
#access notConfigGroup "" any noauth exact systemview none none
syslocation Sioux Center, IA
syscontact my email address
com2sec readonly default mycommunitystring
group myROGroup v2c readonly
view all included .1 80
access MyROGroup ""any noauth exact all none none

Did I miss something? Thanks for your time again.