When I started at my new company, one of the first things I did was bring back to life the SolarWinds environment. It had not been changed or updated in at least two years. There were over three hundred down items from devices that were not on the network anymore and another fifty or so duplicate items from people just running Network Discovery and taking in all of the information found. I also found another five hundred devices that were just using ICMP for the polling method because they “did not see the reason for anything else”.
One of the biggest issues I had was around passwords. Specifically SNMP Version 3. The Network team did not want anything to do with me because I was a Server guy and the previous owner of the SolarWinds environment admitted that he had other more important things to do that find what the passwords were. Solarwinds worked, that is all that mattered. I tried everything. I even placed a question on thwack. The problem was that the password in the database is encrypted, so a direct select statement did not work.
After three months, I had consigned myself to the fact that I just had to work a little on the Network team so that they would like me enough to look up the passwords. Even then, that was only the network devices. I had another three thousand cameras out there with SNMP.
I happen to be setting up new alerts in the system and was adding in some variables when I noticed that there was a field called Privacy that showed the SNMPv3 password.
Hallelujah !!!!!!! But now, how to get it. I could not find a way to get an alert variable into a report. But, with a little help from Google and the Solarwinds knowledge base https://support.solarwinds.com/Success_Center/Network_Performance_Monitor_(NPM)/Track_SNMPv3_credentials_that_are_assigned_to_a_node, I was able to create a process to obtain the passwords.
Here are the steps.
NOTE!!!! Please be kind. I am a server guy with some scripting skills but not a programmer. I am sure some of my steps can be easier. This is just want worked for me.
STEP 1 – Set up an alert
You need to set up a NODE alert.
- Open Solarwinds and go to Alerts
- Click on Manage Alerts
- Click on Add New Alert
- Name your alert (This really does not matter as the alert will be deleted once you are done, but you do need to remember the name)
- Set the severity to Notice
- Click Next
- This is the tricky part. You do not want to have to sort through thousands of emails to get the information. What I did is:
- Set the “I want to alert on” to Node
- Under the scope, select “Only following set of objects”. This will bring up a separate selection screen
- In the first box, Leave the selection of Node. In the next box, choose Node Name. Third box shodul say is equal to. In the last box, just start typing the name of one of your devices (this does not matter now, will change later)
- In “The actual trigger condition” section, leave Node in the first field. Second field should be Status. Third box should be is equal to. Click the arrow in the last box and choose Up.
- When you are done, it should look like this
- Click Next
- Change the Reset Condition to No reset Action – Manually remove the alert from the active alerts list.
- Click Naxt
- Click Next through Time of Day
- Now we are going to add an Email Action.
- Click on Add Action.
- Give you action a name.
- Recipients should just be yourself. No need to send passwords to anyone else
- Under message, you can replace everything else with the following items
- Set your SMTP server
- Click Next
- Click Next through Reset Actions
- Down at the bottom of the screen, you should see that this alert would immediately trigger on 1 Object. If you see more than that, go back through the instructions.
- Go ahead and submit
- You shodul receive one email.
- Go back into manage alerts and Disable the alert for now.
Step 2 – Find your SNMP devices.
This part was a little tricky as well. I did not want to hunt through thousands of devices to find the one or two that had separate SNMP credentials. Fortunately, this is where the link above to Solarwinds knowledge base saved me.
- Open an RDP session to your Solarwinds server
- Go into your programs and look for the “Database Manager” in the SolarWinds group (Not the Database Maintenance but the Manager). You can also use SQL Management studio if you are so inclined. I did not have direct access to the database at this time, so this was a workaround
- Once you have the database manager opened, click on Add Default server
- Select the correct database
- Right click on the Database and choose New Query.
- In the query window, type in SELECT TOP 10000 * FROM [dbo].[NodeSettings] WHERE SettingName LIKE '%SNMP%'
- Click on the heading “SettingValue” so that it sorts by that value
Step 3 – Run the Alert
This is where the big payoff is. You just need to run through each of these steps until you gather all of the information. I placed the information in a TXT file and then opened within Excel to separate fields.
- In the left hand window on the Database Manager, find the SolarWinds database and choose New Query
- In this window, you are going to put in the following query
- SELECT TOP 10000 Nodesettings.NodeID,Nodes.IP_Address,Nodes.DNS FROM [dbo].[NodeSettings] INNER JOIN Nodes on NodeSettings.NodeID=Nodes.NodeID WHERE SettingName LIKE '%SNMP%' AND SettingValue='####'
- Replace the #### with the “SettingValue” number that you have listed from the previous query. It may only be two characters. You do not need to add 0s
- Execute the query. This will bring up all of the devices with that particular SNMP credential set.
- In Solarwinds, you are going to have two windows open. One on the Manage Nodes screen and one on the Alert Manager screen.
- In the Manage nodes screen, choose one of the listed devices from the above query and go into Edit Properties.
- Make sure this node is using Version 3 of SNMP. When I ran through this, I had one that was version 1. It is a good idea to double check.
- Once that is verified, go to your Alert Manager window and edit your SNMP alert that you created in Step 1.
- Go to the Trigger condition screen and type in the name of the node you selected in the Only following set of objects field
- Next all the way to the end (Solarwinds needs to put in a “Finish” button on these screens)
- Now Enable the alert
- Within five seconds, I had my alert. Depending on your email system, it might take longer.
- Once you receive the alert in your email. Disable the alert from Alert Manager.
- Now you can take a look the alert. In the alert, you will see the Privacy as well as the authentication password and the username.
- Once you are done with the information, go to the Database Manager Query window and choose the next “SettingValue” and run through the process again and again until you have captured all of your credentials.