Agent don't use the right IP address for SNMP inventory

[NetItUp-FrancescoPasqualatto]

Describe the bug

Hi, I've found a bug that when you run an inventory task on known snmp device, it will use the first IP address in the alphabetical order in the ip address table(it may not be the same address used for the snmp discovery).

To reproduce

1. Run discovery snmp task
2. Run inventory snmp task (and ip address are as I have explained)

Expected behavior

It import inventory information for the device.

Operating system

Windows, Linux

GLPI Agent version

1.5, 1.4

GLPI version

10.0.9, 10.0.7

GLPIInventory plugin

1.2.3

Additional context

I've found it with many devices but I'll use Synolgy as an example. When I run the inventory task and force inventory I see this and the device entry don't update with inventory information; If you go on network ports tab you can see that the first ip address is not the one used for snmp(and if I remove that the inventory works fine): I also checked this by packet capture:

24SENDSNMPQUERY .... You can see this in code at line 567 of networkinventory.class.php(it select the first element of the table): $ip = current(PluginGlpiinventoryToolbox::getIPforDevice( $jobstate->fields['itemtype'], $jobstate->fields['items_id'] )); All of this remains true with and without ip ranges because the address used for snmp is always fatched from this table I think... I don't know how to solve this, maybe a flag for snmp address is needed.

[stonebuzz]

Hi @NetItUp-FrancescoPasqualatto

your inventory task task is based on IPRange or on asset ?

[NetItUp-FrancescoPasqualatto]

I've tried both approaches but the result is the same: with glpi-injector the inventory is imported(or with changes on the ip table).

[g-bougard]

Hi @NetItUp-FrancescoPasqualatto have you checked the glpi-agent log to see which ip it finally uses during netinventory ? Just to be sure what ip was sent by the plugin.

[NetItUp-FrancescoPasqualatto]

Yes, this is part of the log that prove my point:

12SENDSNMPQUERY ... [Fri Sep 29 13:36:40 2023][debug] WakeOnLan task execution not requested [Fri Sep 29 13:36:40 2023][debug] Remote inventory task execution disabled: no remote to inventory [Fri Sep 29 13:36:40 2023][info] running task NetInventory [Fri Sep 29 13:36:40 2023][debug] Current run expiration timeout: 1.0 hour [Fri Sep 29 13:36:40 2023][debug] creating 1 worker threads [Fri Sep 29 13:36:40 2023][debug] [thread 1] creation [Fri Sep 29 13:36:40 2023][debug] [http client] Using Compress::Zlib for compression [Fri Sep 29 13:36:40 2023][debug2] [http client] sending message: 1.4-1 1 5.1 281 GLA01-2023-06-09-11-33-47 SNMPQUERY [Fri Sep 29 13:36:40 2023][info] [http client] SSL Client info: Cert-Issuer: '/C=US/O=Let's Encrypt/CN=R3', Cert-Subject: '/CN=aaa', Version: 'TLSv1_3', Cipher: 'TLS_AES_256_GCM_SHA384' [Fri Sep 29 13:36:40 2023][info] [http client] SSL server certificate fingerprint: sha256$2226ca28dbb6e5afd2668cc8dd15851377e5b36dd6a482b4544b044a7ea4fc44 [Fri Sep 29 13:36:40 2023][info] [http client] You can set it in conf as 'ssl-fingerprint' and disable 'no-ssl-check' option to trust that server certificate [Fri Sep 29 13:36:40 2023][debug2] format: Zlib [Fri Sep 29 13:36:40 2023][debug2] [http client] receiving message: [Fri Sep 29 13:36:40 2023][debug] [thread 1] #1, scanning 79: 169.254.45.136 [Fri Sep 29 13:37:40 2023][error] [thread 1] #1, [thread 1] SNMP communication error: no response from host 169.254.45.136 [Fri Sep 29 13:37:40 2023][debug] [thread 1] #1, [http client] Using Compress::Zlib for compression [Fri Sep 29 13:37:40 2023][debug2] [thread 1] #1, [http client] sending message: 79 SNMP communication error: no response from host 169.254.45.136 NETWORKING 5.1 281 GLA01-2023-06-09-11-33-47 SNMPQUERY It gave this IP in the log with both task

[stonebuzz]

from IPRange target I can easily check the list of IPs and only (first) use the one that corresponds to the IPRange

from Asset target i can't compare with IPRange (logic !)

At one point we tried to keep a record of the IP that responded to the SNMP discovery, but it was much more complex than we expected.

Can you try this (try only with IPRAnge target) https://github.com/glpi-project/glpi-inventory-plugin/pull/416

[NetItUp-FrancescoPasqualatto]

with your code it gave me: Error "device has no ip": [debug] WakeOnLan task execution not requested [error] invalid device: no address defined [error] invalid job: no valid device defined [error] no valid job found, aborting

Once I have programmed this bad code:

$ip_a = PluginGlpiinventoryToolbox::getIPforDevice( $jobstate->fields['itemtype'], $jobstate->fields['items_id'] ); $ip = ''; if(count($ip_a) > 1) { $ip1 = current($ip_a); $ip2 = next($ip_a); if($ip2 != '') { $ip = $ip2; } else { $ip = $ip1; } } else { $ip = current($ip_a); }

It update everything but works only if the snmp address is in the second place. (I don't know if it can be useful)

[stonebuzz]

Are you sure you tested with an IPRAnge?

It seems not, I've adjusted the PR to keep the same behaviour as now (first IP is used) when the target is an Asset

[NetItUp-FrancescoPasqualatto]

I've used IPRange as target for the task...

[stonebuzz]

Can you run this SQL query and past here the result

SELECT * FROM glpi_plugin_glpiinventory_taskjobstates WHERE plugin_glpiinventory_taskjobs_id = ID_OF_TASK

[NetItUp-FrancescoPasqualatto]

I've used the id of the IPRange task.

table.txt

[cedric-anne]

You should look at my last comment on #416 . I guess there was a mistake in the proposal.

[stonebuzz]

The problem is that an SNMP inventory task creates a job for each asset (and not a job with the IP Range).

So I can't check the IP from Range

[stonebuzz]

I don't know if I can do any better.

Since I can't compare the asset IPs with the IPRange and since we don't keep the contact IP, it's impossible for me to deduce the correct IP.

Perhaps you could add unwanted IPs to the black list to prevent them from being back

[NetItUp-FrancescoPasqualatto]

What If we try all Ip address? or keep the contact IP in a new field?

[stonebuzz]

What If we try all Ip address?

When Agent want a JOB configuration plugin return one IP (and XML body have only one IP node)

keep the contact IP in a new field

It's going to take a lot of effort for a single reported issue

[g-bougard]

@NetItUp-FrancescoPasqualatto And to amend @stonebuzz comment, we will probably rewrite that code in a near future, mayby making it native to glpi. So we don't want to pass too much time on this legacy code. Indeed, identifying such problem can just help us to start the rewrite earlier than actually expected.

[NetItUp-FrancescoPasqualatto]

Ok, thanks. I understand that there isn't a quick solution to this problem. I think it should be pretty common because it's easy to have IP addresses in the wrong order.

[stonebuzz]

Perhaps you could add unwanted IPs to the black list to prevent them from being back

Should solved this issue.

not being able to go any further for the moment I take the liberty of closing this issue

Best regards