search

logstash-plugins / logstash-integration-snmp

Logstash Integration Plugin for SNMP, including SNMP input and SNMP Trap Plugins
Apache License 2.0
0 stars 3 forks source link

tables option doesn't properly handle columns that comprise the index #42

Open johnworkman opened 4 years ago

johnworkman commented 4 years ago

Using this configuration in logstash:

    tables => [ {"name" => "crasSessionTable" "columns" => [
        "1.3.6.1.4.1.9.9.392.1.3.21.1.1", # crasUsername
        "1.3.6.1.4.1.9.9.392.1.3.21.1.3", # crasSessionIndex
        "1.3.6.1.4.1.9.9.392.1.3.21.1.4", # crasAuthenMethod
        "1.3.6.1.4.1.9.9.392.1.3.21.1.6", # crasSessionDuration
        "1.3.6.1.4.1.9.9.392.1.3.21.1.8", # crasLocalAddress
        "1.3.6.1.4.1.9.9.392.1.3.21.1.10", # crasISPAddress
        "1.3.6.1.4.1.9.9.392.1.3.21.1.17", # crasClientVendorString
        "1.3.6.1.4.1.9.9.392.1.3.21.1.18", # crasClientVersionString
        "1.3.6.1.4.1.9.9.392.1.3.21.1.19", # crasClientOSVendorString
        "1.3.6.1.4.1.9.9.392.1.3.21.1.20", # crasClientOSVersionString
        "1.3.6.1.4.1.9.9.392.1.3.21.1.31", # crasSessionInPkts
        "1.3.6.1.4.1.9.9.392.1.3.21.1.32", # crasSessionOutPkts
        "1.3.6.1.4.1.9.9.392.1.3.21.1.33", # crasSessionInDropPkts
        "1.3.6.1.4.1.9.9.392.1.3.21.1.34", # crasSessionOutDropPkts
        "1.3.6.1.4.1.9.9.392.1.3.21.1.35", # crasSessionInOctets
        "1.3.6.1.4.1.9.9.392.1.3.21.1.36", # crasSessionOutOctets
        "1.3.6.1.4.1.9.9.392.1.3.21.1.37" # crasSessionState
    ]}]

Produces this output:

{
  "crasSessionState": 0,
  "crasClientOSVersionString": "10.0.17763 ",
  "crasSessionOutPkts": 62849,
  "crasLocalAddress": "",
  "crasSessionInPkts": 55160,
  "index": "8.x.x.x.x.x.x.x.x.311297",
  "crasSessionInOctets": 12843833,
  "crasClientVendorString": "AnyConnect",
  "crasClientVersionString": "Cisco AnyConnect VPN Agent for Windows 4.8.02045",
  "crasClientOSVendorString": "win",
  "crasSessionOutDropPkts": 0,
  "crasAuthenMethod": 7,
  "crasISPAddress": "x.x.x.x",
  "crasSessionOutOctets": 42538743,
  "crasSessionInDropPkts": 0,
  "crasSessionDuration": 5873
},

The columns crasUsername (1.3.6.1.4.1.9.9.392.1.3.21.1.1) and crasSessionIndex (1.3.6.1.4.1.9.9.392.1.3.21.1.3) are absent from the output.

This is using CISCO-REMOTE-ACCESS-MONITOR-MIB

inokir commented 4 years ago

similar issue:

config:

tables => [ { name => "ifTable_v3" columns => [ "1.3.6.1.2.1.2.2.1.1", "1.3.6.1.2.1.2.2.1.2", "1.3.6.1.2.1.2.2.1.10", "1.3.6.1.2.1.2.2.1.16", "1.3.6.1.2.1.2.2.1.11", "1.3.6.1.2.1.2.2.1.17", "1.3.6.1.2.1.2.2.1.12", "1.3.6.1.2.1.2.2.1.18", "1.3.6.1.2.1.2.2.1.13", "1.3.6.1.2.1.2.2.1.19", "1.3.6.1.2.1.2.2.1.14", "1.3.6.1.2.1.2.2.1.20" ] } ] output:

"ifTable_v3": [ { "ifInErrors": 0, "index": "1", "ifIndex": 1 }, { "ifOutErrors": 0, "index": "2", "ifDescr": "ether2-master" }, { "ifInOctets": 1082509867, "index": "3", "ifInErrors": 0 }, { "ifOutErrors": 0, "index": "4", "ifOutOctets": 0 }, { "ifInErrors": 0, "index": "5", "ifInUcastPkts": 0 }, { "ifOutErrors": 0, "index": "6", "ifOutUcastPkts": 132675414 }, { "ifInErrors": 0, "index": "7", "ifInNUcastPkts": 0 }, { "ifOutErrors": 0, "index": "8", "ifOutNUcastPkts": 0 }, { "ifInErrors": 0, "index": "11", "ifInDiscards": 0 }, { "ifOutErrors": 0, "index": "12", "ifOutDiscards": 0 } ] },