sensu / sensu-go

Simple. Scalable. Multi-cloud monitoring.
https://sensu.io
MIT License
1.03k stars 175 forks source link

Unable to get Palo Alto FW MIB to translate in Sensu #3612

Closed micruzz82 closed 4 years ago

micruzz82 commented 4 years ago

I have uploaded the Palo Alto MIB files into Sensu directory /etc/sensu/mibs

However I receive the alerts as below:

image

This doesn't provide information as if the box is rebooted, the alert does not change from green to red.

Also it only shows me the IP address of the box.

image

The PA firewall is unable to set the SNMP trap port to 1062, so I have configured:

iptables -t nat -A PREROUTING -p UDP --dport 162 -j REDIRECT --to-port 1062 on the box.

This is a development lab to test what Sensu can do for monitoring and everything is configured on 1 VM running Ubuntu for Sensu-backend and Sensu-client with SNMP-Trap extension plugin.

Expected Behavior

Sensu guide state:

"This directory is where the SNMP extension will look for any MIB files used to translate the trap OIDs into something that’s readable by humans…unless you know what your OID means off the top of your head.

You’ll need to ensure that you place the MIB provided by your device manufacturer in directory above. If you already have MIBs present in another location, you can override the default location by specifying the the mibs_dir or imported_dir attributes in your snmp_trap.json configuration file."

However this does not look to be the case.

Current Behavior

Sensu does not translate the MIBS after importing to correct location.

Possible Solution

Allow Sensu to read the MIB and translate received SNMP.

Steps to Reproduce (for bugs)

  1. Setup virtual PA firewall device
  2. Send SNMP trap to Sensu Monitoring server
  3. Review SNMP traps received on Sensu Dashboard.

Context

I require to create an opensource Palo Alto monitoring dashaboard so we can receive SNMP traps from our devices.

If there was a way where Sensu can listen on default SNMP trap port of 162/UDP that would perhaps eliminate having to redirect from 162 to 1062. Also if there was a way to upload a MIB file on the dashboard and all the relevant parameters of the MIB file is auto translated to the corresponding OID values.

Your Environment

Distributor ID: Ubuntu Description: Ubuntu 18.04.4 LTS Release: 18.04 Codename: bionic

echlebek commented 4 years ago

Hi @micruzz82, this issue is not related to sensu-go, and is instead related to a Sensu Classic extension. (https://github.com/sensu-plugins/sensu-extensions-snmp-trap)

Feel free to submit an issue there, however you should be aware that Sensu Classic has reached end-of-life and it's uncertain if anyone will pick up the issue and work on it.