Authoritative engine Id and context engine id in snmp v3 - snmp

I have a client machine which sends snmpinform.
In other machine i am running snmptrapd server.
I wanted to mention context engine id and authoritative engine id explicitly.
While sending command i can use -e for authoritative engine id, -E for context engine Id.
But, the problem is how can I mention these values in the snmptrad.conf
Snippet of snmptrapd.conf is
createUser -e 0x000006D70000000000000000 FMS
authUser log,execute,net FMS noauth
engineID 000006D7C0A800C800000000
My command for snmpinform is :
snmpinform -v 3 -d -n "" -l noAuthNoPriv -u FMS -E 0x000006D70000000000000000 -e 80001f8804303030303036443743304138303043383030303030303030 192.168.0.200 162 1.3.6.1.4.1.1751.2.119.1.1.1.0
The output is timeout(Error message came). Further investigations with wireshark showed, in the report it is giving both authoritative and context engine ids with same values.
I did try several work arounds without any use
Did not give -e option while sending snmpinform. It did discovery of authoritative engine Id and the output is still the same (Error message and timeout)
Did not give -E option. snmpinform: Unknown user name
obv: It seems to be completely different behavior. It is able to properly decode the context engine id and able to identify the user name. But, the report is with the different
context engine id.
Did not give -e option while creating user and while sending gave only -e(Authoritative engine id). Then it worked perfectly.
obv: Both the authoritative and context engine ids are same. So, it worked perfectly.
What should do if i want to mention both the engine ids in the conf file?
How can i give authoritative engine id in snmptrapd.conf file as hex number?. It expectes text string. What if i have non-printable characters.
Thanks for reading patiently :-)

I think -3e for (security) engine ID and -3E for context engine ID should do the trick for snmptrapd.conf. I found these in the net-snmp source in snmplib/snmpv3.c:150 for reference, not really sure if they are documented.
I think that is what you're asking for? You may need to play with the net-snmp source and step through things if snmptrapd doesn't behave correctly.

Related

How Jmeter handles LDAP Referral mechanism

I am trying to do a LDAP mod operation through Jmeter. Expected behavior - Jmeter would hit server A which in turn would hit server B. Actual modification operation would happen at server B. Server B would complete the operation and give response to server A which in turn would respond to Jmeter.
Now the issue is, Jmeter is always getting the "Referral" response message. However, manually we are able to change the password after hitting server A from different remote server.
Could you someone please suggest how to overcome this?
I am assuming this has been resolved. Just in case you are still wondering, #Rohan , my understanding is that you run jmeter on the command line:
$ jmeter -Jjava.naming.referral=true -n -t testplan.jmx -l log.jtl
JMeter won't have specific behaviour of its own. You will need to tell it to follow referrals by setting java.naming.referral property appropriately in the jndi.properties mechanism defined in the documentation for the JNDI LDAP provider, which you should already have in place for your application if you expect it to behave that way.

How to eliminate "unique visitors" information from GoAccess report?

The webserver of which I am off-line analyzing the logs sits behind a proxy server. The IP addresses in the log file are not the ones from the clients but the ones from the hand full of proxy servers. This I cannot change. The parsing works well, but the number of "unique visitors" that GoAccess calculates is therefor not valid.
How can I eliminate that information from the html reports as it is misleading? I tried to hide the IP address from the analyzer with %^ instead of %h but that leads to an error.
I read the GoAccess manual but I can't find an option to ignore the unique visitors. GoAccess Version is 1.1.1.
Manny thanks in advance.

How do I use the public swagger-generator docker image to generate a client?

We have a fully dockerized web app with a valid Swagger definition for the API. The API runs in its own docker container, and we're using docker-compose to orchestrate everything. I want to generate a Ruby client based on the Swagger definition located at http://api:8443/apidocs.json.
I've poured through the documentation here, which led me to Swagger's public docker image for generating client and server code. Sadly the documentation is lacking and offers no examples for actually generating a client with the docker image.
The Dockerfile indicates its container runs a web service, which I can only assume is the dockerized version of http://generator.swagger.io. As such, I would expect to be able to generate a client with the following command:
curl -X POST -H "content-type:application/json" -d \
'{"swaggerUrl":"http://api:8443/apidocs"}' \
http://swagger-generator:8080/api/gen/clients/ruby
No luck here. I keep getting "invalid swagger definition" even though I've confirmed the swagger definition is valid with (npm -q install -g swagger-tools >/dev/null) && swagger-tools validate http://api:8443/apidocs.
Any ideas?
indeed you are correct, the docker image you're referring to is the same image used at http://generator.swagger.io
The issue you're having is the input parameter isn't correct.
Now to get it right, please note that the swagger-generator has a web interface. So once you start it up, like the instructions say, open it in a browser. For example (replace the GENERATOR_HOST with your machine's IP address):
docker run -d -e GENERATOR_HOST=http://192.168.99.100 -p 80:8080 swaggerapi/swagger-generator
then you can open the swagger-ui on http://192.168.99.100
The important part here is that you can use the UI to see the call syntax. If you're generating a client, go to http://192.168.99.100/#!/clients/generateClient select the language you want to generate and click the payload on the right. Replace the swaggerUrl field with the address of your server and voila.
You can use the output in the curl to figure out how to call from the command line. It should be easy from there.
Please keep in mind that just because a 3rd party tool says the swagger definition is valid doesn't mean it actually is. I don't think that's your issue, though, but 3rd party tool mileage may vary...

OpenNMS alert when a folder is not empty?

I'm trying to create an OpenNMS alert when a certain folder ISN'T empty but can't seem to find a way of doing it. Any ideas?
I assume you have a service which goes down if your folder is empty. See the short video. By default notifications are turned off. Every service down event will be notified by default. You can be more granular by filtering on nodes and services. The default setting will send a mail to the admin user. You set a mail address in the user of the admin. To configure the access to your mail server, configure the javamail-configuration.properties. I just tried to figure out where you stuck exactly.
One approach could be to poll the certain directory for the empty condition with an agent on your host system and expose the status, e.g. Net-SNMP. You can create a service by using the SNMP Monitor to poll the status of the exposed OID and create a mail notification for this particular service.
Yes, this can be done. I have performed similar tasks using simple perl and bash scripts on Linux.
OpenNMS allows you to create polling configurations based on scripts. Your script is expected to output "0" or "1", with 0 representing "OK" and 1 representing "Not OK".
You could use the GeneralPurposePoller:
https://wiki.opennms.org/wiki/GeneralPurposePoller
However, it seems that you should instead use the SystemExecuteMonitor:
https://wiki.opennms.org/wiki/SystemExecuteMonitor

Reading syslog output on a Mac

I have a program that was written for linux and I am trying to build and run it on my MacOS 10.5 machine. The program builds and runs without problem, however it makes many calls to syslog. I know that syslogd is running on my mac, however I can't seem to find where my syslog calls are output to.
The syslog calls are of the form
syslog (LOG_WARNING, "Log message");
Any idea where I might find my log output?
/var/log/system.log
You can monitor it easily using tail -f /var/log/system.log
See also the "logger" (man logger) and "syslog" (man syslog).
You should probably use the Console.app to view logfiles. It's purdy.
Select your device on the left and filter messages on the right:
Maybe interesting to note: Apple was using a real syslogd in the past but meanwhile all of this has switched to ASL (Apple System Log). The syslog command is still available, but it will only access this one log. If you want to access all log messages of ASL across all log files configured, use the log command.
E.g. the following shows all log messages produced by Safari within the last two days (be patient, can take a while):
log show --predicate 'process == "Safari"' --last 2d
See man log for all the actions you can perform, all the parameters it knows and what attributes you can filter for.
When in doubt, there's always man syslog.
You can find your messages in /var/log/syslog; my machine is set up out of the box to only include high level messages so you may need to have your settings.
You can also read the messages through syslog(1), or create a test message with a command like
$ syslog -s -l INFO "Hello, world."
use a severity of P ("panic") and you'll get an exciting message on your console immediately.
Mac OS X implements a superset of syslog's functionality. All of syslog is there, but as part of ASL.
Console, mentioned by Matthew Schinckel in his answer, is the GUI on ASL. It'll show you any messages that exist in the database, as fetched by queries listed in the sidebar. There are two queries by default; one only shows messages sent with the Console facility (as used by NSLog, among other things), whereas the other shows all log messages. Check the all-messages query; you'll probably find your message there.
That “all” does come with an asterisk. If you look in /etc/asl.conf, you'll see this line:
# save everything from emergency to notice
? [<= Level notice] store
Fortunately, in your case, the message will pass this check, since warning outranks (is a lesser number than) notice.
If you need complex syslog analysis (navigation hour by hour in terminal, regexp, comparing in real time w\ other files or even running SQL over syslog) lnav would seamlessly provide it for you.
Installation:
brew install lnav
Usage:
lnav /var/log/system.log
UI itself:
Building on Charlie's answer, I would like to add that you should take a look at the manpage of syslog.conf(5) and also take a peek at the file /etc/syslog.conf (which is where the syslog configuration is defined by default and also, as I see it, on OS X 10.5.x).
Check for a call to openlog somewhere in the program. After a call to openlog, syslog will save its output to that log file instead of the default location.
Big Sur
Unfortunately, non of the stated answers worked for me.
What Worked for me:
The system mail accessed using the mail program from the terminal had all the /usr/sbin/cron logs in emails.

Resources