Open topic with navigation

SNMP

This topic applies to Logger Appliances only.

You can use SNMP (Simple Network Management Protocol) to monitor the health of your appliance. Logger appliance supports SNMP v2c and SNMP v3.

You can configure SNMP polling and notifications (traps): 

• If you configure SNMP polling, a manager station can query the SNMP agent residing on Logger. The information retrieved provides detailed information at the hardware and Operating System level.
• If you configure an SNMP destination, Logger can send notifications for the events below. These notifications differ from the ones sent by Alerts. (For more information on using Alerts to send event information as SNMP notifications, see Real-Time Alerts and SNMP Destinations.) Instead of a notification being for a generic event, the new notifications are specific to a single event, making more easily understood by a Network Management System (NMS) such as Micro Focus NMMi.

SNMP Metrics Supported

Hardware

Logger supports polling and notifications for the following hardware parameters.

• CPU Usage
• Memory Usage
• Disk Almost Full
• Fan Failure
• Power Supply Failure
• Temperature Out of Range
• Ethernet Link Down

Logger application

The following notifications are defined in the ARCSIGHT-EVENT-MIB.

• Login attempt failed
• Password change attempt failed
• User account locked
• Exceeded the maximum number of managed connectors allowed by the license
• Reboot command launched
• Manual backup failed
• Scheduled backup failed
• Enable FIPS mode successful
• Disable FIPS mode successful
• Enable FIPS mode failed
• Disable FIPS mode failed

Configuration on the Logger Appliance

To configure SNMP polling:

1. In the main menu bar, click System Admin.
2. In the navigation tree, under System, click SNMP. The SNMP Poll Configuration tab displays.
3. Status: Select Enabled or Disabled.
4. Port: Enter a port number. The default is 161 (UDP) but can be any available port.

5. SNMP Version: Select V2c or V3. The default is V2c.

   • V2c — Enter the following value:

     Community String: 6–128 alphanumeric, underscore (_), and dash (-) characters.

   • V3 — Enter values for the following fields:

     Username: 4–16 alphanumeric, lower-case characters. The user name must begin with an alphabetic character and may include underscores.

     Authentication Protocol: Select MD5 or SHA.

     Authentication Passphrase: Enter a password consisting of 8–256 characters.

     Privacy Protocol: Select DES or AES128.

     Privacy Passphrase: Enter a password consisting of 8–256 characters.

     Note: To be valid, the values for Poll Configuration and Trap Configuration must match.

6. System Name: Enter a name for the system you want to poll.
7. Point of Contact: Enter a valid notification contact.
8. Location: Enter a location for the system you want to poll.
9. Click Save.
10. Configure the firewall to open the SNMP port, see Firewall Rules.

If an SNMP destination is configured, Logger can send notifications for a limited set of events (see SNMP Metrics Supported.

SNMP notifications differ from those sent by SmartConnectors, which are for a generic ArcSight event. The notifications listed here are specific to a single event, making them easier for understanding by a network management system like Micro Focus NMMi.

To configure the destination for SNMP notifications:

1. In the main menu bar, click System Admin.
2. In the navigation tree, under System, click SNMP. The SNMP Poll Configuration tab displays.
3. Select the SNMP Destination tab to open the SNMP Trap Configuration menu.
4. Status: Select Enabled or Disabled.
5. NMS IP Address: Enter the IP address of the Network Management System (NMS) host.
6. Port: Enter a port number. The default is 162 (UDP) but can be any available port.

7. SNMP Version: Select V2c or V3. The default is V2c.

   • V2c — Enter the following value:

     Community String: 6–128 alphanumeric, underscore (_), and dash (-) characters.

   • V3 — Enter values for the following fields:

     Username: 4–16 alphanumeric, lower-case characters. The user name must begin with an alphabetic character and may include underscores.

     Authentication Protocol: Select MD5 or SHA.

     Authentication Passphrase: Enter a password consisting of 8–256 characters.

     Privacy Protocol: Select DES or AES128.

     Privacy Passphrase: Enter a password consisting of 8–256 characters.

     Note: To be valid, the values for Poll Configuration and Trap Configuration must match.

8. Click Save.

Configuration on the NMS

1. Download ArcSight MIB file and other standard Net-SNMP MIB files using following URLs:

   • https://<system_name_or_ip>/platform-service/ARCSIGHT-EVENT-MIB.txt
   • https://<system_name_or_ip>/platform-service/DISMAN-EVENT-MIB.txt
   • https://<system_name_or_ip>/platform-service/HOST-RESOURCES-MIB.txt
   • https://<system_name_or_ip>/platform-service/IF-MIB.txt
   • https://<system_name_or_ip>/platform-service/UCD-SNMP-MIB.txt

2. Load the MIB.

3. Configure the node (appliance) in the NMS (or MIB browser) according to the protocol used, either v2c or v3.

MIB Contents

The standard MIB files contain the following types of notifications: