Configuring an external monitoring system

KSMG provides information over SNMP separately for each node of the cluster. An external monitoring system (hereinafter also referred to as the monitoring system) is used for storing, aggregating and analyzing this information.

Configuring the external monitoring system to use SNMP

To configure the external monitoring system:

1. If the monitoring system supports import of MIB files, import the information about MIB objects of KSMG.
2. Add all nodes of the KSMG cluster to the monitoring system as monitored devices (network nodes).
3. For each monitored device, specify the SNMPv3 connection settings:
   • Connection address
   • Port
   • Protocol
   • User credentials: user name, authentication algorithm, authentication password, encryption algorithm, encryption password

     Use the credentials of the user account that you created when configuring the snmpd service on the KSMG cluster node.

4. For each monitored device, specify the list of information to be sent over SNMP. Use the symbolic names of MIB objects or their numeric IDs. For each piece of data, specify its type (integer or string), poll frequency, and storage period.
5. Configure schedules, triggers, and notifications based on the information sent over SNMP.
6. For each node of the KSMG cluster, create a user account to receive traps over SNMPv3.

   Specify user credentials in the settings of the snmpd service on the cluster nodes (the 'trapsess' directive).

7. For each monitored device, specify the list of events received as SNMPv3 traps. Use the symbolic names of MIB objects or their numeric IDs. For events that you consider to be important, create appropriate triggers.

Configuring the snmptrapd service to receive SNMP traps

Some monitoring systems (for example, Zabbix, LibreNMS) use the snmptrapd service from the operating system as the agent for receiving SNMP traps. The snmptrapd service saves information about received events to a log file, which is then read by the monitoring system.

You must configure the snmptrapd service on the computer on which the monitoring service is installed.

To configure the snmptrapd service:

1. Verify that the snmptrapd service and basic MIB files are installed in the operating system.

   If the snmptrapd service is not installed, install the appropriate packages:

   • On Red Hat Enterprise Linux, CentOS, Rocky Linux operating systems:

     yum install net-snmp net-snmp-utils

   • On Debian, Ubuntu, Astra Linux Special Edition:

     apt install snmp snmptrapd

   To install the basic MIB files:

   • On Red Hat Enterprise Linux, CentOS, Rocky Linux:

     yum install net-snmp-libs

   • On Debian, Ubuntu:

     apt install snmp-mibs-downloader

   • On Astra Linux Special Edition, follow the instructions in the Astra Linux documentation.
2. Copy the KSMG MIB files to the directory containing the MIB files, for example, to the /usr/share/snmp/mibs/ksmg directory.
3. To connect the MIB files of the application, add the following lines to the /etc/snmp/snmp.conf configuration file:

   mibdirs +/usr/share/snmp/mibs/ksmg

   mibs all

4. The configuration of the snmptrapd service is stored in the /etc/snmp/snmptrapd.conf file. You can add the necessary information to an existing configuration file or create a new configuration file and add the settings lines.

   If you chose to create a new configuration file, make sure that only the superuser has access to it. If necessary, configure permissions:

   chown root:root /etc/snmp/snmptrapd.conf

   chmod 600 /etc/snmp/snmptrapd.conf

5. Specify the protocol, network interface address, and port number on which the snmptrapd service must listen for SNMP traps. To listen for requests on all network interfaces, add the following line to the configuration file:

   snmpTrapdAddr udp:162

6. To receive SNMP traps over SNMPv3 with authentication and encryption, you must add user accounts with the following information on the side of the snmptrapd service:
   • User name (case sensitive)
   • Authentication algorithm (MD5 or SHA, SHA is recommended)
   • Authentication password
   • Encryption algorithm (DES or AES, AES is recommended)
   • Encryption password

   For security purposes, we recommend creating a separate user account for receiving SNMP traps from each node of the KSMG cluster.

7. For each created user account, add the following lines to the configuration file:

   createUser <trap_username> <trap_auth_algo> "<trap_auth_pass>" <trap_priv_algo> "<trap_priv_pass>"

   authUser log <trap_username> priv

   Example of configuration file: snmpTrapdAddr udp:162 createUser TrapUser SHA "TrapAuthSecret" AES "TrapPrivSecret" authUser log TrapUser priv createUser TrapUser2 SHA "TrapAuthSecret2" AES "TrapPrivSecret2" authUser log TrapUser2 priv

8. To test the snmptrapd service:
   1. Configure the snmpd service on the KSMG cluster node to send SNMP traps to the monitoring system address.
   2. Configure sending SNMP traps in the KSMG web interface.
   3. Start the snmptrapd service in debug mode and wait for SNMP traps to be received.

      To start the snmptrapd service in debug mode:

      snmptrapd -f -Lo

   If everything is configured correctly, within 5 to 10 minutes you will receive an SNMP trap with an event about the KSN status in the application:

   DISMAN-EVENT-MIB::sysUpTimeInstance = Timeticks: (4504) 0:00:45.04

   SNMPv2-MIB::snmpTrapOID.0 = OID: KSMG-EVENTS-MIB::ksnConnectionStatusEvent

   KSMG-EVENTS-MIB::sourceNode = STRING: mailgw01.example.com

   KSMG-EVENTS-MIB::status = STRING: KsnDisabled

9. Configure the integration of the snmptrapd service with the monitoring system.

   To do so, follow the instructions in the documentation of your monitoring system.

The snmpd service is configured.