BUG: SNMP v3 with HP printer - any update or even better a solution?

Hi CheckMK-Community,

I’m quite new to checkmk and this forum, so please apologize if I address my question not in the appropriate way.
In the forums archive I found a topic about using SNMPv3 with HP Printers
==> [Check_mk (english)] SNMP v3 with HP printer
I was not able to reply to this post, so created a new one…

I tested this with 1.16.0p16 and it still seams to be an issue :frowning:
So situation is:

  • I created a check with SNMPv3 (authPriv) and the snmp-context “Jetdirect” set as parameter

Results:

  • in WATO I can test the access successfully
  • with CLI and snmp I could also get access
  • but no access with WATO => Services => “full scan” possible

Happy to get any suggestion from you guys :slight_smile:
Georg

Hi Georg

I’ve been using SNMP v2 for our HP printers since the bottom line of the other topic. It sound like the same problem as I had then:

I’ve reported the bug at 09.11.2016, 08:03 to the address feedback@check-mk.org. I didn’t track, if the bug was resolved.

Sorry, for not having a solution. Maybe you can switch to snmp v2 as a workaround. If you have the paid “Checkmk Enterprise Standard” edition you can ask the support.

Cheers
Michael

Hi Michael,

Thanks for your reply.
Yes, I’m also using SNMPv2 and it works.
But it makes no sense, to not fix this bug.
“Save&Test” in WATO works with SNMPv3, why not make the check able to use the proper snmp-context?
I got all my devices to work with SNMPv3, would be great to have also the HP Printers work with SNMPv3.
I will give it a try and send a mail to the address you mentioned above.
Let’s see :slight_smile:

Kind regards
Georg

If i have a bit of time left i take a look at the actual code and if i can find the problem as 4 years before, i will make a pull request on github. :slight_smile:

1 Like

cool! :slight_smile:
Let me know if you need someone for testing.
Georg

I see that this issue is fixed. I was struglling with same configuration for a network device.
https://checkmk.com/check_mk-werks.php?werk_id=5054

Only problem, it will not do discovery for this OIDs .1.3.6.1.2.1.1.1.0 and .1.3.6.1.2.1.1.2.0 with context.
I added rule for “Hosts without system description OID”
and its started working.

Hi Sunil,
hi checkmk-Forum,

many thanks. This helped, but still no final success.
The Situation is somehow wired and still pretty much the same as Michael described in his initial post.

Setup:
I just installed a brand new system with checkmk 1.6.0p17, doing only the HP Printer checks.
Also I added two rules:
A) “SNMPv3 contexts to use in requests”
B) “Hosts without system description OID”
C) setup SNMPv3 credentials

Situation:

  1. a “full scan” in WATO ends with [Errno 111] Connection refused, but if I do “automatic refresh” the services show up eventually
  2. a Test in WATO => “Save & Test” is 100% predictable successful, everything “green”
  3. all services show up in “Main Overview” but stuck in “stalled” forever. 2 problems pop up, both with [Errno 111]

So basically it’s still the same result a described by Michael.
Any hint, how to get SNMPv3 with HP Printers up and running?

Kind regards
Georg

I had a look at the code and found the following strange comments :smiley:

The referenced file is ~/lib/python/cmk_base/snmp.py - version inspected was 1.6.0p16 - it should be not relevant if it is Enterprise or Raw

Starting Line 267

# Contextes can only be used when check_plugin_name is given.
...
# get_single_oid() can only return a single value. When SNMPv3 is used with multiple
# SNMP contexts, all contextes will be queried until the first answer is received.
if check_plugin_name is not None and snmp_utils.is_snmpv3_host(snmp_config):
    snmp_contexts = _snmpv3_contexts_of(snmp_config, check_plugin_name)
else:
    snmp_contexts = [None]

console.vverbose("       Getting OID %s: " % oid)
for context_name in snmp_contexts:
    try:
        snmp_backend = SNMPBackendFactory().factory(snmp_config,
                                                    enforce_stored_walks=_enforce_stored_walks)
        value = snmp_backend.get(snmp_config, oid, context_name)

        if value is not None:
            break  # Use first received answer in case of multiple contextes
    except:
        if cmk.utils.debug.enabled():
            raise
        value = None

The first comment is what i find strange - why?
I have here no devices to test but on thing i would test if possible is the following.

change the following line

if check_plugin_name is not None and snmp_utils.is_snmpv3_host(snmp_config):

to

if snmp_utils.is_snmpv3_host(snmp_config):

After this change it is important to test if not only the scan is working but also the checking.

I would do this first on the command line after the change with.

cmk --debug -vvI device

and

cmk --debug -vvn device

After i read a little bit inside the source a found no reason why you cannot use the context for scan.

Hi Georg,

I cannot answer HP printer per se, I was facing this issue for a switch.
Can you try discovery Inventory on the command line to check.

cmk --debug -vvI PrinterName

Hi Andreas,
Many thanks indeed!
I changed the code-line and did the checks via cli.
BTW: I found one config error in my setup which has lead to the [Errno 111]

I can confirm, that the check makes use of the snmp context! That’s great :slight_smile:
But of course I got still error in the debug output :frowning:

OMD[<SITE>]:~$ cmk --debug -vvn <HOSTNAME>
[cpu_tracking] Start with phase 'busy'
Check_MK version 1.6.0p17
Try aquire lock on /omd/sites/<SITE>/tmp/check_mk/counters/<HOSTNAME>
Got lock on /omd/sites/<SITE>/tmp/check_mk/counters/<HOSTNAME>
Releasing lock on /omd/sites/<SITE>/tmp/check_mk/counters/<HOSTNAME>
Released lock on /omd/sites/<SITE>/tmp/check_mk/counters/<HOSTNAME>
Loading autochecks from /omd/sites/<SITE>/var/check_mk/autochecks/<HOSTNAME>.mk
+ FETCHING DATA
[cpu_tracking] Push phase 'snmp' (Stack: ['busy'])
 [snmp] No persisted sections loaded
 [snmp] Not using cache (Don't try it)
 [snmp] Execute data source
 [snmp] if: Fetching data
Running 'snmpbulkwalk -Cr10 -v3 -l authPriv -a sha -u monitor -A <PASSWD> -x AES -X <PASSWD> -m "" -M "" -n Jetdirect -Cc -OQ -OU -On -Ot <IP-ADDRESS> .1.3.6.1.2.1.2.2.1.1'
Running 'snmpbulkwalk -Cr10 -v3 -l authPriv -a sha -u monitor -A <PASSWD> -x AES -X <PASSWD> -m "" -M "" -n Jetdirect -Cc -OQ -OU -On -Ot <IP-ADDRESS> .1.3.6.1.2.1.2.2.1.2'
Running 'snmpbulkwalk -Cr10 -v3 -l authPriv -a sha -u monitor -A <PASSWD> -x AES -X <PASSWD> -m "" -M "" -n Jetdirect -Cc -OQ -OU -On -Ot <IP-ADDRESS> .1.3.6.1.2.1.2.2.1.3'
Running 'snmpbulkwalk -Cr10 -v3 -l authPriv -a sha -u monitor -A <PASSWD> -x AES -X <PASSWD> -m "" -M "" -n Jetdirect -Cc -OQ -OU -On -Ot <IP-ADDRESS> .1.3.6.1.2.1.2.2.1.5'
Running 'snmpbulkwalk -Cr10 -v3 -l authPriv -a sha -u monitor -A <PASSWD> -x AES -X <PASSWD> -m "" -M "" -n Jetdirect -Cc -OQ -OU -On -Ot <IP-ADDRESS> .1.3.6.1.2.1.2.2.1.8'
Running 'snmpbulkwalk -Cr10 -v3 -l authPriv -a sha -u monitor -A <PASSWD> -x AES -X <PASSWD> -m "" -M "" -n Jetdirect -Cc -OQ -OU -On -Ot <IP-ADDRESS> .1.3.6.1.2.1.2.2.1.10'
Running 'snmpbulkwalk -Cr10 -v3 -l authPriv -a sha -u monitor -A <PASSWD> -x AES -X <PASSWD> -m "" -M "" -n Jetdirect -Cc -OQ -OU -On -Ot <IP-ADDRESS> .1.3.6.1.2.1.2.2.1.11'
Running 'snmpbulkwalk -Cr10 -v3 -l authPriv -a sha -u monitor -A <PASSWD> -x AES -X <PASSWD> -m "" -M "" -n Jetdirect -Cc -OQ -OU -On -Ot <IP-ADDRESS> .1.3.6.1.2.1.2.2.1.12'
Running 'snmpbulkwalk -Cr10 -v3 -l authPriv -a sha -u monitor -A <PASSWD> -x AES -X <PASSWD> -m "" -M "" -n Jetdirect -Cc -OQ -OU -On -Ot <IP-ADDRESS> .1.3.6.1.2.1.2.2.1.13'
Running 'snmpbulkwalk -Cr10 -v3 -l authPriv -a sha -u monitor -A <PASSWD> -x AES -X <PASSWD> -m "" -M "" -n Jetdirect -Cc -OQ -OU -On -Ot <IP-ADDRESS> .1.3.6.1.2.1.2.2.1.14'
Running 'snmpbulkwalk -Cr10 -v3 -l authPriv -a sha -u monitor -A <PASSWD> -x AES -X <PASSWD> -m "" -M "" -n Jetdirect -Cc -OQ -OU -On -Ot <IP-ADDRESS> .1.3.6.1.2.1.2.2.1.16'
Running 'snmpbulkwalk -Cr10 -v3 -l authPriv -a sha -u monitor -A <PASSWD> -x AES -X <PASSWD> -m "" -M "" -n Jetdirect -Cc -OQ -OU -On -Ot <IP-ADDRESS> .1.3.6.1.2.1.2.2.1.17'
Running 'snmpbulkwalk -Cr10 -v3 -l authPriv -a sha -u monitor -A <PASSWD> -x AES -X <PASSWD> -m "" -M "" -n Jetdirect -Cc -OQ -OU -On -Ot <IP-ADDRESS> .1.3.6.1.2.1.2.2.1.18'
Running 'snmpbulkwalk -Cr10 -v3 -l authPriv -a sha -u monitor -A <PASSWD> -x AES -X <PASSWD> -m "" -M "" -n Jetdirect -Cc -OQ -OU -On -Ot <IP-ADDRESS> .1.3.6.1.2.1.2.2.1.19'
Running 'snmpbulkwalk -Cr10 -v3 -l authPriv -a sha -u monitor -A <PASSWD> -x AES -X <PASSWD> -m "" -M "" -n Jetdirect -Cc -OQ -OU -On -Ot <IP-ADDRESS> .1.3.6.1.2.1.2.2.1.20'
Running 'snmpbulkwalk -Cr10 -v3 -l authPriv -a sha -u monitor -A <PASSWD> -x AES -X <PASSWD> -m "" -M "" -n Jetdirect -Cc -OQ -OU -On -Ot <IP-ADDRESS> .1.3.6.1.2.1.2.2.1.21'
Running 'snmpbulkwalk -Cr10 -v3 -l authPriv -a sha -u monitor -A <PASSWD> -x AES -X <PASSWD> -m "" -M "" -n Jetdirect -Cc -OQ -OU -On -Ot <IP-ADDRESS> .1.3.6.1.2.1.2.2.1.6'
 [snmp] printer_alerts: Fetching data
Running 'snmpbulkwalk -Cr10 -v3 -l authPriv -a sha -u monitor -A <PASSWD> -x AES -X <PASSWD> -m "" -M "" -n Jetdirect -Cc -OQ -OU -On -Ot <IP-ADDRESS> .1.3.6.1.2.1.43.18.1.1.2'
Running 'snmpbulkwalk -Cr10 -v3 -l authPriv -a sha -u monitor -A <PASSWD> -x AES -X <PASSWD> -m "" -M "" -n Jetdirect -Cc -OQ -OU -On -Ot <IP-ADDRESS> .1.3.6.1.2.1.43.18.1.1.4'
Running 'snmpbulkwalk -Cr10 -v3 -l authPriv -a sha -u monitor -A <PASSWD> -x AES -X <PASSWD> -m "" -M "" -n Jetdirect -Cc -OQ -OU -On -Ot <IP-ADDRESS> .1.3.6.1.2.1.43.18.1.1.5'
Running 'snmpbulkwalk -Cr10 -v3 -l authPriv -a sha -u monitor -A <PASSWD> -x AES -X <PASSWD> -m "" -M "" -n Jetdirect -Cc -OQ -OU -On -Ot <IP-ADDRESS> .1.3.6.1.2.1.43.18.1.1.7'
Running 'snmpbulkwalk -Cr10 -v3 -l authPriv -a sha -u monitor -A <PASSWD> -x AES -X <PASSWD> -m "" -M "" -n Jetdirect -Cc -OQ -OU -On -Ot <IP-ADDRESS> .1.3.6.1.2.1.43.18.1.1.8'
 [snmp] printer_input: Fetching data
Running 'snmpbulkwalk -Cr10 -v3 -l authPriv -a sha -u monitor -A <PASSWD> -x AES -X <PASSWD> -m "" -M "" -n Jetdirect -Cc -OQ -OU -On -Ot <IP-ADDRESS> .1.3.6.1.2.1.43.8.2.1.13'
ERROR: SNMP error: Timeout: No Response from <IP-ADDRESS>
 [snmp] ERROR: SNMP Error on <IP-ADDRESS>: Timeout: No Response from <IP-ADDRESS> (Exit-Code: 1)
[cpu_tracking] Pop phase 'snmp' (Stack: ['busy', 'snmp'])
CRIT - SNMP Error on <IP-ADDRESS>: Timeout: No Response from <IP-ADDRESS> (Exit-Code: 1)

My take is, that everything good until the snmpbulkwalk hits the last OID .1.3.6.1.2.1.43.8.2.1.13.
But why in snmpbulkwlak not just ignoring the missing OID response?
Any way the exclude this OID or any other way to get this error solved?

Kind regards
Georg

I think this could be a bulkwalk problem.
Can you compare if you do a

snmpbulkwalk -Cr10 -v3 -l authPriv -a sha -u monitor -A <PASSWD> -x AES -X <PASSWD> -m "" -M "" -n Jetdirect -Cc -OQ -OU -On -Ot <IP-ADDRESS> .1.3.6.1.2.1.43.8.2.1.13

with

snmpwalk -v3 -l authPriv -a sha -u monitor -A <PASSWD> -x AES -X <PASSWD> -m "" -M "" -n Jetdirect -Cc -OQ -OU -On -Ot <IP-ADDRESS> .1.3.6.1.2.1.43.8.2.1.13

If the normal walk don’t work you can only disable the “printer_input” check for this device.
Look for the rule “Disabled checks”.


Good news for the v3 context problem. Inside the code for version 1.7 this looks like already removed and there should be no problem anymore with the original problem :slight_smile:

1 Like

Hi All,

since some time the check via snmpv3 runs absolutely reliable on the various HP printers (HP PageWide Pro Series).
So I want to share the result and details here, maybe someone else can use it.

  1. the update from Checkmk 1.6.0p17 to Checkmk 1.6.0p18 has shown that the small patch (~/lib/python/cmk_base/snmp.py) from Andreas is absolutely necessary:

     change the following line
    
     if check_plugin_name is not None and snmp_utils.is_snmpv3_host(snmp_config):
     to
    
     if snmp_utils.is_snmpv3_host(snmp_config):
    
  2. it was necessary to create some additional rules in “Host & Service Parameters”, otherwise the tests run with OK but not the checks themselves.The following rules are necessary:

A) Timing settings for SNMP access

  • (Response timeout for a single query = 2sec / Number of retries = 10)

B) Check intervals for SNMP checks

  • (All SNMP checks: Do check every = 10min)

C) SNMPv3 contexts to use in requests

  • (All SNMP Checks: SNMP Context IDs = Jetdirect)

The set timing values work reliably and I did not try to optimize them further, because in this constellation they are absolutely sufficient.
The HP printers return 15 values each via Checkmk. Among them just as relevant values as toner level.
The SNMPv3 values for Auth Priv have to be set correctly in Checkmk according to the settings of the HP printers. This seems to be different between the different old HP Printer model series. But it can be seen very well in the settings of the HP printers and be taken over in Checkmk.

Happy monitoring
Georg