Bug 1318291

Summary: net-snmp seems not to support extensions
Product: Red Hat Enterprise Linux 7 Reporter: Jens Hektor <hektor>
Component: net-snmpAssignee: Jan Safranek <jsafrane>
Status: CLOSED WORKSFORME QA Contact: BaseOS QE Security Team <qe-baseos-security>
Severity: low Docs Contact:
Priority: unspecified    
Version: 7.4CC: rs
Target Milestone: rc   
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2016-03-18 11:15:54 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:

Description Jens Hektor 2016-03-16 13:02:19 UTC 
Description of problem:

It looks as if the "extend" directive is ignored.

Version-Release number of selected component (if applicable):


How reproducible:

Always

Steps to Reproduce:
1. Edit snmpd.conf: extend httpd_pids /bin/sh /usr/local/bin/check_apache.sh
2. Restart snmpd
3. snmpwalk -On -v2c -c public localhost 1.3.6.1.4.1.8072

Actual results:

.1.3.6.1.4.1.8072 = No more variables left in this MIB View (It is past the end of the MIB tree)


Expected results:

Output of the example script taken from the redhat pages

Additional info:
Comment 2 Jens Hektor 2016-03-16 13:18:36 UTC 
I was using this example: 
https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/6/html/Deployment_Guide/sect-System_Monitoring_Tools-Net-SNMP-Extending.html
Comment 3 Robert Story 2016-03-16 15:16:43 UTC 
Can you provide your snmpd.conf config for the community public? By default CentOS/RHEL/Fedora restrict the public community to the system branch, which does not include the extend table.

If you add "rocommunity everything 127.0.0.1" to snmpd.conf, and restart, this should work:

snmpwalk -On -v2c -c everything 127.0.0.1 1.3.6.1.4.1.8072
Comment 4 Jens Hektor 2016-03-17 07:56:44 UTC 
This is the output of "fgrep -v '#' /etc/snmp/snmpd.conf":
------------------------------
com2sec notConfigUser  default       public
group   notConfigGroup v1           notConfigUser
group   notConfigGroup v2c           notConfigUser
view    systemview    included   .1.3.6.1.2.1
view    systemview    included   .1.3.6.1.2.1.25.1.1
view    systemview    included   .1.3.6.1.4.1.2021
view    all           included   .1
rocommunity public 127.0.0.1 .1
extend httpd_pids /bin/sh /usr/local/bin/check_apache.sh
access  notConfigGroup ""      any       noauth    exact  systemview none none
syslocation Unknown (edit /etc/snmp/snmpd.conf)
syscontact Root <root@localhost> (configure /etc/snmp/snmp.local.conf)
dontLogTCPWrappersConnects yes
------------------------------

And found the solution:

I had to add an explicit
------------------------------
view    systemview    included   .1.3.6.1.4.1.8072
------------------------------

I thought that this should have been covered with my "view all ..." line.
Comment 5 Robert Story 2016-03-17 21:30:48 UTC 
> access notConfigGroup ""   any   noauth    exact  systemview none none

It would have if the access line were using 'all' instead of 'systemview'.

Also:

>com2sec notConfigUser  default       public
>rocommunity public 127.0.0.1 .1

Using the same community multiple times is not recommended.
Comment 6 Jens Hektor 2016-03-18 07:45:38 UTC 
Off course.

Anyway thank you to the fantastic support here and @Centos bug tracker.

Case can be closed.
Comment 7 Jan Safranek 2016-03-18 11:15:54 UTC 
Closing. And thanks Robert for support!