Forum GLPI-Project

thyde.rsi

Member

Registered: 2021-12-07

Posts: 6

GLPI Agent 1.4 - SNMP import devices denied; switches seen as Computer

Good afternoon. I'm running GLPI 10.0.3 on a Debian server, with Glpi Native Inventory Agents (1.4) on both Debian and Win 10 platforms. The local inventory is running fine, however I'm getting challenged when NetDiscovery and NetInventory is attempted. The infrastructure is typically Cisco and Aruba devices.
Although config and equipment updates happen on a regular basis, I've been using GLPI for a number of years, and have had success with the FusionInventory plugins, so am not completely new to the topic.
I have not had successful SNMP activities on this particular instance of GLPI, it's a feature I used a while back on an earlier version, and am just now getting around to re-enabling those actions.

I have verified snmp walking to the devices form both agent platforms (although I would prefer to have the agent that handles the SNMP activities as a Debian container, if it has to be a WIn10 machine, that's ok too).

In both instances, the task does run and there is activity occurring with data being returned to GLPI. I have looked at other similar posts that discuss denial of import rules, and have worked on modifying a number of them one at a time, but with no change in the resultant output from a task log. I have also seen a couple posts that note an "unknown" device will be returned with blank info, but I don't think that's the specific direct issue either (more evidence of that below)

Regardless of the platform, the result on a log is as such:

2023-05-05 21:01:22	Running	Import denied [type]: Computer, [name]: 172.XX.1.133, [mac]: b4:XXXXXXXXXX:41, [ips]: 172.XX.1.133
2023-05-05 21:01:22	Running	1 devices found
2023-05-05 21:01:22	Running	Import denied [type]: Computer, [name]: 172.XX.1.132, [mac]: f4:XXXXXXXXXXb:c1, [ips]: 172.XX.1.132
2023-05-05 21:01:22	Running	1 devices found
2023-05-05 21:01:22	Running	1 devices found
2023-05-05 21:01:22	Running	Import denied [type]: Computer, [name]: 172.XX.1.129, [mac]: c0XXXXXXXXX:c2, [ips]: 172.XX.1.129
2023-05-05 21:01:22	Running	1 devices found

If I run an snmpwalk, I get the mibs decoded with appropriate info. If I try a manual run of: glpi-netinventory.bat --debug --community MYCOMMUNITYNAME --host 172.XX.1.129

I get back:

[debug] Logger backend Stderr initialized
[debug] GLPI Agent (1.4)
[debug] Current run expiration timeout: 1.0 hour
[debug] creating 1 worker threads
[debug] [thread 1] creation
[debug] [thread 1] #1, scanning 0: 172.XX.1.129
[debug] [thread 1] #1, full match for sysobjectID .1.3.6.1.4.1.9.1.780 in database
[debug] [thread 1] #1, switching SNMP context to vlan 1012
<?xml version="1.0" encoding="UTF-8" ?>
<REQUEST>
  <CONTENT>
    <DEVICE>
      <COMPONENTS>
        <COMPONENT>
          <CONTAINEDININDEX>0</CONTAINEDININDEX>
          <DESCRIPTION>ME-3400G-12CS-A</DESCRIPTION>

and so on for other devices.

SPOILER TIME:
What does strike me as a little weird however is in the agent log I see:

[Fri May  5 14:01:15 2023][debug] forking process -8368 to handle task NetDiscovery
[Fri May  5 14:01:15 2023][info] running task NetDiscovery
[Fri May  5 14:01:15 2023][warning] No valid SNMP credential defined for this scan

The task has a single IP range defined, and there is an SNMP credential defined and attached to that range. I have tried this with both v1 and v3 protocols, same result.
However if I dive down into the details of an IP range, the associated SNMP credentials list has entries, but their names and versions are shown as blank. For example, I have a single credential, there is an entry for that IP range and it has a priority of 1. There is a checkbox to the left of the entry, but the name and version are blank. If I select the checkbox and try to (permanently) delete the relation, I get a failure with "Failed Operation (1 authorizations problems, 0 failures) N/A: Authorization Error" popup.
I can associate a new credential from that same modal, and the SNMP credential name is shown in the dropdown. Once added, there are now two rows in the list, both without names or version tags, and both unable to be deleted.

So I started digging....

If I inspect the table "glpi_snmpcredentials" in the db directly, I get a full spread of data (including the name, etc as one would expect).

Diving down a littler further into the db directly,

MariaDB [xxx_glpi]> select * from glpi_plugin_glpiinventory_ipranges_snmpcredentials;
+----+----------------------------------+------------------------------------------+------+
| id | plugin_glpiinventory_ipranges_id | plugin_glpiinventory_configsecurities_id | rank |
+----+----------------------------------+------------------------------------------+------+
|  1 |                                7 |                                        0 |    1 |
|  2 |                                7 |                                        0 |    2 |
+----+----------------------------------+------------------------------------------+------+

Ok, so that follows ok, too.  I'm now curious about the plugin_glpiinventory_configsecurities_id tag.

I have no idea if it is supposed to directly cross ref to a key, but there is no table plugin_glpiinventory_configsecurities. Hmmm. (As a DBA myself, I was following the same logic I would employ, thus a table with that name I would expect).

Am I missing some data here? Did a table get hosed somewhere along the way?

Help appreciated,

Thanks,
Ted.

gbougard

Moderator

From: Montpellier, France

Registered: 2021-07-21

Posts: 537

Website

Re: GLPI Agent 1.4 - SNMP import devices denied; switches seen as Computer

Hi Ted,

this sounds like a bug in the plugin. You should probably open an issue linking this forum thread there: https://github.com/glpi-project/glpi-inventory-plugin

The message "[Fri May  5 14:01:15 2023][warning] No valid SNMP credential defined for this scan" is relatively clear. The server seems to not provide any credential. And without credential, the discovered information is limited and explains the denied imports.

---

GLPI-Agent developer from Teclib' and GLPI-Network team
Previously FusionInventory-Agent maintainer