[hobbit] Cisco switches

[Henrik Stoerner]

On Wed, Jan 16, 2008 at 11:05:47AM -0000, Mike Rowell wrote:
> One word..
> 
> Devmon
> 
> http://sourceforge.org/projects/devmon

indeed, Devmon is the right thing to use currently. But let me take the
opportunity to give you a quick idea of what's coming in Hobbit.


The current snapshot of Hobbit can fetch data through SNMP, and one of
the things I am using it for is to collect data about switches. We use
Nortel's Passport-8600 switches here, but it can be configured for any
kind of SNMP-enabled host. So just picking up the current load of the 
switch (cpu, memory, fabric utilisation) and the traffic on each port 
is done with this config entry in hobbit-snmphosts.cfg:

	[pp8600.foo.com]
	        version=2
		community=public
		p8600system
		ifmib=!*!

"p8600system" and "ifmib" are actually pointers into hobbit-snmpmibs.cfg
which has the details of what SNMP objects to retrieve (just showing a
couple of items):

	[p8600system]
		Descr = SNMPv2-MIB::sysDescr.0
		UpTime = RFC1213-MIB::sysUpTime.0
		BufferUtil = RAPID-CITY::rcSysBufferUtil.0 /rrd:GAUGE
		CpuUtil = RAPID-CITY::rcSysCpuUtil.0 /rrd:GAUGE

	[ifmib]
		keyidx (IF-MIB::ifDescr)
		keyidx !IF-MIB::ifIndex!
		ifHCInOctets = IF-MIB::ifHCInOctets /rrd:COUNTER
		ifHCOutOctets = IF-MIB::ifHCOutOctets /rrd:COUNTER

As you can see this is a bit complex, but it is fairly easy to set up
when you have access to a system like the one you're monitoring, and can
walk through the SNMP data with the "snmpwalk" utility (from the
Net-SNMP package).

Notice the "ifmib=!*!" and "keyidx !IF-MIB::ifIndex!" lines ? These are
indices that pick out one (or all) of the switch ports. Here it matches
all ports, but you can also have "ifmib=(eth0)" to fetch data for the
eth0 device, or "ifmib={10.45.0.102}" to grab data from the device which
has the IP 10.45.0.102 assigned. You can have multiple ways of indexing
an SNMP table, so you can pick out the interesting entries the easiest
way.

The interesting data is automatically graphed, that is what the
"/rrd:..." is for. No alerting yet, but that is work-in-progress.

As I said, it's in the current snapshot so feel free to experiment with
it. Feedback is welcome.


Regards,
Henrik