Sysname and ifname via SNMP

[Johan Petersson]

Hi,

I have enabled snmp so sflow-rt could fetch sysname and ifname from some Arista switches. It works fine in sFlowTrend-Pro. I.e I can see hostname of switches and all ifnames.

Is the same feature not supported in slow-rt?

Regards

/Johan

[Peter Phaal]

On Monday, July 30, 2018 at 7:03:51 AM UTC-7, Johan Petersson wrote:

I have enabled snmp so sflow-rt could fetch sysname and ifname from some Arista switches. It works fine in sFlowTrend-Pro. I.e I can see hostname of switches and all ifnames.

Is the same feature not supported in slow-rt?

You can enable SNMP in sFlow-RT by setting the System Property "snmp.ifname=yes". By default SNMP v2c is used with community "public" to retrieve the values. There are additional snmp.* settings that you can use to override the SNMP protocol defaults:

https://sflow-rt.com/reference.php#properties

When enabled, SNMP is used to retrieve sysName and ifName values when sFlow is received from a switch. 

There are fields specified in the sFlow protocol for exporting ifName/sysName information. You might want to ask Arista if they have plans to support these fields:

The following port_name structure is defined in https://sflow.org/sflow_openflow.txt:

/* Port name */

/* opaque = counter_data; enterprise = 0; format = 1005 */

struct port_name {

  string<255> name;

}

and the sysName structure is defined in https://sflow.org/sflow_host.txt:

/* Physical or virtual host description */

/* opaque = counter_data; enterprise = 0; format = 2000 */

struct host_descr {

   string hostname<64>;       /* hostname, empty if unknown */

   opaque uuid<16>;           /* 16 bytes binary UUID, empty if unknown */

   machine_type machine_type; /* the processor family */

   os_name os_name;           /* Operating system */

   string os_release<32>;     /* e.g. 2.6.9-42.ELsmp,xp-sp3, empty if unknown */

}

You can install the Host sFlow agent on Arista switches to export the sFlow host statistics:

https://blog.sflow.com/2017/03/arista-eos-telemetry.html

[Johan Petersson]

Hi Peter,

thank you for taking the time and answering my question.

I might not understand this correctly. But I have enabled SNMP och can see with tcpdump that the switch is sending info to the sflow-rt server:

.1.3.6.1.2.1.31.1.1.1.1.1000067="Port-Channel67" } }
.1.3.6.1.2.1.31.1.1.1.1.30="Ethernet30" } }
.1.3.6.1.2.1.31.1.1.1.1.29="Ethernet29" } }
.1.3.6.1.2.1.31.1.1.1.1.1000093="Port-Channel93" } }
.1.3.6.1.2.1.31.1.1.1.1.2="Ethernet2" } }
.1.3.6.1.2.1.31.1.1.1.1.1="Ethernet1" } }

But I cant see this info (eg. Ethernet1) when I run 'curl http://localhost:8008/metric/<AGENT>/json' for that agent. Should it not be there? sFlow-Trend-Pro have the same SNMP settings and show hostnames, ifnames and ifalias.

I have installed sFlow agent on Arista switches and could now at least see host info. Thanks for the tip :)

Best regards

/Johan

[Peter Phaal]

On Tuesday, July 31, 2018 at 4:28:03 AM UTC-7, Johan Petersson wrote:

I might not understand this correctly. But I have enabled SNMP och can see with tcpdump that the switch is sending info to the sflow-rt server:

.1.3.6.1.2.1.31.1.1.1.1.1000067="Port-Channel67" } }
.1.3.6.1.2.1.31.1.1.1.1.30="Ethernet30" } }
.1.3.6.1.2.1.31.1.1.1.1.29="Ethernet29" } }
.1.3.6.1.2.1.31.1.1.1.1.1000093="Port-Channel93" } }
.1.3.6.1.2.1.31.1.1.1.1.2="Ethernet2" } }
.1.3.6.1.2.1.31.1.1.1.1.1="Ethernet1" } }

But I cant see this info (eg. Ethernet1) when I run 'curl http://localhost:8008/metric/<AGENT>/json' for that agent. Should it not be there? sFlow-Trend-Pro have the same SNMP settings and show hostnames, ifnames and ifalias.

I have installed sFlow agent on Arista switches and could now at least see host info. Thanks for the tip :)

In sFlow-RT, the only values that are part of the metrics set are those that are received via sFlow, i.e. the ifname and host_name metrics are only available if the agent exports the port_name and host_descr respectively. Now that you have the Host sFlow agent running on your Arista switches you should be seeing the host_name metric.

The sFlow-RT SNMP ifName and sysName are part of the topology functionality and don't generate metrics - setting topology provides a third way to provide port name information to sFlow-RT (1. sFlow structures, 2. SNMP, 3. topology). The following article describes how integrate sFlow-RT with CloudVision and collect topology using eAPI:

https://blog.sflow.com/2017/10/arista-eos-cloudvision.html

Topology information can be accessed in flow definitions using the node: and ifname: functions, e.g. the following flow keys retrieve the sysName and ifName values as part of the flow key:

node:inputifindex,ifname:inputifindex

See the following article for more information on defining flows, 

https://sflow-rt.com/define_flow.php

You can also query the topology using functions in the embedded JavaScript API, 

https://sflow-rt.com/reference.php#script. 

For example, the following script periodically queries ifInOctet and ifOutOctet metrics and looks up the corresponding sysName and ifName information:

setTopology({});

setIntervalHandler(function(now) {

  var res = table('ALL','ifinoctets,ifoutoctets');

  if(!res || res.length == 0) return;

  for(var i = 0; i < res.length; i++) {

    let entry = res[i];

    let { node, port } = topologyInterfaceToPort(entry[0].agent,entry[0].dataSource) || {};

    let ifInOctets = entry[0].metricValue || 0;

    let ifOutOctets = entry[1].metricValue || 0;

    logInfo([node,port,ifInOctets,ifOutOctets]);

  }

},10);

The scripting API is useful for pushing metrics to local and cloud based metrics platforms. For example, pushing metrics to InfluxDB:

https://blog.sflow.com/2017/01/telegraf-influxdb-chronograf-and.html

You can also use eAPI to push automated controls to Arista switches, for example, to mitigate DDoS attacks:

https://blog.sflow.com/2017/07/arista-eapi.html

The example above didn't use a port based control, but if you wanted to, you could use the topology queries to get the port name to apply the appropriate configuration command. FYI, the JavaScript, name=ifName(agent,ifIndex), function is a useful shortcut for controller scripts.

For more information on writing sFlow-RT applications, see https://sflow-rt.com/writing_applications.php