SNMP configuration with powerCLI

[VMSavvy]

Hi people,

I'm looking for a script to enable and update snmp configuration on close to 400 esxi 5.0/5.1 hosts.. I know we can use Set-VMHostsnmp cmdlet for this purpose but getting stuck with where and how to start..

Here is what I'm thinking to do.. please let me know if this works or guide me through the right way...

$esxlist = Import-Csv "C:\Scripting\Servers.txt"

foreach($item in $esxlist){

Connect-VIServer $item

-User root -Password xxx

$item| Set-VMHostSnmp -Enabled:$true

Set-VMHostSnmp

-HostSnmp $_ -ReadOnlyCommunity "Name" -TargetHost "1.1.1.1"

Disconnect-VIServer -Confirm:$false

Regards,

VMSavvy :smileyhappy:

[LucD]

Your script looks ok.

I suppose you already saw this one Set SNMP thru PowerCLI

[VMSavvy]

Yes LucD,

I saw your other thread and made changes to it and it worked as expected.. after all it was from you..and it should work.. :smileyhappy:

I've got a couple of questions though..

1. How can I check if the trap targets are successfully added..? I would like to run a one liner randomly on hosts to check if all the required traptargets are added..

2. Do I have to stop and start the SNMP service after adding the targets..? If yes, how can I do that with powercli so that I can include it in the script itself..

Thanks in advance,

VMSavvy :smileyhappy:

[LucD]

1. It depends what you want to check.

If you just want to check if the traps were added to the SNMP config you can do a Get-VMHostSnmp and verify the trap config is in there.

If you want to chekc if the traps are working you can use the Test-VMHostSnmp

2. When you "enable" the SNMP service, the ESXi firewall rule should be enabled and the service should be started.

Do you see that the SNMP service is not running ? Is the FW open ?

[VMSavvy]

Hi LucD,

I think I made a mistake somewhere.. It ran fine when I did yesterday on 2 hosts.. but when I'm running it on 70 hosts now.. its failing.. Below are the errors and I'm attaching the script as well.. Please help!!

VMSavvy-

Get-VMHostSnmp : 1/23/2013 9:54:55 PM Get-VMHostSnmp The method or operation is not implemented.

At C:\My Folder\Scripting\SNMPConfig.ps1:8 char:26

+ $snmpObj = Get-VMHostSnmp <<<< -Server $item

+ CategoryInfo : NotSpecified: (:) [Get-VMHostSnmp], VimException

+ FullyQualifiedErrorId : Core_BaseCmdlet_UnknownError,VMware.VimAutomation.ViCore.Cmdlets.Commands.Host.GetVMHostSnmp

Set-VMHostSnmp : Cannot validate argument on parameter 'HostSnmp'. The argument is null or empty. Supply an argument that is not null or empty and

then try the command again.

At C:\My Folder\Scripting\SNMPConfig.ps1:9 char:25

+ Set-VMHostSnmp -HostSnmp <<<< $snmpObj -Enabled:$true

+ CategoryInfo : InvalidData: (:) [Set-VMHostSnmp], ParameterBindingValidationException

+ FullyQualifiedErrorId : ParameterArgumentValidationError,VMware.VimAutomation.ViCore.Cmdlets.Commands.Host.SetVmHostSnmp

Set-VMHostSnmp : Cannot validate argument on parameter 'HostSnmp'. The argument is null or empty. Supply an argument that is not null or empty and

then try the command again.

At C:\My Folder\Scripting\SNMPConfig.ps1:10 char:25

+ Set-VMHostSnmp -HostSnmp <<<< $snmpObj -Enabled:$true

+ CategoryInfo : InvalidData: (:) [Set-VMHostSnmp], ParameterBindingValidationException

+ FullyQualifiedErrorId : ParameterArgumentValidationError,VMware.VimAutomation.ViCore.Cmdlets.Commands.Host.SetVmHostSnmp

[LucD]

Are these ESXi servers runnning a different version perhaps ?

There have been some changes in the way the SNMP daemon works between ESXi 4.* and 5.*

Update: just saw that you said these are 5/5.1 ESXi servers.

Are the ones where it doesn't work all the same ESXi version ?

[VMSavvy]

When I tested the script on 2 hosts, those 2 were 5.0 hosts..

Now I'm running it on 5.1 hosts where it is failing.. We have a mix of 5.0 and 5.1 hosts.. if we have to change as per the versions, I'll make a list of hosts with each version and run appropriate script..

Can you please help me with the changes for 5.0 and 5.1?

Thanks,

VMSavvy

[LucD]

Let's first see if the first error is not caused by anyhting else.

In the line

$snmpObj = Get-VMHostSnmp -Server $item

What do you have in the $item variable ? Is that object produced by the Connect-VIServer cmdlet ?

And you are connected to the ESXi at that moment I suppose ?

[VMSavvy]

Yes..$item has the connect-viserver object and connection was made and active at the time script reached the below line..

$snmpObj = Get-VMHostSnmp -Server $item

VMSavvy..

[VMSavvy]

Hi Luc,

Here is where I see a difference.. In prior to 5.1 hosts the SNMP configurations can be done using Get/Set-VMHostSnmp.. but with 5.1 looks like we have to rely on Get/Set-VMHostService and then make changes.. Is that right??

Can you get me how to do this with VMHostService cmdlet?

I have to get this done before my day ends today.. Please help me.. Sorry for pushing through..

VMSavvy..

[LucD]

Where did you find that info that it has to be done through Set-VMHostservice ?

That normally only allows you to configure the policy for a service (on/off/automatic).

Do you get the service ?

What do you see when you do

Get-VMHostService -VMHost MyEsx

I don't think the SNMP service appears in there

[VMSavvy]

Here is what I see..

PowerCLI C:\> Get-VMHostService | Where{$_.Key -eq "snmpd"}

Key                  Label                          Policy     Running  Required
---                       -----                               ------          -------    --------
snmpd                snmpd                          on         False    False

[LucD]

Can you start it ?

Get-VMHostService | Where{$_.Key -eq "snmpd"} | Start-VMHostService -Confirm:$false

[VMSavvy]

Yes, I was able to start the service using the start-Vmhostservice cmdlet..

[VMSavvy]

Do I have to restart the snmp daemon regardless the version of esxi?

[LucD]

Yes, after a change in the settings it's best to restart the service.

[VMSavvy]

Its confusing me a lot as I haven't done EsxCLI stuff much before.. Can one of you help with the following with Get-EsxCLI?

1. Enable SNMP

2. Create a ReadOnlyCommunity

3. Add a target to the community..

Appreciate all your help..

VMSavvy..

[LucD]

It's identical to the esxcli comand parameters

Something like this (I do 2 gets to see the before asnd after)

$esxcli = Get-EsxCli -VMHost esx1.local.test 

$esxcli.system.snmp.get()

$authentication = "none" 
$communities = "MyCommunity"
$enable = $true
$engineid = "0x12345"
$hwsrc = "sensors"
$loglevel = "error"
$notraps = "reset"
$port = 161
$privacy = "none"
$remoteusers = $null
$reset = $null
$syscontact = "System Contact"
$syslocation = "System Location"
$targets = "192.168.1.1/MyCommunity"
$users = "user/-/-/none"
$v3targets = $null

$esxcli.system.snmp.set($authentication,$communities,$enable,$engineid,$hwsrc,$loglevel,$notraps,$port,$privacy,$remoteusers,$reset,$syscontact,$syslocation,$targets,$users,$v3targets)

$esxcli.system.snmp.get()

[VMSavvy]

Thanks for the example. Have got a couple of questions please..

1. Can I just take off the unwanted settings and just do what I need? Like this below..

2. How can I get multiple targets get registered in one shot? Is there a way to do that..

Here is what I wrote and please let me know if this works..

Thank you,

VMSavvy..

$esxlist = Get-Content "C:\My Folder\Scripting\Servers.txt"

$communities = "1m0p3nv13w"

$enable = $true

$port = 161

$targets = "10.130.100.138/1m0p3nv13w", "10.130.100.139/1m0p3nv13w"

foreach($item in $esxlist){

Connect-VIServer

$esxcli

= Get-EsxCli -Server $item

$esxcli.system.snmp.set($communities,$enable,$port,$targets)

$esxcli

.system.snmp.get()

-Server $item -User root -Password "YXYZ"

[LucD]

Afaik you have to provide all the parameters. Did you get an error message with that call ?

Assign $null to a parameter (which is the default value for a new variable created without an assignment) when you don't want to set it.

[VMSavvy]

Of course I got whole bunch of errors.. :smileycry:

I'll change the unwanted ones to $null and try..

How about assigning more than one targets? Can't be done?

VMSavvy..

[LucD]

You can assign multiple targets on the $targets and $v3targets parameter.

You pass them as an array of strings.

[VMSavvy]

I got the following error while pushing multiple targets..

These occured when I tried this way -

$targets = "1.2.3.4/mycommunity", "5.6.7.8/mycommunity", "9.1.2.3/mycommunity"...

I also tried passing them as $target1, $target2... but it seems to be overwriting the current target and the final target host is what I see when the script is done.. Please help..

The remote server returned an error: (500) Internal Server Error.:

<?xml version="1.0" encoding="UTF-8"?>

<soapenv:Envelope xmlns:soapenc="http://schemas.xmlsoap.org/soap/encoding/"

xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/"

xmlns:xsd="http://www.w3.org/2001/XMLSchema"

xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">

<soapenv:Body>

<soapenv:Fault><faultcode>ServerFaultCode</faultcode><faultstring>

Single field targets provided multiple times

while parsing call information for method VimEsxCLIsystemsnmpset

at line 4, column 4

while parsing SOAP body

at line 3, column 2

while parsing SOAP envelope

at line 2, column 0

while parsing HTTP request for method set

on object of type vim.EsxCLI.system.snmp

at line 1, column 0</faultstring><detail><InvalidRequestFault xmlns="urn:vim25" xsi:type="InvalidRequest"></InvalidRequestFault></detail></soapenv:

Fault>

</soapenv:Body>

</soapenv:Envelope>

At C:\Users\myname\AppData\Local\Temp\aaefd9b8-5830-4896-9398-12114869c044.ps1:41 char:24

+ $esxcli.system.snmp.set <<<< ($authentication,$communities,$enable,$engineid,$hwsrc,$loglevel,$notraps,$port,$privacy,$remoteusers,$reset,$syscon

tact,$syslocation,$targets,$users,$v3targets)

+ CategoryInfo : InvalidOperation: (:) [], RuntimeException

+ FullyQualifiedErrorId : MethodInvocationException

Root element is missing.

At C:\Users\mynameAppData\Local\Temp\aaefd9b8-5830-4896-9398-12114869c044.ps1:43 char:24

+ $esxcli.system.snmp.get <<<< ()

+ CategoryInfo : InvalidOperation: (:) [], RuntimeException

+ FullyQualifiedErrorId : MethodInvocationException

[LucD]

The CLI doc says you can specify up to three targets.

Perhaps try like this

$targets = "1.2.3.4/mycommunity,5.6.7.8/mycommunity,9.1.2.3/mycommunity"

[VMSavvy]

Awesome..That worked!!... I tried with more than 3 and it failed, when I tried 3 it worked.

Does this mean that we can only have 3 target hosts and not more..? If yes, I'll get the guys select 3 out of the 12 they gave me.. Its up to them to decide :smileywink:

VMSavvy.. :smileyhappy:

[LucD]

Yes, I'm afraid 3 is the maximum number of targets according to the documentation.

[VMSavvy]

One last question -

The "Engine ID" in the SNMP settings looks like it is unique to each host. Can I someway preserve this id and change rest of them..? I'll do bunch of hosts using this script at once and I don't want that to be overwritten with the one which is specified in the script..

I think the Engine ID is obtained from the router and if we give $null in the script, does it get a new one from the router later?

VMSavvy

[LucD]

Note that the EngineId is only used by SNMP v3. Are you using SNMP v3 ?

If you pass $null for the engineId, is it changed ?

If it does, you could first query the value like this

$engineId = $esxcli.system.snmp.get() | Select -ExpandProperty engineid 

[VMSavvy]

I'm not sure what version of SNMP the monitoring team will use, but this one liner will sure help me to preserve whats existing there.

Thanks a lot LucD for patiently answering all my queries in this thread.. If I had an option I would've given 50 points in one shot..

I'll come up with something else soon if I'm unable to figure out what I'm doing.. :smileywink:

Thanks a bunch again!!!

VMSavvy.. :smileyhappy:

[Almero]

Afternoon Gents

Please note there is another OverloadDefinition missing from the list passed here . Boolean Largestorage . Not sure if this is new under PS 4 PcLI 5.5

PS C:\PS\ELMOHostBuilder> $esxcli.system.snmp.set

 

　

OverloadDefinitions : {boolean set(string authentication, string communities, boolean enable, string engineid, string hwsrc, boolean largestorage, string loglevel, string notraps, long port, string privacy, string remoteusers, boolean reset, string

  syscontact, string syslocation, string targets, string users, string v3targets)}

[LucD]

I suspect that is related to the vSphere version.

[MKguy]

You can (or maybe should) use esxcli for configuring SNMP on ESXi 5.1 hosts.

esxcli system snmp get, set and test should provide you with everything you need. In PowerCLI you can execute any esxcli command via Get-EsxCli: http://www.vmware.com/support/developer/PowerCLI/PowerCLI41U1/html/Get-EsxCli.html

Here are some example commands to configure SNMP via esxcli:

http://blogs.vmware.com/vsphere/2012/11/configuring-snmp-v1v2cv3-using-esxcli-5-1.htmlhttp://www.vmware.com/support/developer/PowerCLI/PowerCLI501/html/Get-EsxCli.html

# esxcli system snmp set --help
Usage: esxcli system snmp set [cmd options]

Description:
  set                   This command allows the user to set up ESX SNMP agent.

Cmd options:
  -a|--authentication=<str>
                        Set default authentication protocol. Values: none, MD5, SHA1
  -c|--communities=<str>
                        Set up to ten communities each no more than 64 characters. Format is: community1[,community2,...] (this overwrites previous settings)
  -e|--enable           Start or stop SNMP service. Values: [yes|no, true|false, 0|1]
  -E|--engineid=<str>   Set SNMPv3 engine id. Must be at least 5 to 32 hexadecimal characters. 0x is stripped if found as well as colons (:)
  -y|--hwsrc=<str>      Where to source hardware events from IPMI sensors or CIM Indications. One of: indications|sensors
  -l|--loglevel=<str>   System Agent syslog logging level: debug|info|warning|error
  -n|--notraps=<str>    Comma separated list of trap oids for traps not to be sent by agent. Use value 'reset' to clear setting
  -p|--port=<long>      Set UDP port to poll snmp agent on. The default is udp/161
  -x|--privacy=<str>    Set default privacy protocol. Values: none, AES128
  -R|--remote-users=<str>
                        Set up to five inform user ids. Format is: user/auth-proto/-|auth-hash/priv-proto/-|priv-hash/engine-id[,...] Where user is 32 chars max.
                        auth-proto is none|MD5|SHA1, priv-proto is none|AES. '-' indicates no hash. engine-id is hex string '0x0-9a-f' up to 32 chars max.
  -r|--reset            Return agent configuration to factory defaults
  -C|--syscontact=<str> System contact string as presented in sysContact.0. Up to 255 characters
  -L|--syslocation=<str>
                        System location string as presented in sysLocation.0. Up to 255 characters.
  -t|--targets=<str>    Set up to three targets to send SNMPv1 traps to. Format is: ip-or-hostname[@port]/community[,...] The default port is udp/162. (this
                        overwrites previous settings)
  -u|--users=<str>      Set up to five local users. Format is: user/-|auth-hash/-|priv-hash/model[,...] Where user is 32 chars max. '-' indicates no hash. Model is
                        one of (none|auth|priv).
  -i|--v3targets=<str>  Set up to three SNMPv3 notification targets. Format is: ip-or-hostname[@port]/remote-user/security-level/trap|inform[,...].

[LucD]

That is also possible through Get-EsxCli, not need to use an SSH connection

[MKguy]

Yes, that's why I mentioned how you can execute any esxcli command via the Get-EsxCli cmdlet above :smileyhappy:

[LucD]

Oops, didn't read that line