...
Instead of using canned SSH-based probes for UNIX, we are researching the possibility of using SNMP against unix boxes (and possibly windows). In theory we can . We do this by simply replacing the SSH probes with equivalent SNMP probes which SNMP GET information from extended MIB objects which we apply to all machines we plan to instrument.
...
...we may want to use SNMPv3, but the general idea is clear... we can expose arbitrary configuration data through SNMP. Since there are only a few dozen probes (and maybe only a subset of actual interest to Yale) we should be able to leverage SNMP for UNIX discovery instrumentation.
...
Rewiring of Discovery
This is simple to do. There are two main objectives:
- make sure SSH discovery doesn't happen
- no credentials
- configure the behavior of the MID server to skip SSH
- Expand the stock Linux classifier for SNMP so that it runs additional Explore-phase probes
...
The most complete approach here is probably something like this:
- narrow down the sensors to those that apply to our asset types
- look at which ci_ tables are being edited by those and combine sensors with the same function
- generate a list of probes from those sensors
- generate a list of data needed by SNMP
- find out what standard MIBs provide the data
- generate a list of needed extensions for data not covered above