at my work we use InterMapper to monitor all our equipment. I was trying to get the SNMP probe it has for cisco equipment to work with our Cisco 6509 switch, but apparantly cisco decided that it would be fun to use completely differant OIDs for that line of switches. so I spent hours yesterday trying to get it to work.

Sure, cisco has a nice repository of all the MIBs for all their equipment, but they are all uncompiled and missing the actual OIDs.

Granted I am not nearly as familiar with SNMP stuff as I would like to be, but come on.

Look at the number of mibs available just for the 6500 series:
ftp://ftp-sj.cisco.com/pub/mibs/supportlists/wsc6000/wsc6000-supportlist-ios.html

All I am looking for is the CPU load and the amount of memory available. For the 5 second CPU Load according to the MIB file this is what I need:

cpmCPUTotal5sec OBJECT-TYPE
SYNTAX Gauge32 (1..100)
MAX-ACCESS read-only
STATUS deprecated
DESCRIPTION
"The overall CPU busy percentage in the last 5 second
period. This object obsoletes the busyPer object from
the OLD-CISCO-SYSTEM-MIB. This object is deprecated
by cpmCPUTotal5secRev which has the changed range of
value (0..100)."
::= { cpmCPUTotalEntry 3 }

Part of the fine is the deprecation chain. As you can see in the mib excerpt, cpmCPUTotal5sec was deprecated by cpmCPUTotal5secRev. If you go to the cpmCPUTotal5secRev section, it says it was deprecated by cpmCPUTotalMonInterval, which when you go to that section. But of course the only one of those that is actually in our version of the 6509 is cpmCPUTotal5sec.

Anyway, It sure would be nice if the OID was listed in that mib file. Then I find this file:
ftp://ftp.cisco.com/pub/mibs/oid/CISCO-PROCESS-MIB.oid

One of the lines says:
"cpmCPUTotal5sec" "1.3.6.1.4.1.9.9.109.1.1.1.1.3"

So I should be all set now right? no.

This might be an issue with our version of intermapper, because if I use snmpwalk like this:

snmpwalk -O -v 2c -c CommunityName IPAddress 1.3.6.1.4.1.9.9.109.1.1.1.1.3

I get this result:
SNMPv2-SMI::enterprises.9.9.109.1.1.1.1.3.9 = Gauge32: 21

It sure looks like that should work. I get a value and everything! So I write the custom SNMP probe for InterMapper with the 3 OIDs I want to watch. But none of them work, InterMapper claims none of those OIDs are available in the switch. Of course snmpwalk disagrees. So I figure I just completely messed up writing the probe.

So this morning I come into work figuring I would give it a fresh go. I happened to be looking through the options for snmpwalk, and notice the “-O n” option, which prints out the OID numerically. Which returns:
.1.3.6.1.4.1.9.9.109.1.1.1.1.3.9 = Gauge32: 21

So apparantly, my problem the whole time was that InterMapper wants the OID to look like this:
.1.3.6.1.4.1.9.9.109.1.1.1.1.3.9
Instead of this:
1.3.6.1.4.1.9.9.109.1.1.1.1.3

Not sure what the .9 at the end does, but go figure… It sure would be nice to just make the OID available in the first place. without jumping through so many hoops.

For anyone that cares, These are the OIDs that seem to make the most sense:

cpmCPUTotal5sec .1.3.6.1.4.1.9.9.109.1.1.1.1.3.9
cpmCPUTotal1min .1.3.6.1.4.1.9.9.109.1.1.1.1.4.9
cpmCPUTotal5min .1.3.6.1.4.1.9.9.109.1.1.1.1.5.9
ciscoMemoryPoolFree 1.3.6.1.4.1.9.9.48.1.1.1.6
DRAM .1.3.6.1.4.1.9.9.48.1.1.1.6.1
FLASH .1.3.6.1.4.1.9.9.48.1.1.1.6.6
NVRAM .1.3.6.1.4.1.9.9.48.1.1.1.6.7
MBUF .1.3.6.1.4.1.9.9.48.1.1.1.6.8
CLUSTER .1.3.6.1.4.1.9.9.48.1.1.1.6.9
MALLOC .1.3.6.1.4.1.9.9.48.1.1.1.6.10

Memory stuff
ftp://ftp.cisco.com/pub/mibs/v2/CISCO-MEMORY-POOL-MIB.my
ftp://ftp.cisco.com/pub/mibs/oid/CISCO-MEMORY-POOL-MIB.oid

CPU/Process stuff
ftp://ftp.cisco.com/pub/mibs/v2/CISCO-PROCESS-MIB.my
ftp://ftp.cisco.com/pub/mibs/oid/CISCO-PROCESS-MIB.oid

InterMapper Cisco 6500 Probe:
http://aisle10.net/intermapper-snmp.cisco6500.txt

Lately I have been building and maintaining more and more Windows 2000 and 2003 servers than I would ever like to. I think it ended up being basically a necessary evil that needed to be used to tie the many different system architectures, systems, and company divisions together.

having something even remotely close to a single sign on type of authentication system would be great. Every time an new employee starts at my work, there is at least 3 to 5 separate accounts that need to be created.

1. The phone system

2. a windows login

3. a unix login

4. a login to our CMS

5. a login to the horrible “email system”

Most of the unix (Solaris/Linux mostly) systems that we have use at least NIS, but everything else is completely separate. Getting a working phone number and a working windows logins both come from completely different departments…actually different buildings.

I can see how annoying this must be for a new employee. You sit at your desk trying to adjust to your new job and you can’t receive email, maybe have no phone, possibly no computer. I think at this point they should just get a 3 subject notebook, a couple folders, 2 post-it pads, and a pen the day they start, because that will get them a lot further.

So, when a couple weeks ago my office had a massive phone outage due to some “issues” with a telecommunications company that begins with a V. We ended up having literally 43 non-working phones. That is easily more than half the company that could no longer use the phone. The phone system isn’t controlled, maintained, or basically touched by me or anyone else in my department. It is handled by a separate division of the company that for the most part doesn’t want to be bothered with our stupid phone problems.

Nothing was getting fixed, technicians are poking at everything attached to the phone system, and my time (along with others) gets wasted more and more. So we decided it was time to start cutting the few life lines we have with the other division in the company. They have an archaic poorly maintained phone system that we can’t diagnose anything on, and sales people don’t like you very much when they can’t use their phone. Or even better, when they will be in the middle of a call with a possible client, and the phone will just drop the connection. There are many reasons, the list goes on and on.
So it seemed like this would be a great chance to just ditch the old phone system and install a new shiny VoIP phone system. We figured out that we could maintain all our offices phones internally on the VoIP system, and then any incoming/outgoing calls from outside the office would go directly to the old phone systems switch.

So then after thinking things out, this would be a great opportunity to finally start using LDAP for all our user accounts. This quickly changed over to making an Active Directory. Enter Microsoft.

If we installed an Active Directory, now we can get off of the other divisions old slow windows NT domain. We could be able to now create all the windows accounts ourself, meaning employees could actually login to their computer when they come in for work. Sounds great doesn’t it? but now that means that the Active Directory is in charge of everything. Is that a bad thing? I don’t really know, but I (and most people I work with) have never been big fans of using windows…even more so as a server. Which is why we have 3. 1 primary and 2 backups. I suppose the odds of all 3 blue screening at the same is slim.

So where does the bullet dodging come in? Active directory likes to be able to dynamically change DNS entries. I wasn’t familiar with how to do that in BIND, and while clicking all the next buttons involved in installing Win 2003 and the Active Directory, it has a pretty little radio button that says “hey there…if you want, I could install microsoft dns! you’ll be all set!” It was a pretty radio button and it almost lured me in, but thankfully I looked on google and found out that it’s actually one stupid line that needs to be added to the BIND config.

So I just made a new zone file for windows to play around in without taking over everything like it was SkyNet.

Knowing that I at least am not now using Microsoft DNS means that is one less cold shower I need to take this weekend. The stench of windows is everywhere, and if the testing of this other product goes well, we’ll have a pretty little PAM module installed on all our Linux and Solaris boxes that will make everything authenticate off of the active directory. Group and system policies included.

On the bad side, I just sold my soul to the devil. On the good side, having there be 1 account for virtually all the internally maintained systems the company uses would be nice.

At least nothing on or around my desk, or even have to log into begins with a lowercase i.

thats when I just have to throw in the towel.

After mucking around with it for 3 days off and on, I come into work 2 hours early today to get a head start on getting the Sun Java Enterprise Server (with LDAP/Messaging support) running and populated so that my work can finally move off of NIS/40 other authentication systems.

I have it to the point where all that is left is to run the various post-deployment configuration scripts and steps, which I find odd in the first place. Why are their configuration steps that you have to do after you finish the configuration? what is the point of having a configuration wizard with a product if after you complete using it, the wizard then says “yeah, uh, you still have things to do….I dont know what, but there is stuff, and it is in document 819-2328.”

The fun part is that document 819-2328 is on suns docs.sun.com website. Which gives the good ‘ol

Server Error

This server has encountered an internal error which prevents it from fulfilling your request. The most likely cause is a misconfiguration. Please ask the administrator to look for messages in the server’s error log.

message. That doesn’t look like post deployment instructions to me. You know, I always thought that generic 500 error was stupid. So I am supposed to just go and contact “the administrator” at Sun? I am sure Sun only has one administrator..just one. Not only that, but I am sure he is just sitting at his desk…twiddling his fingers just waiting for the phone to ring for me to say “hey, uhh…your website is down…your probably didn’t get 500 calls, pages and emails about it, but yeah…I just wanted you to know. Could you get it back up soon?”
Someone out there really does not like me. It must be because I didn’t pay much attention to ash wednesday. Now god is smiting me.

I think that this is what happened to the server:

On a related note, aside from the massiveness of the entire Java Enterprise Server system, it actually is fairly cool. The web mail client that comes with the messaging server is not the best thing in the world, but it is fairly decent, and adding info to the LDAP directory with their java interface is beyond easy. I don’t know why it took around 4 years for us to finally set one up. I guess it is probably because of the 300 other projects that are always going on.