1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
|
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2 Final//EN">
<HTML>
<HEAD>
<META NAME="GENERATOR" CONTENT="LinuxDoc-Tools 0.9.21">
<TITLE>SQUID Frequently Asked Questions: SNMP</TITLE>
<LINK HREF="FAQ-19.html" REL=next>
<LINK HREF="FAQ-17.html" REL=previous>
<LINK HREF="FAQ.html#toc18" REL=contents>
</HEAD>
<BODY>
<A HREF="FAQ-19.html">Next</A>
<A HREF="FAQ-17.html">Previous</A>
<A HREF="FAQ.html#toc18">Contents</A>
<HR>
<H2><A NAME="s18">18.</A> <A HREF="FAQ.html#toc18">SNMP</A></H2>
<P>Contributors:
<A HREF="mailto:glenn@ircache.net">Glenn Chisholm</A>.</P>
<H2><A NAME="ss18.1">18.1</A> <A HREF="FAQ.html#toc18.1">Does Squid support SNMP?</A>
</H2>
<P>True SNMP support is available in squid 2 and above. A significant change in the implimentation
occured starting with the development 2.2 code. Therefore there are two sets of instructions
on how to configure SNMP in squid, please make sure that you follow the correct one.</P>
<H2><A NAME="ss18.2">18.2</A> <A HREF="FAQ.html#toc18.2">Enabling SNMP in Squid</A>
</H2>
<P>To use SNMP, it must first be enabled with the <EM>configure</EM> script,
and squid rebuilt. To enable is first run the script:
<PRE>
./configure --enable-snmp [ ... other configure options ]
</PRE>
Next, recompile after cleaning the source tree :
<PRE>
make clean
make all
make install
</PRE>
Once the compile is completed and the new binary is installed the <EM>squid.conf</EM> file
needs to be configured to allow access; the default is to deny all requests. The
instructions on how to do this have been broken into two parts, the first for all versions
of Squid from 2.2 onwards and the second for 2.1 and below.</P>
<H2><A NAME="ss18.3">18.3</A> <A HREF="FAQ.html#toc18.3">Configuring Squid 2.2</A>
</H2>
<P>To configure SNMP first specify a list of communities that you would like to allow access
by using a standard acl of the form:
<PRE>
acl aclname snmp_community string
</PRE>
For example:
<PRE>
acl snmppublic snmp_community public
acl snmpjoebloggs snmp_community joebloggs
</PRE>
This creates two acl's, with two different communities, public and joebloggs. You can
name the acl's and the community strings anything that you like.</P>
<P>To specify the port that the agent will listen on modify the "snmp_port" parameter,
it is defaulted to 3401. The port that the agent will forward requests that can
not be furfilled by this agent to is set by "forward_snmpd_port" it is defaulted
to off. It must be configured for this to work. Remember that as the requests will
be originating from this agent you will need to make sure that you configure
your access accordingly.</P>
<P>To allow access to Squid's SNMP agent, define an <EM>snmp_access</EM> ACL with the community
strings that you previously defined.
For example:
<PRE>
snmp_access allow snmppublic localhost
snmp_access deny all
</PRE>
The above will allow anyone on the localhost who uses the community <EM>public</EM> to
access the agent. It will deny all others access.</P>
<P>If you do not define any <EM>snmp_access</EM> ACL's, then
SNMP access is denied by default.</P>
<P>Finally squid allows to you to configure the address that the agent will bind to
for incomming and outgoing traffic. These are defaulted to 0.0.0.0, changing these
will cause the agent to bind to a specific address on the host, rather than the
default which is all.
<PRE>
snmp_incoming_address 0.0.0.0
snmp_outgoing_address 0.0.0.0
</PRE>
</P>
<H2><A NAME="ss18.4">18.4</A> <A HREF="FAQ.html#toc18.4">Configuring Squid 2.1</A>
</H2>
<P>Prior to Squid 2.1 the SNMP code had a number of issues with the ACL's. If you are
a frequent user of SNMP with Squid, please upgrade to 2.2 or higher.</P>
<P>A sort of default, working configuration is:
<PRE>
snmp_port 3401
snmp_mib_path /local/squid/etc/mib.txt
snmp_agent_conf view all .1.3.6 included
snmp_agent_conf view squid .1.3.6 included
snmp_agent_conf user squid - all all public
snmp_agent_conf user all all all all squid
snmp_agent_conf community public squid squid
snmp_agent_conf community readwrite all all
</PRE>
</P>
<P>Note that for security you are advised to restrict SNMP access to your
caches. You can do this easily as follows:
<PRE>
acl snmpmanagementhosts 1.2.3.4/255.255.255.255 1.2.3.0/255.255.255.0
snmp_acl public deny all !snmpmanagementhosts
snmp_acl readwrite deny all
</PRE>
You must follow these instructions for 2.1 and below exactly or you are
likely to have problems. The parser has some issues which have been corrected
in 2.2.</P>
<H2><A NAME="ss18.5">18.5</A> <A HREF="FAQ.html#toc18.5">How can I query the Squid SNMP Agent</A>
</H2>
<P>You can test if your Squid supports SNMP with the <EM>snmpwalk</EM> program
(<EM>snmpwalk</EM> is a part of the
<A HREF="http://net-snmp.sourceforge.net/">NET-SNMP project</A>).
Note that you have to specify the SNMP port, which in Squid defaults to
3401.
<PRE>
snmpwalk -p 3401 hostname communitystring .1.3.6.1.4.1.3495.1.1
</PRE>
If it gives output like:
<PRE>
enterprises.nlanr.squid.cacheSystem.cacheSysVMsize = 7970816
enterprises.nlanr.squid.cacheSystem.cacheSysStorage = 2796142
enterprises.nlanr.squid.cacheSystem.cacheUptime = Timeticks: (766299) 2:07:42.99
</PRE>
then it is working ok, and you should be able to make nice statistics out of it.</P>
<P>For an explanation of what every string (OID) does, you should
refer to the
<A HREF="/SNMP/">Squid SNMP web pages</A>.</P>
<H2><A NAME="ss18.6">18.6</A> <A HREF="FAQ.html#toc18.6">What can I use SNMP and Squid for?</A>
</H2>
<P>There are a lot of things you can do with SNMP and Squid. It can be useful
in some extent for a longer term overview of how your proxy is doing. It can
also be used as a problem solver. For example: how is it going with your
filedescriptor usage? or how much does your LRU vary along a day. Things
you can't monitor very well normally, aside from clicking at the cachemgr
frequently. Why not let MRTG do it for you?</P>
<H2><A NAME="ss18.7">18.7</A> <A HREF="FAQ.html#toc18.7">How can I use SNMP with Squid?</A>
</H2>
<P>There are a number of tools that you can use to monitor Squid via
SNMP. Many people use MRTG. Another good combination is
<A HREF="http://net-snmp.sourceforge.net/">NET-SNMP</A> plus
<A HREF="http://people.ee.ethz.ch/~oetiker/webtools/rrdtool/">RRDTool</A>. You might be able to find more
information at the
<A HREF="/SNMP/">Squid SNMP web pages</A> or
<A HREF="http://wessels.squid-cache.org/squid-rrd/">ircache rrdtool scipts</A></P>
<H2><A NAME="ss18.8">18.8</A> <A HREF="FAQ.html#toc18.8">Where can I get more information/discussion about Squid and SNMP?</A>
</H2>
<P>General Discussion:
<A HREF="mailto:cache-snmp@ircache.net">cache-snmp@ircache.net</A>
These messages are
<A HREF="http://www.squid-cache.org/mail-archive/cache-snmp/">archived</A>.</P>
<P>Subscriptions should be sent to:
<A HREF="mailto:cache-snmp-request@ircache.net">cache-snmp-request@ircache.net</A>.</P>
<H2><A NAME="ss18.9">18.9</A> <A HREF="FAQ.html#toc18.9">Monitoring Squid with MRTG</A>
</H2>
<P>Some people use
<A HREF="http://www.mrtg.org/">MRTG</A>
to query Squid through its SNMP interface.</P>
<P>To get instruction on using MRTG with Squid please visit these pages:
<OL>
<LI>
<A HREF="http://www.cache.dfn.de/DFN-Cache/Development/Monitoring/">Cache Monitoring - How to set up your own monitoring</A> by DFN-Cache</LI>
<LI>
<A HREF="http://www.acmeconsulting.it/SquidNT.html">Using MRTG to monitor Squid</A> by ACME Consulting S.r.l.</LI>
<LI>
<A HREF="http://squid.visolve.com/related/snmp/monitoringsquid.htm">Squid Configuration Manual - Monitoring Squid</A> by Visolve</LI>
<LI>
<A HREF="http://www.arnes.si/~matija/utrecht/lecture.html">Using MRTG for Squid monitoring</A> Desire II caching workshop session by Matija Grabnar</LI>
<LI>
<A HREF="http://hermes.wwwcache.ja.net/FAQ/FAQ-2.html#mrtg">How do I monitor my Squid 2 cache using MRT</A> by The National Janet Web Cache Service </LI>
</OL>
</P>
<P>Further examples of Squid MRTG configurations can be found here:
<OL>
<LI>
<A HREF="http://howto.aphroland.de/HOWTO/MRTG/SquidMonitoringWithMRTG">MRTG HOWTO Collection / Squid</A> from MRTG</LI>
<LI>
<A HREF="http://people.ee.ethz.ch/~oetiker/webtools/mrtg/squid.html">using mrtg to monitor Squid</A> from MRTG</LI>
<LI>
<A HREF="http://www.psychofx.com/chris/unix/mrtg/">Chris' MRTG Resources</A></LI>
<LI>
<A HREF="http://thproxy.jinr.ru/file-archive/doc/squid/cache-snmp/mrtg-demo/">MRTG & Squid</A> by Glenn Chisholm</LI>
<LI>
<A HREF="http://www.braindump.dk/en/wiki/?catid=7&wikipage=ConfigFiles">Braindump</A> by Joakim Recht</LI>
</OL>
</P>
<HR>
<A HREF="FAQ-19.html">Next</A>
<A HREF="FAQ-17.html">Previous</A>
<A HREF="FAQ.html#toc18">Contents</A>
</BODY>
</HTML>
|
