topic SNMP Traffic from windows to Splunk in Getting Data In

SNMP Traffic from windows to Splunk

kristiaan_d — Sat, 29 Jan 2011 01:26:24 GMT

Hello Everyone, just after some help with Splunk and Windows SNMP data collection, ive had a bit of a read on here and some of the help docs which suggest i setup a seperate piece of software to log SNMP traffic on the server and have Splunk capture this.

I would much prefer to have Splunk capture the traffic directly to save having to admin a log files on servers and maintain extra software, i have setup my SNMP service in windows to point at the PC running Splunk but so far i cannot see anywhere in Splunk that shows me its acutally collecting data ?

can someone please offer some advice or help on how to configure the inbuilt snmp system with windows so that splunk can use it?

this is not a firewall problem btw ive already double checked that and both machines firewalls are disabled for this test.

Kris

Re: SNMP Traffic from windows to Splunk

chris — Sun, 30 Jan 2011 01:20:26 GMT

Hi Kris

You've probably come accross this: http://www.splunk.com/base/Documentation/latest/Admin/SendSNMPeventstoSplunk

The instructions are pretty clear, splunk will not be able to handle the SNMP Traps (you are talking about clients sending Traps to the Splunk Server right?)

We have setup an snmp daemon at our company which logs traps and it works fine.

Good luck

Chris

Re: SNMP Traffic from windows to Splunk

kristiaan_d — Mon, 31 Jan 2011 19:32:43 GMT

Hi Chris,
thanks for the reply, yes i basically want my web server to send snmp traffic to splunk and have splunk capture it, however if im reading your reply correctly and other peoples experiences, this is not possible i have to setup a system to capture this and write it to a txt file??

not sure where the logic for this was thought up but if thats the only way i can do it i will look at trapping the data..

Re: SNMP Traffic from windows to Splunk

chris — Mon, 31 Jan 2011 20:04:23 GMT

Hi Kris, I am afraid, that you won't get around setting up an snmp daemon. I'm not sure why Splunk does not have this integrated. But I guess it is because they would have to maintain and support an snmp daemon which will only capture one log source. And there already are good tools that will generate data Splunk can read.

Re: SNMP Traffic from windows to Splunk

kristiaan_d — Mon, 31 Jan 2011 21:32:10 GMT

Hi Chris, just one final question, been as i now need an SNMP Daemon did you use the one suggested in the splunk article? or did you choose a different one? if you chose a different daemon can you let me know what it was please?

Re: SNMP Traffic from windows to Splunk

chris — Mon, 31 Jan 2011 21:47:58 GMT

Hi Kris, yes we are using net-snmp.

Re: SNMP Traffic from windows to Splunk

kristiaan_d — Tue, 01 Feb 2011 00:25:43 GMT

ok at the risk of sounding dumb, ive searched the net-snmp site for a windows download and there only seems to be linux RPM files all over the place... wheres the windows version?

Re: SNMP Traffic from windows to Splunk

chris — Tue, 01 Feb 2011 00:54:57 GMT

don't worry, the Windows version is a bit behind, the linux binary distribution try: http://sourceforge.net/projects/net-snmp/files/net-snmp%20binaries/5.5-binaries/

Re: SNMP Traffic from windows to Splunk

cqian02 — Tue, 04 Sep 2012 14:44:11 GMT

Hi Chris, I've configured SNMPTRAP on a Windows server using Net-SNMP(according to the documentation), now I'm able to create the snmptrapd.log file, but I didn't see any data coming in the log file. Do you have any idea why this happened? Thank you very much.

Re: SNMP Traffic from windows to Splunk

chris — Thu, 06 Sep 2012 11:42:18 GMT

Hi cqian02, do you see any network traffic on port 162 (or whatever you configured)?