SNmp Plugin and InfluxDb

[chappi6]

Hi

I am trying to collect data via snmp from one Firewall and store this data in my InfluxDb. Now i am facing the problem, that i would like to insert multiple values from an snmp request with the same timestamp into the db. From my point of knowledge it is not possible to do that.
Now my question is, is it possible to remove the timestamp from the snmp imput or get different timestamps for each value?

Values from InfluxDb:

select * from Prozessor
name: Prozessor
time agent_host host hrProcessorFrwID hrProcessorLoad

---

1489649741000000000 10.0.0.1 localhost.localdomain .0.0 59
1489649751000000000 10.0.0.1 localhost.localdomain .0.0 61
1489649761000000000 10.0.0.1 localhost.localdomain .0.0 49

Value output from telegraf:
Prozessor,agent_host=10.0.0.1,host=localhost.localdomain hrProcessorLoad=54i,hrProcessorFrwID=".0.0" 1489649741000000000
Prozessor,agent_host=10.0.0.1,host=localhost.localdomain hrProcessorFrwID=".0.0",hrProcessorLoad=50i 1489649741000000000
Prozessor,agent_host=10.0.0.1,host=localhost.localdomain hrProcessorFrwID=".0.0",hrProcessorLoad=51i 1489649741000000000
Prozessor,agent_host=10.0.0.1,host=localhost.localdomain hrProcessorLoad=59i,hrProcessorFrwID=".0.0" 1489649741000000000

Prozessor,agent_host=10.0.0.1,host=localhost.localdomain hrProcessorLoad=54i,hrProcessorFrwID=".0.0" 1489649751000000000
Prozessor,agent_host=10.0.0.1,host=localhost.localdomain hrProcessorFrwID=".0.0",hrProcessorLoad=50i 1489649751000000000
Prozessor,agent_host=10.0.0.1,host=localhost.localdomain hrProcessorFrwID=".0.0",hrProcessorLoad=50i 1489649751000000000
Prozessor,agent_host=10.0.0.1,host=localhost.localdomain hrProcessorFrwID=".0.0",hrProcessorLoad=61i 1489649751000000000

Prozessor,agent_host=10.0.0.1,host=localhost.localdomain hrProcessorFrwID=".0.0",hrProcessorLoad=61i 1489649761000000000
Prozessor,host=localhost.localdomain,agent_host=10.0.0.1 hrProcessorFrwID=".0.0",hrProcessorLoad=53i 1489649761000000000
Prozessor,agent_host=10.0.0.1,host=localhost.localdomain hrProcessorFrwID=".0.0",hrProcessorLoad=50i 1489649761000000000
Prozessor,agent_host=10.0.0.1,host=localhost.localdomain hrProcessorFrwID=".0.0",hrProcessorLoad=49i 1489649761000000000

[danielnelson]

In InfluxDB each series can only have one value per field. If you want more than one reading at an exact time you will probably want one of the tags to be different, a reading can only have one value for a field at a time from a given host.

I think you may be able to do this by modifying your snmp input configuration, can you add the relevant config?

[danielnelson]

Also take a look at the round_interval https://github.com/influxdata/telegraf/blob/master/docs/CONFIGURATION.md#agent-configuration

[chappi6]

I am actually trying to get the information about the cpu load. the return isn't that wrong because there are 4 cpus in the device.

Here is my config from telegraf:

[[inputs.snmp]]
agents = ["10.0.0.1"]
version = 3
sec_name = ""
auth_protocol = ""
auth_password = ""
priv_protocol = ""
priv_password = ""
sec_level = "noAuthNoPriv" # Values: "noAuthNoPriv", "authNoPriv", "authPr iv"
## Timeout for each SNMP query.
timeout = "5s"
## Number of retries to attempt within timeout.
retries = 3

.# MIB id lookup http://www.oidview.com/mibs/0/HOST-RESOURCES-MIB.html
[[inputs.snmp.table]]
name = "Prozessor"
inherit_tags = [ "hostname" ]
oid = ".1.3.6.1.2.1.25.3.3" # hrProcessorTable
[[inputs.snmp.table.field]]
oid = ".1.3.6.1.2.1.25.3.3.1.1" #hrProcessorLoad

[[outputs.influxdb]]
urls = [ "http://127.0.0.1:8086" ]
database = "fw"
precision = "ns"

[phemmer]

While I'm not familiar with the device, or the data it outputs, I would have expected the hrProcessorFrwID field to be an identifier, and not the same for all records.
However given that it appears it is not, one feature which would help you is to be able to add the table index as a tag: #2366

[WaterByWind]

That is exactly what I am using for a few different devices. For now I have specifically applied the relevant PR and locally built telegraf with that change to support this. My telegraf input configuration for this:

   [[inputs.snmp.table]]
     index_as_tag = true
     oid = "HOST-RESOURCES-MIB::hrProcessorTable"

BTW: hrProcessorFrwID is an identifier that varies with each entry and is in fact the index used:

user@host:/home/user$ snmpwalk -v 2c -c <community> <host> HOST-RESOURCES-MIB::hrProcessorTable
HOST-RESOURCES-MIB::hrProcessorFrwID.196608 = OID: SNMPv2-SMI::zeroDotZero
HOST-RESOURCES-MIB::hrProcessorFrwID.196609 = OID: SNMPv2-SMI::zeroDotZero
HOST-RESOURCES-MIB::hrProcessorLoad.196608 = INTEGER: 4
HOST-RESOURCES-MIB::hrProcessorLoad.196609 = INTEGER: 4

[chappi6]

I tried to collect the data with snmpwalk and it worked pretty fine.
snmpwalk -v 3 -a MD5 -A pw -u user -x AES -X pw -l noauthPriv -r3 -t 5 10.0.0.1:161 HOST-RESOURCES-MIB::hrProcessorTable

HOST-RESOURCES-MIB::hrProcessorFrwID.768 = OID: SNMPv2-SMI::zeroDotZero
HOST-RESOURCES-MIB::hrProcessorFrwID.769 = OID: SNMPv2-SMI::zeroDotZero
HOST-RESOURCES-MIB::hrProcessorFrwID.770 = OID: SNMPv2-SMI::zeroDotZero
HOST-RESOURCES-MIB::hrProcessorFrwID.771 = OID: SNMPv2-SMI::zeroDotZero
HOST-RESOURCES-MIB::hrProcessorLoad.768 = INTEGER: 60
HOST-RESOURCES-MIB::hrProcessorLoad.769 = INTEGER: 48
HOST-RESOURCES-MIB::hrProcessorLoad.770 = INTEGER: 45
HOST-RESOURCES-MIB::hrProcessorLoad.771 = INTEGER: 48

Telegraf output:
Prozessor,agent_host=10.0.0.1,host=localhost.localdomain hrProcessorFrwID=".0.0",hrProcessorLoad=48i 1489649751000000000

But if I do it with telegraf it doesn't work. Telegraf seems to make some wired things with the processor id.
Also the round_interval parameter doesn't help. And i still have the same timestamp for all values. Would it be possible to remove the timestamp? So that influx could set it?

[WaterByWind]

The HOST-RESOURCES-MIB::hrProcessorTable is similar to several others. The problem is that you don't want the value of hrProcessorFrwID since it doesn't contain anything useful. In fact you probably don't want/need hrProcessorFwrID at all as many (most?) vendors don't populate this and leave it as 0.0 (as you see here). This object is defined in the MIB as:

hrProcessorFrwID OBJECT-TYPE
    SYNTAX     ProductID
    MAX-ACCESS read-only
    STATUS     current
    DESCRIPTION
        "The product ID of the firmware associated with the
        processor."
    ::= { hrProcessorEntry 1 }

hrProcessorFrwID is sometimes used to enumerate processors which may cause confusion.

The PR noted by @phemmer is what is needed in this case if you want to use the auto-table capability in the SNMP plugin (IE: [[inputs.snmp.table]]). The actual index, which is what is needed here, is not part of the table itself and is instead the sub-oid in the values returned. There are no other fields that would identify each row uniquely (IE: used as an index) which is what is causing the issue you are seeing - it has nothing to do with timestamps.

I am using the functionality in #2366 for several standard and vendor-specific tables for similar reasons.

Alternately you could build a specific configuration that does not use auto-table. Using your example above this might be something like:

[[inputs.snmp.field]]
name = "hrProcessorLoad1"
oid = ".1.3.6.1.2.1.25.3.3.1.2.768" 
[[inputs.snmp.field]]
name = "hrProcessorLoad2"
oid = ".1.3.6.1.2.1.25.3.3.1.2.769" 
[[inputs.snmp.field]]
name = "hrProcessorLoad3"
oid = ".1.3.6.1.2.1.25.3.3.1.2.770" 
[[inputs.snmp.field]]
name = "hrProcessorLoad4"
oid = ".1.3.6.1.2.1.25.3.3.1.2.771" 

Be aware the that actual index is actually a generic device index for the system, and could be subject to change. It is not very likely but it is possible. Also note that this index and the number of entries may vary from platform to platform, requiring different configurations for each. This obviously would not scale well but may suit for you for the interim (or apply the PR manually)