Section 10.1. Understanding SNMP

10.1. Understanding SNMP

SNMP is part of the TCP/IP suite of protocols and is used for communicating monitoring data (called an SNMP trap) from SNMP agents to an SNMP console over port 162. It is also used to gather configuration information from a device and to write configuration data to a device over port 161. When you discuss monitoring using SNMP, you're usually referring to network devices (switches and routers). Most operations management solutions are capable of receiving and sending SNMP traps to be backward compatibile. MOM is no exception and uses the Windows SNMP Windows Management Instrumentation (WMI) provider.

An SNMP trap is similar to an alertit is triggered by a predefined event, such as a reboot, on the SNMP-monitored device. It contains information about the event and is sent from the SNMP agent to a central console. Unlike a MOM alert, the only thing you can do with an SNMP trap is to acknowledge it in the SNMP console. You could keep it for historical purposes, but the only thing a trap really gives you is a message from the managed device saying "this event happened at this time."

SNMP data is arranged in a hierarchy, much like the DNS hierarchy. At the top level of the hierarchy, public identifiers are defined by Internet authorities. Where DNS uses domain names like .com, .gov, or .org at the top and allows registration of sub-domain names, the SNMP namespace uses a dotted decimal notation to assign numbers that map to Internet entities and sub-entities. A complete SNMP data identification string looks very much like an IP address, except much longer. In DNS, the complete path to an object in the public DNS namespace, such as homemomserver.homelab.lab.com, is the FQDN. In SNMP, every attribute of a device or an event can be described in the dotted decimal notation and the whole string is called an object identifier (OID). For example, this OID string is for a successful network logon to a Windows server:

 .1.3.6.1.4.1.311.1.13.1.9999.1.0 

In this OID string, the numbers map to these fields respectively:

 .iso.org.dod.internet.private.enterprises.microsoft.software.13.1.9999.1.0 

The complete mapping of fields to actual values for a device or application is done in a management information block (MIB) file for any SNMP device or application. SNMP management applications (consoles) need the mappings in MIB files to decode the OIDs in SNMP traps and to read and write information to an SNMP device. The management applications compile raw MIB files, which are just text files of a specific format, into a format that is used by the management application. For example, for MOM to catch SNMP traps from a Cisco router you would need to get the MIB file for that device from Cisco and compile it into the Windows WMI namespace. The traps could be translated from OID format into something that is readable by the Windows OS, MOM, and humans. SNMP traps come in three versions: v1, v2, and v3. The SNMP-monitored device and the SNMP console must speak the same version of SNMP to communicate. The versions are differentiated by increasing functionality starting from v1. In the context of the Windows OS and MOM, you will only be working with v1 and v2 traps.

MOM can also generate SNMP traps as a response to an alert. The MOM-generated SNMP traps can be sent to another application that speaks SNMP. This is another way that MOM alerts can be integrated into other operations management systems. The MOM MIB file is called MicrosoftOperationsManager.mib , and it is in the MOM 2005 SDK.

If you read the MicrosoftOperationsManager.mib file, you will notice that it is called the Mission_Critical_MIB file. Before Microsoft acquired the product that eventually became MOM, it was owned by a company called Mission Critical Software that created the initial MIB. Mission Critical was issued a namespace in the OID hierarchy and the MIB was created with that information embedded. This fact is irrelevant to the product's functions, but it is a little bit of interesting history and it answers what can be a puzzling question.