Daniel Nashed's Blog

SNMP with Domino on Docker

Simple Network Management Protocol (SNMP) is a rarely used functionality in Domino, which has been implemented in Domino in the last century.
But I got a request from a customer to get SNMP working with Domino in a container to monitor the server.
On Kubernetes there are other ways to monitor servers. But for a stand-alone Docker host, SNMP could still make sense and can be implemented.


SNMP components involved

To understand how it works, it is good to understand all the components.


SNMP Master Agent

SNMP uses a host level master SNMP agent "snmpd".
The agent listens on port 161 UDP and is installed as a systemd service.

On Redhat/CentOS based distributions the agent can be installed like this:

dnf install -y net-snmp net-snmp-utils
systemctl enable --now snmpd

On Ubuntu you need different package names:

apt install -y snmpd snmp snmp-mibs-downloader
systemctl enable --now snmpd


Domino SNMP Agent

Domino brings it's own SNMP agent "lnsnmp", which needs to be started as root user as a systemd service.
Note: Domino does not ship with a service, but I added one to the Domino start script replacing older init.d scripts, which are not supported on newer Linux versions.

Domino Servertasks

quryset and intrcpt are two servertasks working hand in hand with the Domino SNMP agent and implement the logic.
You can enable debugging via notes.ini settings to see their details about SNMP processing on teh Domino side:

set config QS_DEBUG=255;/local/notesdata/debug-quryset.log
set config DEBUG_TRAP=255;/local/notesdata/debug-intercept.log


Communication among the components

• The SNMP master agent is listening on UDP port 161
  
  
• The Domino SNMP agent communicates via SNMP on port UDP 161 with the master agent and registers itself
  It registers a AF_UNIX socket with the name /tmp/.esaMainProxy to communicate with the two servertasks
  
  
• quryset and intrcpt communicate with the Domino SNMP agent leveraging the socket

Bringing SNMP into the container

Basically there would be two approaches which would work.
The straightforward implementation is to copy the Domino SNMP files to the host and run the Domino SNMP service on the host.
Then expose the UNIX socket to the container by mounting it as a volume via

-v /tmp/.esaMainProxy:/tmp/.esaMainProxy.

Using this approach does not need any changes in the container image.
The Domino server in the container just communicates thru the socket with the host level Domino SNMP agent, which talks directly to the SNMP master agent.


---

The second approach is not recommended and I am describing it just for educational purposes.
In theory the Domino SNMP agent could run as a daemon inside the container and would create the UNIX socket directly in the container to allow quryset and intrcpt to communicate with Domino SNMP.
If running in network host mode the Domino SNMP agent does not need any further configuration to talk to the SNMP master agent.

This approach would involve a process running as root inside the container. Domino could still start the SNMP agent in the background when the binary gets teh SUID permissions set.
With SUID the Domino SNMP agent would switch to the root user -- even the container is started as the "notes" user.

I have tested booth approaches, but I don't think we want the SNMP agent to run inside the container.
But if a customer would require this type of configuration, I could add a container build option for native support SNMP in future.


Conclusion

I personally don't think SNMP with Domino is used often. But it is good to have SNMP working for the Domino container image if needed.
This short write up should also explain the communication among the components involved and might give you a better understanding of the SNMP agent.

There are more modern monitoring options today. I would personally not favor SNMP in combination with Domino running in container -- but it works.
Example:

snmpwalk -m /opt/hcl/domino/notes/latest/linux/domino.mib -c public -v2c 127.0.0.1 lnServerName

• Comments [0]