Manage a Publisher

After deploying your publisher, use the following sections to make modifications to your Publishers.

Guidance for Installing 3rd-party Applications on Publishers

Be aware that any additional software (not included with the Netskope provided package) that is installed on a Publisher instance will be sharing resources with the Publisher application. In addition, Netskope and 3rd-party domains and Publisher software processes may need to be whitelisted in the 3rd-party software.

Network security software that monitors each and every action on the Publisher instance may cause performance issues. You can install security software as long as doing so does not impact Publisher performance. It is your responsibility to ensure that enough resources are allocated for all the software applications running on a Publisher instance.

To troubleshoot issues, Netskope Support may request you to test/recreate without 3rd-party software to narrow down the root cause.

Publisher Auto-Update Best Practices

2024/10/15 04:31:20 UTC - 1149212 CmdWait failed: exit status 100 (E: Sub-process /usr/bin/dpkg returned an error code (1))
2024/10/15 04:31:20 UTC - 1149212 Failed to apt-get upgrade, exit status 100 (E: Sub-process /usr/bin/dpkg returned an error code (1))
2024/10/15 04:31:21 UTC - 1149212 Auto upgrade failed, perform the post auto upgrade failed action

sudo apt-get update
sudo apt-get upgrade

Prerequisites

• Publisher: Must have snmpd installed to send trap information.
• Server (Trap Receiver): Must have snmptrapd installed to receive trap information.

Configure SNMP for the Publisher

1. Install SNMP on your Publisher using these instructions.
2. Install the required snmpd and snmpget packages using this command:
   sudo apt-get update && sudo apt-get install snmp snmpd.
3. Configure the snmpd file located at: /etc/snmp/snmpd.conf.
   1. Set the community string with the following line:
      rocommunity COMMUNITY_STRING.
   2. Define the trap receiver. Replace $TRAP_RECEIVER_IP with the IP address of your SNMP manager and $COMMUNITY_STRING) with your community string:
      • Ensure that $TRAP_RECEIVER_IP is the IP address of your server.
      • Add the line:
        trapsink $TRAP_RECEIVER_IP $COMMUNITY_STRING.
   3. Configure the agent to send traps by adding:
      authtrapenable 1.
4. Restart the snmpd service with the command:
   sudo service snmpd restart.
5. Configure the snmptrapd file located at: /etc/snmp/snmptrapd.conf. Add the line:
   disableAuthorization yes.
6. Here is an example configuration for /etc/snmp/snmpd.conf. In this example, assume your $COMMUNITY_STRING is NETSKOPE, and your $TRAP_RECEIVER_IP is 13.231.185.233. The remaining settings are left unchanged.

ubuntu@publisherIP:~$ sudo cat /etc/snmp/snmpd.conf
###########################################################################
#
# snmpd.conf
# An example configuration file for configuring the Net-SNMP agent ('snmpd')
# See snmpd.conf(5) man page for details
#
##############################################################

# SECTION: System Information Setup
#

# syslocation: The [typically physical] location of the system.
#   Note that setting this value here means that when trying to
#   perform an snmp SET operation to the sysLocation.0 variable will make
#   the agent return the "notWritable" error code.  IE, including
#   this token in the snmpd.conf file will disable write access to
#   the variable.
#   arguments:  location_string
sysLocation    Sitting on the Dock of the Bay
sysContact     Me <me@example.org>

# sysservices: The proper value for the sysServices object.
#   arguments:  sysservices_number
sysServices    72

##############################################################
# SECTION: Agent Operating Mode
#
#   This section defines how the agent will operate when it
#   is running.

# master: Should the agent operate as a master agent or not.
#   Currently, the only supported master agent type for this token
#   is "agentx".
#
#   arguments: (on|yes|agentx|all|off|no)

master  agentx

# agentaddress: The IP address and port number that the agent will listen on.
#   By default the agent listens to any and all traffic from any
#   interface on the default SNMP port (161).  This allows you to
#   specify which address, interface, transport type and port(s) that you
#   want the agent to listen on.  Multiple definitions of this token
#   are concatenated together (using ':'s).
#   arguments: [transport:]port[@interface/address],...

agentaddress udp:161


###########################################################################
# SECTION: Access Control Setup
#
#   This section defines who is allowed to talk to your running
#   snmp agent.

# Views
#   arguments viewname included [oid]

#  system + hrSystem groups only
view   systemonly  included   .1.3.6.1.2.1.1
view   systemonly  included   .1.3.6.1.2.1.25.1


# rocommunity: a SNMPv1/SNMPv2c read-only access community name
#   arguments:  community [default|hostname|network/bits] [oid | -V view]

# Read-only access to everyone to the systemonly view
rocommunity NETSKOPE                      <<<<< Modify this
rocommunity6 public default -V systemonly
trapsink 13.231.185.233 NETSKOPE          <<<<< Modify this
authtrapenable 1                          <<<<< Modify this

# SNMPv3 doesn't use communities, but users with (optionally) an
# authentication and encryption string. This user needs to be created
# with what they can view with rouser/rwuser lines in this file.
#
# createUser username (MD5|SHA|SHA-512|SHA-384|SHA-256|SHA-224) authpassphrase [DES|AES] [privpassphrase]
# e.g.
# createuser authPrivUser SHA-512 myauthphrase AES myprivphrase
#
# This should be put into /var/lib/snmp/snmpd.conf
#
# rouser: a SNMPv3 read-only access username
#    arguments: username [noauth|auth|priv [OID | -V VIEW [CONTEXT]]]
rouser authPrivUser authpriv -V systemonly
disk / 10000

Configure the SNMP Trap on a Linux Server

1. Install snmptrapd with this command:
   sudo apt-get update && sudo apt-get install snmptrapd.
2. Configure snmptrapd by editing the configuration file located at: /etc/snmp/snmptrapd.conf.
   To allow incoming traps, add this line to the configuration file:
   disableAuthorization yes.
3. Configure the snmptrapd systemd configuration located at: /lib/systemd/system/snmptrapd.service.
   For example, you can modify the log output file by changing the ExecStart line to:
   ExecStart=/usr/sbin/snmptrapd -f -Lf $OUTPUT_PATH.
4. Configure the firewall to allow incoming traffic from port 162/udp by running:
   sudo ufw allow 162/udp.
   Note that if your UFW is disabled, you should skip this step; otherwise, you risk blocking your SSH access.
5. Reload the snmptrapd configuration, and restart the service.

sudo systemctl daemon-reload
sudo systemctl enable snmptrapd
sudo systemctl start snmptrapd

Example output for /lib/systemd/system/snmptrapd.service:

cat /lib/systemd/system/snmptrapd.service
[Unit]
Description=Simple Network Management Protocol (SNMP) Trap Daemon.
After=network.target
ConditionPathExists=/etc/snmp/snmptrapd.conf

[Service]
Type=simple
ExecStart=/usr/sbin/snmptrapd -f -Lf /var/log/snmptrap.log
ExecReload=/bin/kill -HUP $MAINPID

[Install]
WantedBy=multi-user.target

Example output for /lib/systemd/system/snmptrapd.service:

cat /etc/snmp/snmptrapd.conf

#
# EXAMPLE-trap.conf:
#   An example configuration file for configuring the Net-SNMP snmptrapd agent.
#
###############################################################################
#
# This file is intended to only be an example.
# When the snmptrapd agent starts up, this is where it will look for it.
#
# All lines beginning with a '#' are comments and are intended for you
# to read.  All other lines are configuration commands for the agent.

#
# PLEASE: read the snmptrapd.conf(5) manual page as well!
#
#authCommunity log,execute,net private　
#authCommunity log,execute,net public
#
## send mail when get any events
#traphandle default /usr/bin/traptoemail -s smtp.example.org foobar@example.org
#
## send mail when get linkDown
#traphandle .1.3.6.1.6.3.1.1.5.3 /usr/bin/traptoemail -s smtp.example.org foobar@example.org
disableAuthorization yes

E2E Testing and Expected Result

1. On the Publisher, send the trap message with the public IP of the server:
   1. You may need to install MIB files related module by running:
      sudo apt-get install snmp-mibs-downloader.
   2. Send the snmptrapd message.
      1. For example, send available disk space:

         #!/bin/bash
         
         # SNMP community string and target IP
         COMMUNITY="NETSKOPE"
         TARGET_IP="52.199.37.185"
         
         # Retrieve the value for available space on the disk
         available_space=$(snmpget -v 2c -c $COMMUNITY localhost .1.3.6.1.4.1.2021.9.1.7.1 -Ov | awk '{print $2}')
         
         # Send the trap
         snmptrap -v 2c -c $COMMUNITY $TARGET_IP '' .1.3.6.1.4.1.2021.9.1.7.1 i integer $available_space

      2. Other metrics can be found here.
      3. The generalized syntax / rule might be:
         1. Use snmpget to get the result, names as $METHOD_RESULT of desired metric based on OID on localhost snmpget -v 2c -c $COMMUNITY_NAME localhost $OID -Ov | $PROCESSING_METHOD?.
         2. Use snmptrap to send the result to the target machine:
            sudo snmptrap -v 2c -c $COMMUNITY_NAME $TRAP_RECEIVER_IP "" $OID [i|s] [integer|string] $METHOD_RESULT.
2. On the server (trap receiver), receive the snmptrap message with sudo tail -f /var/log/snmptrap.log.
   You should see that 15G is the disk remaining space:

   sudo tail -f /var/log/snmptrap.log
   unknown snmp version 193
   NET-SNMP version 5.8 AgentX subagent connected
   NET-SNMP version 5.8
   2024-01-11 07:16:20 ec2-13-114-11-108.ap-northeast-1.compute.amazonaws.com [UDP: [13.114.11.108]:34966->[172.31.20.184]:162]:
   iso.3.6.1.2.1.1.3.0 = Timeticks: (17718887) 2 days, 1:13:08.87  iso.3.6.1.6.3.1.1.4.1.0 = OID: iso.3.6.1.4.1.2021.9.1.7.1        iso.3.6.1.6 = STRING: "15G"

3. You can use crontab -e along with bash scripts to make it periodically process.

SNMP Trap Troubleshooting

1. The snmpd failed to run with exit-code.

   root@ip-172-31-29-201:/home/ubuntu# service snmpd status
   snmpd.service - Simple Network Management Protocol (SNMP) Daemon.
        Loaded: loaded (/lib/systemd/system/snmpd.service; enabled; vendor preset: enabled)
        Active: failed (Result: exit-code) since Wed 2024-01-10 06:07:06 UTC; 6min ago
       Process: 98894 ExecStartPre=/bin/mkdir -p /var/run/agentx (code=exited, status=0/SUCCESS)
       Process: 98895 ExecStart=/usr/sbin/snmpd -LOw -u Debian-snmp -g Debian-snmp -I -smux,mteTrigger,mteTriggerConf -f >
      Main PID: 98895 (code=exited, status=1/FAILURE)
   
   Jan 10 06:07:06 ip-172-31-29-201 systemd[1]: Starting Simple Network Management Protocol (SNMP) Daemon....
   Jan 10 06:07:06 ip-172-31-29-201 systemd[1]: Started Simple Network Management Protocol (SNMP) Daemon..
   Jan 10 06:07:06 ip-172-31-29-201 snmpd[98895]: Error opening specified endpoint "[::1]"
   Jan 10 06:07:06 ip-172-31-29-201 snmpd[98895]: Server Exiting with code 1
   Jan 10 06:07:06 ip-172-31-29-201 systemd[1]: snmpd.service: Main process exited, code=exited, status=1/FAILURE
   Jan 10 06:07:06 ip-172-31-29-201 systemd[1]: snmpd.service: Failed with result 'exit-code'

   Solution: Modify the agentaddress in /etc/snmp/snmpd.conf from agentaddress 127.0.0.1, [::1] to agentaddress udp:161. After making this change, restart the SNMP service. Once restarted, verify that the snmpd service is running correctly.

   snmpd.service - Simple Network Management Protocol (SNMP) Daemon.
        Loaded: loaded (/lib/systemd/system/snmpd.service; enabled; vendor preset: enabled)
        Active: active (running) since Wed 2024-01-10 06:28:09 UTC; 5min ago
       Process: 102590 ExecStartPre=/bin/mkdir -p /var/run/agentx (code=exited, status=0/SUCCESS)
      Main PID: 102591 (snmpd)
         Tasks: 1 (limit: 4603)
        Memory: 6.5M
        CGroup: /system.slice/snmpd.service
                └─102591 /usr/sbin/snmpd -LOw -u Debian-snmp -g Debian-snmp -I -smux mteTrigger mteTriggerConf -f -p /run>
   
   Jan 10 06:28:09 ip-172-31-29-201 systemd[1]: Starting Simple Network Management Protocol (SNMP) Daemon....
   Jan 10 06:28:09 ip-172-31-29-201 systemd[1]: Started Simple Network Management Protocol (SNMP) Daemon..

2. If the snmptrap is complaining about the syntax error:
   sudo snmptrap -v 2c -c NETSKOPE 52.199.37.185 "" .1.3.6.1.4.1.2021.9.1.7.1 s $(df -h / | awk '/\/$/ {print $4}')
s: Missing type/value for variable.
   
   Solution: Add a string suffix after the s::
   sudo snmptrap -v 2c -c NETSKOPE 52.199.37.185 "" .1.3.6.1.4.1.2021.9.1.7.1 s string $(df -h / | awk '/\/$/ {print $4
}').
3. For integer i, add integer suffix after the i.