The standard way of doing this in Smarts is to create a seperate instrumentation class for each vendor. So in your case create a toplevel class fw_session where you put code common to all vendors. Then subclass off this for each vendor, e.g. fw_session_cisco, fw_session_netscreen, etc.You put vendor specific code/definitions in these classes.

Your discovery code will need to know which instrumentation class to create for a given model/vendor.

I think then your propagate definitation in the Firewall class should work unmodified.

Hi AlanG,

Thanks for your reply. Your input lightened me.

However, looks like most of the general instrumentations ( for example: Memory_Performance ) are complied in binary code, I can only see the specific vendor's instrumentation. The difficult part for me would be how to link the general instrumentation with the specific vendor's instrumentations.

So do you know if there is any code in Smarts installation path I can refer to ?

Cheers,

There isn't much to it, something like this should work, although I haven't tested it (but it compiles).

interface fw_session : ICIM_Instrumentation {

    readonly attribute int ActiveSessions;

}

interface fw_session_cisco : fw_session {

    instrument SNMP {
        ActiveSessions = "1.3.6.1.4.1.9.9.147.1.2.2.2.1.5.40.6"
    };

  refine instrumented ActiveSessions;
}

interface fw_session_netscreen : fw_session {

    instrument SNMP {
        ActiveSessions = "1.3.6.1.4.1.3224.16.3.2"
    };

  refine instrumented ActiveSessions;
}

etc...

Thank you very much Alan, I will give it a go.

Cheers,

Hi Alan,

Sorry to bother you again. I've loaded the dynamic model into the system and also created separate polling classes for these firewalls, but I get null value in IP domain.

I am not sure if I need to touch the discovery drives ( those .import files) under /opt/InCharge/IP/smarts/conf/discovery.

I think I only need to populate values from snmp poll and no need to create objects, so using instrument snmp plus new polling might be sufficient.

I am quite struggling on this one, as the learning materials/documents are very limited. I am wondering if you have experience on this, would you be able to explain this a bit more to me ? I believe quite a few folks on this forum are keen to know the similar stuff as well according to my searching.

What I've done so far:

###################

1. Dynamic model

###################

interface fw_session : ICIM_Instrumentation {

    readonly attribute unsigned ActiveSessions;

}

interface fw_session_cisco : fw_session {

    instrument SNMP {

        ActiveSessions = "1.3.6.1.4.1.9.9.147.1.2.2.2.1.5.40.6"

    };

  refine instrumented ActiveSessions;

}

interface fw_session_netscreen : fw_session {

    instrument SNMP {

        ActiveSessions = "1.3.6.1.4.1.3224.16.3.2"

    };

  refine instrumented ActiveSessions;

}

interface fw_session_fortinet : fw_session {

    instrument SNMP {

        ActiveSessions = "1.3.6.1.4.1.12356.101.4.1.8"

    };

  refine instrumented ActiveSessions;

}

refine interface Firewall

{

propagate attribute unsigned max ActiveSessions

         "Number of active sessions on the device."

         = fw_Session, InstrumentedBy, ActiveSessions;

}

##################################

2. Create 3 new polling classes for 3 different vendors firewalls and associate firewalls with them, below is an example for fortinet firewalls.

##################################

/*

*  fortinet_fw_setting.asl

*

*

*/

default loglevel      = "warning";

/*

* These are overridden by the Setting every time the START rule is

* invoked.

*/

default SettingClass  = "";

default SettingName   = "";

default ElementClass  = "";

default ElementName   = "";

objectFactory       = object("ICIM_ObjectFactory", "ICIM-ObjectFactory");

topoManager       = object("ICF_TopologyManager", "ICF-TopologyManager");

icimMgrObj          = object("ICIM_Manager", "ICIM-Manager");

pingerObj             = object(getInstances("ICMP_AccessorInterface")[0]);

snmpPollerObj     = object(getInstances("SNMP_AccessorInterface")[0]);

ruleFileName       = this->ReadsRulesFrom->fileName;

DEBUG                 = TRUE;

START {

    .. eol

} do {

    print("************************* SettingClass: " . SettingClass);

    print("*************************  SettingName: " . SettingName);

    print("************************* ElementClass: " . ElementClass);

    print("*************************  ElementName: " . ElementName);

    prnObj = object(ElementClass, ElementName);

    if (prnObj->isNull()) {

        return;

    }

    if (!prnObj->isInstanceOf("Firewall")) {

        return;

    }

  if ( prnObj->Vendor == "FORTINET" ) {

    settingsObj = object(SettingClass, SettingName);

    if (settingsObj->isNull()) {

        return;

    }

    prnAgentObj = prnObj->getSNMPAgent();

    if (prnAgentObj->isNull()) {

        return;

    }

    credentialObj     = create("SNMP_Credentials", "sys-setting-credential-" . string(thread()));

    credentialObj->init();

    prnInstrObj       = prnObj->makeInstrumentation("fw_session_fortinet");

    interval          = settingsObj->PollingInterval;

    timeout           = settingsObj->Timeout / 1000;

    retries           = settingsObj->Retries;

    prnInstrName      = prnInstrObj->Name;

    prnAgentAddress   = prnAgentObj->AgentAddress;

    traceSNMP         = 1;

    prnIndex          = 0;

    pollingParamList  = list(prnInstrName,

                             interval,

                             interval,

                             timeout,

                             retries,

                             traceSNMP);

    icimMgrObj->insertInstrumentation(snmpPollerObj,

                                      prnAgentObj,

                                      prnInstrName,

                                      string(prnIndex),

                                      credentialObj)?  LOG(loglevel), NEXT;

    snmpPollerObj->polling_parameters += pollingParamList? LOG(loglevel),NEXT;

    settingsDriverObj = object("GA_PersistentDriver", "DRV-ICF_ASLSetting-devstat/sys-setting.asl");

    if (settingsDriverObj->isNull()) {

        settingsRuleSet   = object("GA_RuleSet", "RS-ICF_ASLSetting-devstat/sys-setting.asl");

        if (settingsRuleSet->isNull()) {

            settingsRuleSet           = create("GA_RuleSet", "RS-ICF_ASLSetting-devstat/sys-setting.asl");

            settingsRuleSet->fileName = "devstat/sys-setting.asl";

        }

        settingsDriverObj = create("GA_PersistentDriver", "DRV-ICF_ASLSetting-devstat/sys-setting.asl");

        settingsDriverObj->ReadsRulesFrom    = settingsRuleSet;

        settingsDriverObj->waitForCompletion = TRUE;

    }

    gaParameterObj = create("GA_Parameters", "settings-Parameters" . "-" . thread());

    gaParameterObj->insert("SettingClass", SettingClass);

    gaParameterObj->insert("SettingName",  SettingName);

    gaParameterObj->insert("ElementClass", ElementClass);

    gaParameterObj->insert("ElementName",  ElementName);

    if (DEBUG) {

        gaParameterObj->dump();

    }

    settingsDriverObj->startWithParameters(gaParameterObj);

  }

}

You need to sub class ICF_PollingSetting. Something like this (but may need tweaking)

interface Firewall_Session_Setting:ICF_PollingSetting {

    refine DisplayName

    = "Firewall Sessions SNMP Polling";

    refine stored SettingKey

    = "SNMP-SESS";

    refine TargetClass

      = "ICIM_UnitaryComputerSystem";

    refine InstrumentationClass

    = "fw_session";

    refine RuleSet

      = "health/firewall-session-setting.asl";

    refine Type

    = POLLING;

    refine defaults

    definition :

                AnalysisMode                    = ENABLED,

                PollingInterval                 = 240,

                Timeout                         = 700,

                Retries                         = 3;

}

The value of RuleSet should be your ASL for creating the instrumentation and linking to the SNMP accessor. It does not make sense to have a seperate settings file for each vendor, just have one file and create instrumentation based on the value of the vendor attribute.

If you restart your domain with this MODEL then you should have another settings option to apply in the Polling & Thresholds GUI.

Hi Alan,

Thanks for your help.

Actually I forgot something in the post yesterday ( my brain was not working very well ), I did created another instrumentation which inherit from Connectivity_Polling_Setting, not from Class ICF_PollingSetting. The model is similar with what you have provided. ( I tried to change to Class ICF_PollingSetting, but still no luck ).

Now my concerns comes to be the RuleSet, I have enabled the debug switch in the asl, but everything looks fine.

I also used the new tool comes with the latest release called sm_oidInfo.pl, I can see the oid in the fw_session.mdl is polled.

#############################

Discovery,Performance-Probe,Performance-Fortigate-Health-Driver,.1.3.6.1.4.1.12356.101.4.1.5,(discovery/ic-fortigate-health.asl) Discovery of TemperatureSensors VoltageSensors Fans PowerSupplies

Discovery,Performance-Probe,Performance-Fortigate-Health-Driver,.1.3.6.1.4.1.12356.101.4.1.3,(discovery/ic-fortigate-health.asl) Discovery of TemperatureSensors VoltageSensors Fans PowerSupplies

Discovery,VRRPGroup-Probe,VRRP-GROUP-Driver,,

Monitoring,Firewall,fw_session_fortinet,.1.3.6.1.4.1.12356.101.4.1.8,ActiveSessions

Monitoring,IPRoute,IPRoute_Instrumentation_SNMP,.1.3.6.1.2.1.4.21.1.1,ipRouteDest

Monitoring,Interface,Interface_Fault_MIB2,.1.3.6.1.2.1.2.2.1.8,ifOperStatus

##############################

But when I went bit further - dump the snmp accessor data out by using  dmctl

dmctl -s IP-AM-PM exec dmdebug --dumpAccessor=DEVSTAT-SNMP-Poller snmp-poller.log

I can see the following problem for the new created instrumentation:

######################################################

Instance Name: I-fw_session_fortinet-StateOfPlay-FW

Attribute Name: ActiveSessions

Polling Period: 0

Last Polled At: The Epoch

Cached Value:

Last Error: MR-E-NOT-CURRENT_MONITORED-Instrumented attribute ?1? is not currently being monitored by accessor.

######################################################

Any problem you can see so far ?

Thanks,

Hubery

Have you defined any events that use this value? And are you subscribing to those events in SAM?

No, I haven't, I was trying to see the value for the attribute first, then define events.

Do you mean I have to define events and subscribe to them in SAM, otherwise, the value won't be populated ?

Cheers

Added event definition in the model and also create a .import file under /opt/InCharge/IP/smarts/local/conf/icf to subscribe the events.

###########################

GA_SubscriberProfile::PROFILE-default

{

   subscriptions = {

   { "Firewall", ".*", "HighSessionCounts_Cisco", 77879 },

   { "Firewall", ".*", "HighSessionCounts_Fortinet", 77879 }

   }

}

###########################

I've also tried to change the type of the attribute from int to unsigned according to the model document.

But the value is stilling showing "0".

Now I am lost, as I am not sure what is the next steps to troubleshoot.

Again, I will paste my asl code here. this is the RuleSet for the new polling instrumentation

##############################

/*

*  firewall_session_setting.asl

*

*

*/

//default loglevel      = "warning";

default loglevel      = "debug";

/*

* These are overridden by the Setting every time the START rule is

* invoked.

*/

default SettingClass  = "";

default SettingName   = "";

default ElementClass  = "";

default ElementName   = "";

objectFactory       = object("ICIM_ObjectFactory", "ICIM-ObjectFactory");

topoManager       = object("ICF_TopologyManager", "ICF-TopologyManager");

icimMgrObj          = object("ICIM_Manager", "ICIM-Manager");

//pingerObj             = object(getInstances("PingerAccessorInterface")[0]);

pingerObj             = object(getInstances("ICMP_AccessorInterface")[0]);

snmpPollerObj     = object(getInstances("SNMP_AccessorInterface")[0]);

ruleFileName       = this->ReadsRulesFrom->fileName;

DEBUG                 = TRUE;

START {

    .. eol

} do {

    print("************************* SettingClass: " . SettingClass);

    print("*************************  SettingName: " . SettingName);

    print("************************* ElementClass: " . ElementClass);

    print("*************************  ElementName: " . ElementName);

    prnIndex          = "";

    prnObj = object(ElementClass, ElementName);

    if (prnObj->isNull()) {

        return;

    }

    if (!prnObj->isInstanceOf("Firewall")) {

        return;

    }

    settingsObj = object(SettingClass, SettingName);

    if (settingsObj->isNull()) {

        return;

    }

    prnAgentObj = prnObj->getSNMPAgent();

    if (prnAgentObj->isNull()) {

        return;

    }

    credentialObj     = create("SNMP_Credentials", "sys-setting-credential-" . string(thread()));

    credentialObj->init();

//Different vendor using different Insturmentation.  

if ( prnObj->Vendor == "FORTINET" ) {

    prnInstrObj       = prnObj->makeInstrumentation("fw_session_fortinet");

    prnIndex          = 0;

    }

   if ( prnObj->Vendor == "CISCO" ) {

    prnInstrObj       = prnObj->makeInstrumentation("fw_session_cisco");

    }

   if ( prnObj->Vendor == "NETSCREEN" ) {

    prnInstrObj       = prnObj->makeInstrumentation("fw_session_netscreen");

    }

    print("Instrumentation Name is: ".prnInstrObj);

//    prnInstrObj       = prnObj->makeInstrumentation("fw_session");

    interval          = settingsObj->PollingInterval;

    timeout           = settingsObj->Timeout / 1000;

    retries           = settingsObj->Retries;

    prnInstrName      = prnInstrObj->Name;

    prnAgentAddress   = prnAgentObj->AgentAddress;

    traceSNMP         = 1;

//    prnIndex          = 0;

    pollingParamList  = list(prnInstrName,

                             interval,

                             interval,

                             timeout,

                             retries,

                             traceSNMP);

// instanceName oid

    icimMgrObj->insertInstrumentation(snmpPollerObj,

                                      prnAgentObj,

                                      prnInstrName,

                                      string(prnIndex),

                                      credentialObj)?  LOG(loglevel), NEXT;

    snmpPollerObj->polling_parameters += pollingParamList? LOG(loglevel),NEXT;

//add more debug

   if ( DEBUG ) {

   print("snmpPollerObj = ".snmpPollerObj." prnAgentObj = ".prnAgentObj." prnInstrName = ".prnInstrName." prnIndex = ".prnIndex." CredentialObj = ".credentialObj);

   print("Polling Interval=".interval." Timeout=".timeout." Retries=".retries);

   }

    settingsDriverObj = object("GA_PersistentDriver", "DRV-ICF_ASLSetting-devstat/sys-setting.asl");

    if (settingsDriverObj->isNull()) {

        settingsRuleSet   = object("GA_RuleSet", "RS-ICF_ASLSetting-devstat/sys-setting.asl");

        if (settingsRuleSet->isNull()) {

            settingsRuleSet           = create("GA_RuleSet", "RS-ICF_ASLSetting-devstat/sys-setting.asl");

            settingsRuleSet->fileName = "devstat/sys-setting.asl";

        }

        settingsDriverObj = create("GA_PersistentDriver", "DRV-ICF_ASLSetting-devstat/sys-setting.asl");

        settingsDriverObj->ReadsRulesFrom    = settingsRuleSet;

        settingsDriverObj->waitForCompletion = TRUE;

    }

    gaParameterObj = create("GA_Parameters", "settings-Parameters" . "-" . thread());

    gaParameterObj->insert("SettingClass", SettingClass);

    gaParameterObj->insert("SettingName",  SettingName);

    gaParameterObj->insert("ElementClass", ElementClass);

    gaParameterObj->insert("ElementName",  ElementName);

    if (DEBUG) {

        gaParameterObj->dump();

    }

    settingsDriverObj->startWithParameters(gaParameterObj);

}

###############################