Next Previous Contents

18. SNMP

Contributors: Mark Visser.

18.1 Does Squid support SNMP?

True SNMP support is available in squid 2 and above. A significant change in the implimentation occured starting with the development 2.2 code. Therefore there are two sets of instructions on how to configure SNMP in squid, please make sure that you follow the correct one.

You can use Matija Grabnar's mrtg-for-squid package to monitor Squid-1.1 and earlier versions with MRTG.

18.2 Enabling SNMP in Squid

To use SNMP, it must first be enabled with the configure script, and squid rebuilt:

        ./configure --enable-snmp  [ ... other configure options ]
Next, recompile after cleaning the sourse tree :
        make clean
        make all
        make install
Once the compile is completed and the new binary is installed the squid.conf file needs to be configured to allow access; the default is to deny all requests. The instructions on how to do this have been broken into two parts, the first for all versions of Squid from 2.2 onwards and the second for 2.1 and below.

18.3 Configuring Squid 2.2

To configure SNMP first specify a list of communities that you would like to allow access by using a standard acl of the form:

        acl aclname snmp_community string 
For example:
        acl snmppublic snmp_community public
        acl snmpjoebloggs snmp_community joebloggs
This creates two acl's, with two different communities, public and joebloggs. You can name the acl's and the community strings anything that you like.

To specify the port that the agent will listen on modify the "snmp_port" parameter, it is defaulted to 3401. The port that the agent will forward requests that can not be furfilled by this agent to is set by "forward_snmpd_port" it is defaulted to off. It must be configured for this to work. Remember that as the requests will be originating from this agent you will need to make sure that you configure your access to accordingly.

To allow access to Squid's SNMP agent, define an snmp_access ACL with the community strings that you previously defined. For example:

        snmp_access allow public localhost
        snmp_access deny all
If you do not define any snmp_access ACLsnmp_access ACL's, then SNMP access is denied by default.

Finally squid allows to you to configure the address that the agent will bind to for incomming and outgoing traffic. These are defaulted to 0.0.0.0:

        snmp_incoming_address 0.0.0.0
        snmp_outgoing_address 0.0.0.0

18.4 Configuring Squid 2.1

A sort of default, working configuration is:

        snmp_port 3401
        snmp_mib_path /local/squid/etc/mib.txt

        snmp_agent_conf view all .1.3.6 included
        snmp_agent_conf view squid .1.3.6 included
        snmp_agent_conf user squid - all all public
        snmp_agent_conf user all all all all  squid
        snmp_agent_conf community public squid squid
        snmp_agent_conf community readwrite all all

Note that for security you are advised to restrict SNMP access to your caches. You can do this easily as follows:

        acl snmpmanagementhosts 1.2.3.4/255.255.255.255 1.2.3.0/255.255.255.0
        snmp_acl public deny all !snmpmanagementhosts
        snmp_acl readwrite deny all
You must follow these instructions for 2.1 and below exactly or you are likely to have problems. The parser has some issues which have been corrected in 2.2.

18.5 Is there a standard SNMP MIB for Web Caches?

No, not at the moment. We have a Cache SNMP mailing list intended to foster discussion on this subject. A draft of a possible proxy mib has been developed as is available for comment.

The MIB we use for Squid is evolving as well. The sixth draft of Squid's MIB is currently being implemented (Last update 1/1/99).

18.6 How can I query the Squid SNMP Agent

You can test if your Squid supports SNMP with the snmpwalk program (snmpwalk is a part of the UCD-SNMP project). Note that you have to specify the SNMP port, which in Squid defaults to 3401.

        snmpwalk -p 3401 hostname communitystring .1.3.6.1.4.1.3495.1.1
If it gives output like:
        enterprises.nlanr.squid.cacheSystem.cacheSysVMsize = 7970816
        enterprises.nlanr.squid.cacheSystem.cacheSysStorage = 2796142
        enterprises.nlanr.squid.cacheSystem.cacheUptime = Timeticks: (766299) 2:07:42.99
then it is working ok, and you should be able to make nice statistics out of it. For programs you can use to monitor your cache with, see below.

For an explanation of what every string (OID) does, you should read the Squid MIB.

18.7 How can I use SNMP with Squid?

MRTG

We use MRTG to query Squid through its SNMP interface.

To use MRTG with Squid there are two major changes, make sure that you specify the port number in the target configuration keyword. As well MRTG attempts to access objects from the system group. As Squid does not implement that group MRTG will fail. To prevent this you should configure MRTG to get these items from you hosts SNMP agent.

scotty/tkined

We have also had good luck with scotty.

Other related sources

18.8 What can I use SNMP and Squid for?

There are a lot of things you can do with SNMP and Squid. It can be useful in some extent for a longer term overview of how your proxy is doing. It can also be used as a problem solver. For example: how is it going with your filedescriptor usage? or how much does your LRU vary along a day. Things you can't monitor very well normally, aside from clicking at the cachemgr frequently. Why not let MRTG do it for you?

18.9 Where can I get more information/discussion about Squid and SNMP?

General Discussion: cache-snmp@ircache.net These messages are archived.

Subscriptions should be sent to: cache-snmp-request@ircache.net.


Next Previous Contents