Multiple modules with multiple auths

[mariachini]

I recently encountered a rather unusual problem, namely how to use snmp_exporter to handle different modules that require different levels of authentication (v2+v3).
Below is the solution I used in my environment.

devices.yml - in this file I keep a list of devices in a specific form:

###################################################################################
# HERE ARE DEFINED ALL TARGETS THAT SHOULD BE MONITORED BY snmp_exporter          #
# THE STRUCTURE OF THIS TEMPLATE IS DESCRIBED IN THE LINE BELOW                   #
# <DEVICE_IP>:_:<NAME>:_:<MODULE>:_:<AUTH>                                        #
###################################################################################
- targets:

  # ESXi servers
  - 1.1.1.2:_:ServerA:_:sc2:_:public_v2

    # Access swicthes
  - 2.2.2.3:_:SWA:_:SNMPv3:_:public_v3

snmp_sc2.yml - in this file I keep generated things for servers that use public_v2 auth method

auths:
  public_v2:
    community: public
    version: 2
modules:
  sc2:
    walk:
    - 1.3.6.1.2.1.2.2.1.1
    - 1.3.6.1.2.1.2.2.1.10
    - 1.3.6.1.2.1.2.2.1.14
    [...]

snmp_switches.yml - in this file I keep generated things for switches that use public_v3 auth method

auths:
  public_v3:
    version: 3
    security_level: authPriv
    username: admin
    password: Pa$$w0rd
    auth_protocol: SHA
    priv_protocol: AES
    priv_password: SuperPa$$w0rd
modules:
  SNMPv3:
    walk:
    - 1.3.6.1.2.1.2.2.1.1
    - 1.3.6.1.2.1.2.2.1.10
    [...]

Now it's time to use relabeling option in prometheus.yml:

  - job_name: 'SNMP Devices' # snmp_exporter
    metrics_path: /snmp
    file_sd_configs:
            - files:
              - /etc/prometheus/snmp_exporter/devices.yml

    relabel_configs:
            - source_labels: [__address__]
              regex: '(.*):_:.*:_:.*:_:.*'
              target_label: instance
            - source_labels: [__address__]
              regex: '.*:_:(.*):_:.*:_:.*'
              target_label: name
            - source_labels: [__address__]
              regex: '.*:_:.*:_:(.*):_:.*'
              target_label: module
            - source_labels: [__address__]
              regex: '.*:_:.*:_:.*:_:(.*)'
              target_label: auth
            - source_labels: [module]
              target_label: __param_module
            - source_labels: [instance]
              target_label: __param_target
            - source_labels: [auth]
              target_label: __param_auth
            - target_label: __address__
              replacement: 10.10.10.10:9116

In the above configuration, Prometheus refers to the devices.yml file where the entries have their own specific structure. Thanks to relabeling, each entry, depending on the module, uses either v2 or v3 authentication.
Now all you need to do is run snmp_exporter and as a parameter --config.file you should specify the path to the mask files, e.g. --config.file=/etc/prometheus/snmp_exporter/snmp_*.yml

I hope this helps someone :)

[SuperQ]

The other way to format this is to have multiple groups within your devices.yml target list.

- targets:
  # ESXi servers
  labels:
    auth: public_v2
    module: sc2
  - 1.1.1.2;ServerA
- targets:
  # Access swicthes
  labels:
    auth: public_v3
    module: SNMPv3
  - 2.2.2.3;SWA

This would also simplify the relabel configs, as ; is a less complex regexp match. As well as having fewer required matching issues.

    relabel_configs:
      - source_labels: [__address__]
        regex: '(.*);.*
        target_label: instance
      - source_labels: [__address__]
        regex: '.*;(.*)
        target_label: name
      - source_labels: [auth]
        target_label: __param_auth
      - source_labels: [module]
        target_label: __param_module
      - source_labels: [instance]
        target_label: __param_target
      - target_label: __address__
        replacement: 10.10.10.10:9116

[mariachini]

From what I noticed, one thing you wrote incorrectly. In the devices.yml file, the labels section should be after the targets, otherwise there will be problems with labeling.