NetXMS Forum

I have Netxms 3.8 installed on Debian 10.  On a separate machine, I have MariaDB 10.5 installed on Debian 10. (I used DEBs from MariaDB repo)  I'd like to force TLS between NetXMS Server & MariaDB Server.  I have MariaDB setup with SSL enabled:

MariaDB [(none)]> show global variables like '%ssl%';
+---------------------+--------------------------------+
| Variable_name       | Value                          |
+---------------------+--------------------------------+
| have_openssl        | YES                            |
| have_ssl            | YES                            |
| ssl_ca              | /etc/mysql/ssl/ca.pem          |
| ssl_capath          |                                |
| ssl_cert            | /etc/mysql/ssl/server-cert.pem |
| ssl_cipher          |                                |
| ssl_crl             |                                |
| ssl_crlpath         |                                |
| ssl_key             | /etc/mysql/ssl/server-key.pem  |
| version_ssl_library | OpenSSL 1.1.1d  10 Sep 2019    |
+---------------------+--------------------------------+

and created the database and user:

MariaDB [(none)]> show grants for [email protected];
+---------------------------------------------------------------------+
| Grants for [email protected]                                   |
+---------------------------------------------------------------------+
| GRANT USAGE ON *.* TO `netxms`@`netxms.mgmt.lan` REQUIRE X509       |
| GRANT ALL PRIVILEGES ON `db_netxms`.* TO `netxms`@`netxms.mgmt.lan` |
+---------------------------------------------------------------------+

Here is my NetXMS configuration:

## Logging
# Log file name
LogFile=/var/log/netxmsd

# Increase logging verbosity, 0 (only errors) to 9 (verbose debug)
DebugLevel=0

## Database configuration.
DBDriver=mariadb.ddr
DBServer=mariadb.mgmt.lan
DBName=db_netxms
DBLogin=netxms
DBPassword=

But I can't seem to get a connection working.  NXDBMGR INIT tells me Access denied, probably because it's not presenting the X509 cert & key to MariaDB. Where do I drop my user cert & key in NetXMS, and how do I configure mariadb driver to use X509?

This is slightly off topic, so I can create new post if you like.  Is there a way to change the DCI status to Disabled during Instance Discovery?  I've tried the following in a Template DCI instance discovery, but it doesn't work:

snmp = CreateSNMPTransport($node);
if (snmp == null)
	$dci->status = 1;
oid = ".1.3.6.1.2.1.2.2.1.8." . $1;
ifOper = SNMPGetValue(snmp, oid);
if ( ifOper != 1 )
	$dci->status = 1; }
return %(true, $1, $2);

This is supposed to check ifOper status and disable the DCI of the status is not UP.

Thanks Victor.  That seems to work.  The transformation script in the Node DCI is the same as in the Template DCI.  How does $dci->instance work exactly?  Is there documentation of this feature anywhere?

Again, thanks for your help!!

Is there a way to insert the {instance-name} into a transformation script?  I have a Dummy DCI, "Total traffic on {instance-name} (bits/sec)" that sums 2 other DCIs and returns sum.  I'd like to apply this DCI via templates.

Template DCI transformation script:

In = GetDCIValue($node, FindDCIByDescription($node, "Inbound traffic on " . {instance-name} . " (bits/sec)"));
Out = GetDCIValue($node, FindDCIByDescription($node, "Outbound traffic on " . {instance-name} . " (bits/sec)"));
if ( In == null && Out == null )
	return 0;
if ( In == null && Out != null )
	return Out;
if ( In != null && Out == null )
	return In;
return In + Out;

Template DCI Instance Discovery:
SNMP Walk - OIDs
Base SNMP OID:  .1.3.6.1.2.1.31.1.1.1.1
Filter script:return %(true, $1, $2);

I've tried replacing {instance-name} with $2 but no luck.  Any help is appreciated.

This worked for me:

return $node->sysDescription like "HP*Switch*";

You can replace sysDescription with other node attributes:
https://wiki.netxms.org/wiki/NXSL:Node

It's an indirect SNMP call, but I thought it might help.

Create the script in the Script Library.

Open the DCI in the template and go to Instance Discovery.
Instance discovery method = Script
Next line = name of script in Script Library
Instance discovery filter script should be left blank.  Your script will be called from the Script Library as long you entered the script name in the line above.

Force an instance discovery poll to see if it works.

Thank you very much for your help!  That worked perfectly.  I never would've figured out that script

OK, one of the things I'm trying to do is collect bandwidth consumption from Windows hosts and servers running NetXMS Agent.

Here's what I have:
A template named "Agents" with Automatic Apply script as

return $node->isAgent;

Template "Agents" contain multiple DCIs.  I have 2 specific DCIs:

Number of input bytes on interface {instance}
Number of output bytes on interface {instance}

with source being "NetXMS Agent"; data type "UnsignedInt64"; and parameters as follows:

Net.Interface.BytesIn64({instance})
Net.Interface.BytesOut64({instance})

The "Instance Discovery" page is where I think I'm getting something wrong.  For both DCIs, I have "Agent List" as discovery method and List Name is "Net.InterfaceList".  This list returns the ifIndex, IP Address, ifType, MAC Address, and ifDesc.
I'd like to transform the list results so that only ifIndex is returned to {instance}, but I have no idea how to do that.  Is this even possible using Templates?

P.S.  I'd also like to perform similar action with FileSystem.FreeSpace%, etc...

Is it possible to use Instance Discovery within a DCI configured to a Template?  I've tried to configure this according to youTube videos and instructions on the Wiki, but it seems the DCIs never get created on the actual node after applying Template when using Instance Discovery.

I'm running 1.2.12 on Windows 2008 with SQL 2008.  Any help would be appreciated.

OK, maybe I should clarify a little bit.  The IP address that is bound to the X0 (LAN) port on my TZ210 does not change.  It is always 192.168.1.99.  It is only within NetXMS that shows the primary IP address as something from the Static IP pool for SSLVPN clients.  The actual IP address on the device never changes.  I can always pull up a web browser and administer the TZ210.  But, within NetXMS, after the node's Primary IP address is changed from 192.168.1.99 to an IP from the static pool, NetXMS shows the node as "DOWN" and none of the DCI's work, presumably because NetXMS is trying to communicate via an IP address from within the static pool, and not the IP that is bound to the X0 port.

What is the mechanism used to determine a nodes Primary IP Address?  Also, what polling occurs at regular intervals?

I vaguely remember creating a VPN Connector in the older versions of NetXMS, but I cannot find it anywhere in version 1.2.3  Can someone point me in the right direction?  I have a VPN router running IPSec VPN site-to-site tunnels connecting a branch office and the owner's home network.  I have all those nodes in NetXMS, but cannot figure out how to create the VPN connectors.  Any help is appreciated.  Thanks!

Alex, Victor,

Any ideas why the Primary IP Address of my SonicWall TZ210 gets changed from the LAN IP to an IP address from the VPN static pool?  I can provide SNMP-walks if need be.  I just don't know where to start or what to look for.  Any help would be appreciated.  Thanks again!!

Well, no such luck.  I disabled all my VPN and SSLVPN policies and the primary IP address continues to change to an IP address from the SSLVPN IP pool.  Other suggestions welcome.

Disabling network discovery polling had no effect.  The primary IP address of the SonicWall changed after a few minutes.

millerpaint,
I haven't tried that approach yet.  I will have to schedule downtime or try it late night this weekend.  Thanks for the idea.  I will post back.

Still trying to figure this one out.  The arp cache on NetXMS server maps the correct MAC address to the SonicWall's IP address on my LAN.  I've tried disabling status polling, configuration polling, routing table polling, and topology polling, each one at a time.  For some reason, the IP address still gets changed at random.  After disabling the various polls, the only one left is Network Discovery polling.  I just manually set the IP address and ran a configuration poll.  All the interfaces are back and DCIs are collecting data.  I'm going to disable network discovery polling for this node only and see if the IP address still changes at random.  I will post my results back.

Again, any help would be appreciated.  Thanks!

I have NetXMS 1.2.3 setup on Windows 2008 R2 64-bit.  One of my nodes is a SonicWall TZ210.  Firmware is SonicOS Enhanced 5.8.1.8-57o.  This firewall is the default gateway for all my servers, with custom NATs for my hosted services.  It is also configured for SSLVPN Access.  SonicWall TZ210 IP address is 192.168.1.99.  When SSLVPN client connects to SSLVPN router, the client gets an IP address from a static pool configured within the TZ210.  (FYI, I have DHCP on my domain controller configured to issue 192.168.1.100-200.  SSLVPN static pool is 192.168.1.201-215)

At random times (I believe during configuration polling...?), an alarm is generated saying that SonicWall TZ210 node is down.  When I check the node in NetXMS console, I notice the Primary IP Address has changed.  The IP address is different sometimes, but it's always within the static pool for SSLVPN clients.  After the Primary IP address changes, none of the details or DCIs are available.  I can go into Node Properties and manually change the IP address back to 192.168.1.99, then run a Configuration Poll and everything is back to normal.  Then, at some point, the IP address will change back to an IP within the SSLVPN static pool.

So, my question is kind of loaded, but how can I troubleshoot this?  I'm not sure if it's something in the SonicWall or NetXMS.  Any help is appreciated.  Thanks in advance!!

Is there documentation anywhere that details the NetXMS agent and sub-agent parameters?  I'm currently trying to differentiate between System.CPU.Usage and System.CPU.LoadAvg from NetXMS Agent 1.2.3 on Windows 2008 R2 x64.

I'm sure there are many in the community who would like to have a table with specific descriptions of each NetXMS Agent parameter.  Maybe it's already documented and I'm just not paying close enough attention.  If anyone knows, please post a link.  Thanks!

Hello.  I'm wondering if it's currently supported to install NetXMS agent on Mac OS.  I have a customer with an Apple environment, all clients and servers are using Mac OS.  This customer only calls me when he believes his switches, routers, or firewall are giving him problems.  I'm not very familiar with Mac OS, but my customer is.  Is there a way I can install NetXMS agent on my customer's Mac servers so I can monitor performance?  If NetXMS agent cannot be installed on Mac OS, does the server operating system have a SNMP agent that can be installed/enabled?  Any help would be greatly appreciated!!  Thank you.

Is this syntax correct?  I've manually ran configuration polls, but nodes aren't binding.  We have 5 IP cameras and Video server.  I created a Container in "Infrastructure Services" named "Camera" and configured Automatic Bind Rules with the following script:

sub main()
{
	return $node->ipAddr == "10.0.0.18" ||
	return $node->ipAddr == "10.0.0.92" ||
	return $node->ipAddr == "10.0.0.93" ||
	return $node->ipAddr == "10.0.0.94" ||
	return $node->ipAddr == "10.0.0.96" ||
	return $node->ipAddr == "10.0.0.97";
}

The cameras are configured with static IPs listed above, except for 10.0.0.18, that is our video server, also configured with static IPs.  I just want to container to autobind based on the IP address of the node, as opposed to manually right-clicking the node, selecting "Bind" and navigating the hierarchy tree.  Am I doing this correctly?

It's ironic you would mention that.  I installed 1.1.7 on my workstation with MS SQL 2008 Express and started to monitor the Cisco WAP200's we have throughout our business.  I actually did this earlier this week and was going to mention it in my original post, but I didn't want to confuse the issue any further.  So, after running 1.1.7 for about 4 days now, I think I can safely say that 1.1.7 is NOT behaving the same way as 1.0.13.  When polling for Interfaces, the access points have the correct number of RA interfaces, and there are no wierd subnets.

I'm wondering if I should just move to version 1.1.7.  I've considered it previously, but I've always been relunctant to introduce beta or development versions into my production environment.  I would like to keep both version running, but alot of my SNMP devices only allow for a single, trusted SNMP manager.

Anyway, let me know if you would like any more information.