SNMP custom commands on Windows

Question

For a while I've monitored UNIX/Linux servers using SNMP. Modifying the snmpd.conf file and adding something like

view systemview included .1.2.3.4.5.6.789
pass .1.2.3.4.5.6.789 /bin/bash /bin/myscript.sh

lets me run custom scripts to SNMP OID's. I have a powershell script in Windows and I need to do the same, how/where do I configure and set this up?

Box is Windows Server 2008 (I think R2)

Answer 1

As far as I know the only method to do what you're looking for would be to implement an SNMP Extension Agent (DLL). There may already be somebody who has implemented an extension agent that would allow you to execute arbitrary commands (as it sounds like a handy thing) but I am not familiar with one.

Microsoft has various docs on developing and installing SNMP Extension Agents. There's a nice, succinct write-up on developing SNMP Extension Agents at CodeProject, too.

An SNMP Extension Agent that allowed for arbitrary definition of commands to execute would certainly be interesting, but I don't have the copious free time to write it.

Answer 2

As mentioned above, I'm not aware of anything that will trigger a script after an SNMP trap has been received - Windows itself doesn't act as a trap receiver unless you install such a daemon on to Windows, it can only really send them.

If you're trying to do something when an Event is registered in the Event Log, you will likely be better off using Windows Server 2008's built-in "Attach Task To This Event.." option which you will see if you right-click on any event in the Event Log.

In order to raise an actual SNMP trap when an Event is logged, look at evntwin.exe or, if you're more comfortable with CLI evntcmd.exe

There are a couple of programs - one I used in the past was What's Up Gold - that can react to SNMP traps received.

If you think I can provide any more information, please come back to me.

-Lewis

EDIT: Maybe something that would be useful for you are Temporary Event Consumers but it essentially requires a script to run continuously and it uses VBScript so you'd need to adapt to PowerShell or adapt your PowerShell script to VBScript. Look at: http://msdn.microsoft.com/en-us/library/aa392396(v=VS.85).aspx

Essentially this script monitors the Event Log but the concept is the same.

sComputer = "."

Set oWMIService = GetObject("winmgmts:{(Security)}!\\" & sComputer & "\root\cimv2")

Set cEvents = oWMIService.ExecNotificationQuery _
   ("SELECT * FROM __InstanceCreationEvent WHERE " _
   & "Targetinstance ISA 'Win32_NTLogEvent'")

Do
Set oEvent = cEvents.NextEvent

    Select Case oEvent.TargetInstance.EventCode
    Case "100"
        Wscript.Echo "Event 100 occurred".
End Select
Loop