Telegraf Starlark Processor - How to fetch value(s) from SNMP Table

1

We use the telegraf SNMP plugin with the starlark processor.

In the telegraf.conf, the [inputs.snmp] section has this measurement from a table:

[[inputs.snmp.table]]
oid = “HOST-RESOURCES-MIB::hrSWRunTable”
#oid = “.1.3.6.1.2.1.25.3.3”
name = “hrSWRunTable_LocalVM”
inherit_tags = [ “hostname” ]
index_as_tag = true

[[inputs.snmp.table.field]]
name = “hrSWRunName”
oid = “HOST-RESOURCES-MIB::hrSWRunName”

We use the starlark processor. We have:

[[processors.starlark]]
source = ‘’’
def apply(metric):
proc_name = metric.fields.get(‘hrSWRunName’)
print (proc_name)
if “proc_name” == ‘telegraf’:
metric.fields[‘telegraf_proc’] = 1
return metric
return metric

The goal is to look up a running process name stored in (hrSWRunName) which is a field in the (hrSWRunTable) table.

The problem is we keep getting proc_name=None, as if (hrSWRunName) is not defined.

The question is, how do we fetch the value stored in the ((hrSWRunName) field ?

Thank you.

2

At first glance, I would say that should actually work.
Are you sure that the desired field actually exists after the input?
To check this: Remove the Starlark plugin and check with --test or with an outputs.file plugin.

3

Good idea…Below is an excerpt of the --test output. Note ‘hrSWRunName’ is an object (OID) of the ‘hrSWRunTable’. It appears that that the "metric.fields.get(‘hrSWRunStatus’) does not quite getting the correct value for this object.

hrSWRunTable_samLab,agent_host=32.68.15.132,hrSWRunIndex=169,index=169 hrSWRunID=“.0.0”,hrSWRunName=“bioset”,hrSWRunStatus=2i,hrSWRunType=2i 1614949205000000000
hrSWRunTable_samLab,agent_host=32.68.15.132,hrSWRunIndex=94,index=94 hrSWRunID=“.0.0”,hrSWRunName=“bioset”,hrSWRunStatus=2i,hrSWRunType=2i 1614949205000000000
hrSWRunTable_samLab,agent_host=32.68.15.132,hrSWRunIndex=2701,index=2701 hrSWRunID=“.0.0”,hrSWRunName=“snmpd”,hrSWRunParameters=“-Lsd -Lf /dev/null -u snmp -g snmp -p /run/snmpd.pid”,hrSWRunPath=“/usr/sbin/snmpd”,hrSWRunStatus=1i,hrSWRunType=4i 1614949205000000000
hrSWRunTable_samLab,agent_host=32.68.15.132,hrSWRunIndex=45,index=45 hrSWRunID=“.0.0”,hrSWRunName=“kworker/7:0H”,hrSWRunStatus=2i,hrSWRunType=2i 1614949205000000000
hrSWRunTable_samLab,agent_host=32.68.15.132,hrSWRunIndex=337,index=337 hrSWRunID=“.0.0”,hrSWRunName=“multipathd”,hrSWRunParameters=“-d -s”,hrSWRunPath=“/sbin/multipathd”,hrSWRunStatus=2i,hrSWRunType=4i 1614949205000000000

4

From the test output I would conclude that hrSWRunName is indeed a field value.
Please post your starlark snippet here properly formatted in a markdown codeblock.

5

[[processors.starlark]]
namepass = [‘SAM Lab’,‘Local VM’]
source = ‘’’
def apply(metric):
proc_name = metric.fields.get(‘hrSWRunName’)
print (proc_name)
if “proc_name” == “telegraf”:
metric.fields[‘telegraf_proc’] = 1
return metric
return metric
‘’’
( attached is the screen capture if the post alters the indentation )

image

Below is an exerpt from telegraf debug output:

2021-03-05T13:38:05Z D! [inputs.snmp] executing “snmptranslate” “-Td” “-Ob” “UCD-SNMP-MIB::memCached.0”
2021-03-05T13:38:05Z D! [processors.starlark] None
2021-03-05T13:38:05Z D! [sarama] producer/broker/1 starting up
2021-03-05T13:38:05Z D! [sarama] producer/broker/1 state change to [open] on m5lab_telegraf/2
2021-03-05T13:38:05Z D! [sarama] producer/broker/2 starting up
2021-03-05T13:38:05Z D! [sarama] producer/broker/2 state change to [open] on m5lab_telegraf/3
2021-03-05T13:38:05Z D! [sarama] producer/broker/2 state change to [open] on m5lab_telegraf/0
2021-03-05T13:38:05Z D! [sarama] producer/broker/0 starting up
2021-03-05T13:38:05Z D! [sarama] producer/broker/0 state change to [open] on m5lab_telegraf/1
2021-03-05T13:38:05Z D! [outputs.influxdb] Wrote batch of 179 metrics in 32.864254ms
2021-03-05T13:38:05Z D! [outputs.influxdb] Buffer fullness: 0 / 10000 metrics
2021-03-05T13:38:06Z D! [outputs.kafka] Wrote batch of 179 metrics in 604.390042ms
2021-03-05T13:38:06Z D! [outputs.kafka] Buffer fullness: 0 / 10000 metrics
2021-03-05T13:38:06Z D! [processors.starlark] None
2021-03-05T13:38:07Z D! [processors.starlark] None
2021-03-05T13:38:07Z D! [processors.starlark] None

6

I suspect that namepass is the problem, the starlark processor gets nothing at all because this pattern is not correct:

namepass = ['SAM Lab','Local VM']

In my opinion, it should look like this:

namepass = ['hrSWRunTable_samLab']

Here is the documentation on measurement filtering:

namepass filters by measurement - not the tags or fields

BTW:

So you can post code snippets properly formatted in the forum:

```toml
put you config code snippet here
```
7

I wrote your --test output to a file snmp.log and this works as an example:

[[inputs.file]]  # only for debugging
  files = ["snmp.log"]
  data_format = "influx"

[[processors.starlark]]
  namepass = ["hrSWRunTable_samLab"]
  source = '''
def apply(metric):
  proc_name = metric.fields.get("hrSWRunName")
  if proc_name == "snmpd":
    metric.fields["telegraf_proc"] = 1
  return metric
'''

[[outputs.file]]  # only for debugging
  files = ["snmp.out"]
  influx_sort_fields = true
8

Yes. Setting the filter below works:
namepass = [“hrSWRunTable_samLab”]

The is because we name the table in:
[[inputs.snmp.table]]
oid = “HOST-RESOURCES-MIB::hrSWRunTable”
#oid = “.1.3.6.1.2.1.25.3.3”
name = “hrSWRunTable_samLab” <=====
inherit_tags = [ “hostname” ]
index_as_tag = true

Now I have better understanding how the filter works.

Thank you so much for your speedy help and solution.