Sandblast Threat Emulation SNMP

[morris]

Hi there,

we want to check the Pending emulating requests (Output of tecli show emu emu) with SNMP

I've compared the output of two snmp walks (one while no Pending emulating requests and one with more than 30 Pending emulating requests). But the outpot of both walks was the same.

https://community.checkpoint.com/t5/SandBlast-Network/Using-SNMP-with-SandBlast-Network/td-p/40637

tecli show emu emu 

Pending emulating requests: 31
Running virtual machines: 4
Number of emulated files: 24

Has anyone any idea how to check that value or has another idea what OID could be checked get similar information?

Best regards,
Morris

[PhoneBoy]

You can extend SNMP as you wish: https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solut...

[morris]

Basically if I snmpwalk I get these results:

[Expert@cpsandblast:0]# snmpwalk -v 2c -c xxx localhost .1.3.6.1.4.1.2620.1.49
SNMPv2-SMI::enterprises.2620.1.49.3.0 = STRING: "100%"
SNMPv2-SMI::enterprises.2620.1.49.4.1.0 = Gauge32: 20708
SNMPv2-SMI::enterprises.2620.1.49.4.2.0 = Gauge32: 356
SNMPv2-SMI::enterprises.2620.1.49.4.3.0 = Gauge32: 2767
SNMPv2-SMI::enterprises.2620.1.49.4.4.0 = Gauge32: 13446
SNMPv2-SMI::enterprises.2620.1.49.5.1.0 = Gauge32: 0
SNMPv2-SMI::enterprises.2620.1.49.5.2.0 = Gauge32: 0
SNMPv2-SMI::enterprises.2620.1.49.5.3.0 = Gauge32: 0
SNMPv2-SMI::enterprises.2620.1.49.5.4.0 = Gauge32: 0
SNMPv2-SMI::enterprises.2620.1.49.6.1.0 = Gauge32: 0
SNMPv2-SMI::enterprises.2620.1.49.6.2.0 = Gauge32: 0
SNMPv2-SMI::enterprises.2620.1.49.6.3.0 = Gauge32: 0
SNMPv2-SMI::enterprises.2620.1.49.6.4.0 = Gauge32: 0
SNMPv2-SMI::enterprises.2620.1.49.7.1.0 = Gauge32: 0
SNMPv2-SMI::enterprises.2620.1.49.7.2.0 = Gauge32: 0
SNMPv2-SMI::enterprises.2620.1.49.7.3.0 = Gauge32: 0
SNMPv2-SMI::enterprises.2620.1.49.7.4.0 = Gauge32: 0
SNMPv2-SMI::enterprises.2620.1.49.8.1.0 = Gauge32: 79
SNMPv2-SMI::enterprises.2620.1.49.8.2.0 = Gauge32: 113
SNMPv2-SMI::enterprises.2620.1.49.8.3.0 = Gauge32: 66
SNMPv2-SMI::enterprises.2620.1.49.8.4.0 = Gauge32: 69
SNMPv2-SMI::enterprises.2620.1.49.9.1.0 = Gauge32: 124126
SNMPv2-SMI::enterprises.2620.1.49.9.2.0 = Gauge32: 385518
SNMPv2-SMI::enterprises.2620.1.49.9.3.0 = Gauge32: 388842
SNMPv2-SMI::enterprises.2620.1.49.9.4.0 = Gauge32: 457460
SNMPv2-SMI::enterprises.2620.1.49.10.1.0 = Gauge32: 0
SNMPv2-SMI::enterprises.2620.1.49.10.2.0 = Gauge32: 0
SNMPv2-SMI::enterprises.2620.1.49.10.3.0 = Gauge32: 0
SNMPv2-SMI::enterprises.2620.1.49.10.4.0 = Gauge32: 0
SNMPv2-SMI::enterprises.2620.1.49.11.1.0 = Gauge32: 102
SNMPv2-SMI::enterprises.2620.1.49.11.2.0 = Gauge32: 20
SNMPv2-SMI::enterprises.2620.1.49.11.3.0 = Gauge32: 23
SNMPv2-SMI::enterprises.2620.1.49.11.4.0 = Gauge32: 21
SNMPv2-SMI::enterprises.2620.1.49.12.0 = Gauge32: 2
SNMPv2-SMI::enterprises.2620.1.49.13.0 = Gauge32: 0
SNMPv2-SMI::enterprises.2620.1.49.14.0 = Gauge32: 0
SNMPv2-SMI::enterprises.2620.1.49.15.0 = Gauge32: 5
SNMPv2-SMI::enterprises.2620.1.49.16.0 = STRING: "up-to-date"
SNMPv2-SMI::enterprises.2620.1.49.17.0 = STRING: "Gateway is up to date."
SNMPv2-SMI::enterprises.2620.1.49.19.0 = STRING: "temu_local"
SNMPv2-SMI::enterprises.2620.1.49.20.0 = STRING: "1735559812"
SNMPv2-SMI::enterprises.2620.1.49.21.0 = Gauge32: 0
SNMPv2-SMI::enterprises.2620.1.49.22.0 = Gauge32: 0
SNMPv2-SMI::enterprises.2620.1.49.23.0 = Gauge32: 0
SNMPv2-SMI::enterprises.2620.1.49.24.0 = Gauge32: 4
SNMPv2-SMI::enterprises.2620.1.49.25.0 = STRING: "valid"
SNMPv2-SMI::enterprises.2620.1.49.26.0 = STRING: "ok"
SNMPv2-SMI::enterprises.2620.1.49.27.0 = STRING: "Subscription is up to date"
SNMPv2-SMI::enterprises.2620.1.49.28.0 = STRING: "Cloud emulation is not used"
SNMPv2-SMI::enterprises.2620.1.49.29.0 = Gauge32: 60
SNMPv2-SMI::enterprises.2620.1.49.30.0 = Gauge32: 990000400
SNMPv2-SMI::enterprises.2620.1.49.31.0 = STRING: "N/A"
SNMPv2-SMI::enterprises.2620.1.49.32.0 = Gauge32: 0
SNMPv2-SMI::enterprises.2620.1.49.33.0 = Gauge32: 0
SNMPv2-SMI::enterprises.2620.1.49.34.0 = Gauge32: 0
SNMPv2-SMI::enterprises.2620.1.49.35.0 = Gauge32: 0
SNMPv2-SMI::enterprises.2620.1.49.36.0 = Gauge32: 0
SNMPv2-SMI::enterprises.2620.1.49.37.0 = Gauge32: 0
SNMPv2-SMI::enterprises.2620.1.49.38.0 = Gauge32: 0
SNMPv2-SMI::enterprises.2620.1.49.39.0 = Gauge32: 0
SNMPv2-SMI::enterprises.2620.1.49.40.0 = Gauge32: 0
SNMPv2-SMI::enterprises.2620.1.49.41.0 = Gauge32: 0
SNMPv2-SMI::enterprises.2620.1.49.101.0 = Gauge32: 0
SNMPv2-SMI::enterprises.2620.1.49.102.0 = STRING: "ok"
SNMPv2-SMI::enterprises.2620.1.49.103.0 = ""

In chkpnt.mib I only see a handful of values

Is there anywhere a extended documentation?

[PhoneBoy]

What I'm saying is that this is not something that can be polled via SNMP by default.
You can extend the MIB to support your requirement: https://support.checkpoint.com/results/sk/sk90860 

[Forsaken_61]

I'm having the same question. Did you managed to fix this?