I'm having a heck of a time finding any resources that can help me learn the basics of creating custom probes. I'm completely unfamiliar with the code the dude uses to do functions/probes. Since I can't find any tutorials or a reference of keywords and abilities I have nowhere to start. Could anyone point me in the right direction? I'd just like to start with something simple like manipulate/create probes that monitor latency. Or even monitor opsf routes. Normal WISP stuff. Thanks for any help you can provide.

BUMP

Here is a not so quick guide to probes...
New WIKI page for Getting started with functions and probes
http://wiki.mikrotik.com/wiki/Getting_s ... and_probes

The below post is superseded by the wiki...and is full of errors so go to the wiki.
The Dude can easily be called "an SNMP poller". SNMP allows the dude to read a value from a device.

So you will need to SNMPwalk the devices to find OIDs and values you are interested in reporting on.
SNMPwalk can be found in the tools menu. This requires that you have a working SNMP setup.
If you don't have SNMP working SNMPwalk will fail to read any values. Right click on a device and SNMPwalk it, are values returned, if not go to the settings menu and set up SNMP.

If you don't know SNMP the basic idea is you put a "string" on the device you are trying to access. The default is "public" for read only. You should access the device and set it so that it uses something else like "snmpreadonly", just anything besides "public". You can also set access rules on most devices to allow read from a specific IP. Put the same string in the SNMP settings in The Dude. With the same string on both the dude and the device the dude should be able to read the Management Information Base (MIB). Each entry is called an Object Identifier (OID).

If you know the exact OID that you are interested in you can place it in the "OID field" of SNMPwalk, click stop then start.
To understand more about OIDs place a portion of the OID you are interested in in the OID field of snmpwalk.
i.e. 1.3.6.1.2.1.1.1 then try 1.3.6.1.2.1.1 then try 1.3.6.1.2.1
Click stop and start each time, notice more and more of the MIB is displayed.

There is nothing I have found that is a programmers guide for dude code but it is simple enough.
"if, and, or, not, rand, rate, round, array_size" are some of the functions provided.
To understand a function open the function panel and read the description.

The function for "OID" has the following description "returns value of given snmp OID. Only first parameter mandatory. First parameter - oid string, second - cache time - default 5 seconds (5.0), third - negative cache time - default 5 minutes (300.0), forth - ip address (overrides context device), fifth - snmp profile (overrides context device)"

So to use "OID" in a function I need to specifiy only the first parameter. So now I want to display uptime on the label of a device.
Right click on the device click appearance, in the label box click the drop down arrow on the right, this will display the default label configured in the main settings under device appearance. If I put the following on the appearance of a single device it will only be on that one device. If I put it on the appearance of the main map configuration page under settings it will be placed on every device.
uptime: [oid("1.3.6.1.2.1.1.3.0")] <--- place that on the label of a single device.

Ok so now you see the uptime of that device on the device label. The point to doing this is you can verify the value that is returned by an OID by using it on a label before you use it in a probe. Also notice that you can specify cache time and negative cache time. If you are polling every 30 seconds the default negative cache time is 300 seconds so there is a chance for false positives and they won't clear for at least 4:30. The fix to this is to specify a negative cache time one second less than the retry interval.
So oid("1.3.6.1.4.1.9.2.1.57.0", 10, 29) Will read the oid and cache it for 10 seconds(instead of the default 5) If it fails to read the value it will remember that it failed to read the value for 29 seconds. (I am using default polling of 30 seconds).

When you read an OID from a system The Dude sends a packet asking for that value and then displays the result. So care should be taken how often and how many probes you install. Putting too many probes on a device can run the CPU up. Also the size of data you are requesting from a device can affect performance as well. Don't try something like array_find(oid("1.3.6"),"stuff") that will request almost the entire MIB and if you are doing that every 30 seconds well the system is spending a lot of time reading the MIB. Create probes that are very narrow focus on just a few OIDs or only one OID.

So now lets look at a building a probe based off an OID and then graph the values. The 1 minute Cisco CPU average, [oid("1.3.6.1.4.1.9.2.1.57.0")] If you have a Cisco device place that on the appearance of the device or use SNMPwalk and the Internet to find the OID for some value that you are interested in making a probe for. Place the OID on the label and verify that you have a value that you expect.
value: [oid("1.3.6.1.2.1.1.1.0")]

As long as the value you are interested in appears on the label proceed, if not, figure out what is wrong. Usually it is a typo or the oid needs a .0 at the end or a missing bracket, quote or parentheses.

The next step is to create a probe, open the probe panel, click +, give it a type of function and leave agent default, that is the server that is going to actually do the request.

[Available line]
I believe it is best to use a function to resolve available. There is an issue with using the OID directly in the available line, the issue is it sometimes will not return false and the probe will install on devices that do not have those OIDs. You can use the OID directly but you will have to test the probe to determine if available is resolving correctly.

In the available line place the OID minus the last 0, oid("1.3.6.1.4.1.9.2.1.57") also you don't need brackets in a probe, only on a label. The available line reads the MIB and determine if that OID is actually on the device. So you don't want the value, you just want to make sure the OID exists. Also I have seen where having the whole OID in the Available line causes the probe to not graph even though there is no error with the probe. BUT BUT There are oids where you have to specify the entire OID in the available line, you will have to do some testing.

Or build a function that reads the OID and place that function in the available line.
Function - name "Cisco_CPU_a"
if(array_size(oid_column("1.3.6.1.4.1.9.2.1.57", 10 ,29)), oid("1.3.6.1.4.1.9.2.1.57.0", 10, 29)+1 ,"False")
On the Available line on the probe you can check for False.
Cisco_CPU_a() <> "False"

[Error line]
On the error line is where all the work is done, it will be in the format of - if (oid(""), "","failed")
The description of "if" is "first parameter - condition, second - returned if condition yields logical true, third - returned otherwise" and the description of the error line is "if the return string is empty the service is assumed up". This can be confusing, if you return a value other than "" the probe will be in error and you will get a notification. Remember the IF function is "if X, return Y, else return Z". When the probe is in error Z will be sent to your notification.

So on the error line put - if(oid("1.3.6.1.4.1.9.2.1.57.0"), "", "Cant read cpu")
in English that would be ..if the oid exists return "" else return "Can't read cpu".
But there is a problem, what if the cpu average is 0, well your probe will generate a notification and will be false.
So use this instead. if(oid("1.3.6.1.4.1.9.2.1.57.0")<> "", "", "Cant read cpu")
in English that would be ... if the oid is not equal to nothing, return true else ...

BUT we are using 30 second reads and want to make sure if there is a failed read it is not negatively cached for 300 seconds.
if(oid("1.3.6.1.4.1.9.2.1.57.0",10,29)<> "", "", "Cant read cpu")
if oid exists remember it for 10 seconds, negative cache it for 29 seconds, is not nothing, return true.

Now we want to know if CPU is not nothing OR is not over 95% utilization.
if(or(oid("1.3.6.1.4.1.9.2.1.57.0",10,29)<>"", oid("1.3.6.1.4.1.9.2.1.57.0",10,29)>95), "","CPU Problem")
if oid not nothing or is not greater than 95 return nothing.

Math and other logic functions can be performed here as well. Say you are reading a Negative value like RSSI but want the graph to be positive. So you can send a notification if your wireless bridge signal is too weak.
if((oid("1.3.6.1.4.1.9.2.1.57.0",10,29)*-1) <85, "", "Bridge signal low") I don't think this exact line works but hopefully you get the idea.

[Value line]
Now it it time to Graph. In the Value line place the OID that you want to graph.
oid("1.3.6.1.4.1.9.2.1.57.0",10,29)

if your OID has a lot of precision you can round it, many things can be fixed here with values that you want to graph.
round(oid("1.3.6.1.4.1.9.2.1.57.0",10,29))

[Unit line]
In the unit put % if it is percent, put ms if it is in milliseconds... All the graphs with the same Unit will be graphed on one graph.

Leave the rate to none, that is how often the probe is executed and the default polling interval will be used.

There are built in things like [Device.name] that can be used with out knowing the exact oid. I don't know where there is a list of them.

That is all I have time for now... HTH,
Lebowski

Edit: removed the incriminating evidence and touched up some SNMP, MIB and OID stuff. Also many edits to facilitate ease of reading. Improved "Available" section. moved to wiki.

Thanks alot, and this should be a great start. I'll really delve into this later when I have some more time. I really appreciate your input and the time you spent. Thanks again!

thanks as well, some of this i could have use a long time ago

Yeah these probes have been an uphill battle, I learned it all by trial and error (and the probe thread) and really wanted to hammer out the above detail since it does really need to be all in one place.

I added tiny bit more detail and if you have any ideas let me know I will add it to the firs post, maybe we can get it a sticky!

Ok I'm finally starting to delve into this now that I have time. One question so far can I get a list of values within an OID "category".

For instance. I want to get all the IP's off of a MikroTik RouterBoard. The OID's I've found are the following:

1.3.6.1.2.1.4.20.1.1.192.168.1.1
iso.org.dod.internet.mgmt.mib-2.ip.ipAddrTable.ipAddrEntry.ipAdEntAddr.192.168.1.1
1.3.6.1.2.1.4.20.1.1.192.168.1.2
iso.org.dod.internet.mgmt.mib-2.ip.ipAddrTable.ipAddrEntry.ipAdEntAddr.192.168.1.2
1.3.6.1.2.1.4.20.1.1.192.168.1.3
iso.org.dod.internet.mgmt.mib-2.ip.ipAddrTable.ipAddrEntry.ipAdEntAddr.192.168.1.3

Now I've obviously replaced the IP's here as to not disclose public IP's of my devices.

I'd like to display in all of my device labels a list of the devices IP's. Each device has different IP's so I don't want to type the specific oid but more of the "category" such as 1.3.6.1.2.1.4.20.1.1 or iso.org.dod.internet.mgmt.mib-2.ip.ipAddrTable.ipAddrEntry.ipAdEntAddr or something like that. Is there a way to do this?

Please reply with your thoughts and if it can be applied to general OID/Probe practice add it to your original post and we'll slowly add to it to create a bit of a user-generated walkthrough/reference.

Place something like this on the label...
[oid_column("1.3.6.1.2.1.4.20.1.1")]
Then you will want to know how to replace , with "crlf"... there was a post on here somewhere that dealt with making text wrap...

Thanks! I didn't know there was an oid_column function. I'm sure I can figure the rest out. I'll reply when I get some time to try it.

I'm having a problem getting crlf to work in the label. Here is a short test and the results:

Functions:
concatenate(string_substring(oid_column("1.3.6.1.2.1.4.20.1.1"),0, string_find(oid_column("1.3.6.1.2.1.4.20.1.1"), ",")), "CRLF" , "Next Line")

Results:
XX.X.XXX.XXXCRLFNext Line

Please explain why this is not working. Also is there a way to just have a function replace the , with crlf?

[Available line]
In the available line place the OID minus the last 0, oid("1.3.6.1.4.1.9.2.1.57") also you don't need brackets in a probe, only on a label. The available line reads the MIB and determine if that OID is actually on the device. So you don't want the value, you just want to make sure the OID exists. Also I have seen where having the whole OID in the Available line causes the probe to not graph even though there is no error with the probe. BUT BUT There are oids where you have to specify the entire OID in the available line, you will have to do some testing.

amusingly you don't have to enter anything in the 'available' field. regardless of whether you enter some OID (that doesn't even have to exist) or an IF statement that returns 1, 0 or -1 or you write your name or nothing... the probe always works. Is that a wanted behaviour? Or am I getting something wrong?

I believe that is a totally unwanted behavior and I was not able to get the available line to work correctly with out a lot of mucking around but you can get it to work. The problem with custom probes and auto-discovery is exactly that, you build a probe that "available" is not setup correctly on and then the probe gets automatically added to every device even though it doesn't work on the device.

Gsandul has a much better grasp on this than I do, Look at the fixed Cisco CPU probe in the probe thread. I finally have a cpu probe that is very accurate and reliable... Here is the relevant parts

Function - This one grabs the OID then the value and if there is no value it returns False. The name of this function is "Cisco_CPU_a"
I am adding 1 to the value cause some of my devices average 0% cpu utilization (quick fix). 0 as a value is another problem.
if(array_size(oid_column("1.3.6.1.4.1.9.2.1.57", 10 ,29)), oid("1.3.6.1.4.1.9.2.1.57.0", 10, 29)+1 ,"False")

So on the Available line on the probe you can check for False.
Cisco_CPU_a() <> "False"

HTH,
Lebowski

lebowski,

Thanks for you postings. They would make great Wiki articles for others to share and expand on.

Here is a new WIKI page for Getting started with functions and probes
http://wiki.mikrotik.com/wiki/Getting_s ... and_probes

Wow that really needed some work...