sensor-snmp: identity evidence for polled devices (observer role) #537

New issue

Closed

opened 2026-07-23 08:11:21 +00:00 by p13marc · 0 comments

p13marc commented

2026-07-23 08:11:21 +00:00

(Migrated from github.com)

Part of #525.

Problem

Polled devices contribute no identity evidence: the sensor only publishes state/snmp/evidence/self (the poller host's own identity via with_identity()). zensight-common/src/evidence.rs explicitly anticipates SNMP as the canonical third-party observer ("snmp sysName"), and HostEvidence.observer exists for exactly this — but the registry (zensight-common/registry/snmp.toml) has no evidence/device/{device} subject. Result: routers/switches never appear in the correlator's entity catalog or topology; SNMP data can't be fused with netring/netlink observations of the same devices.

Proposal

Per polled device, publish HostEvidence with observer = Some(<poller host_id>):
- hostname ← sysName; vendor/platform ← parsed sysDescr + sysObjectID enterprise arc;
- macs ← ifPhysAddress walk (filter empty/virtual);
- ips ← ipAddrTable / ipAddressTable walk (plus the address we poll);
- stable per-device host_id derivation (decide: hash of engine ID / chassis MAC / sysName+address — must survive re-IP).
Registry: add evidence/device/{device} (state, HostEvidence) to snmp.toml; refresh on a slow cadence (e.g. every 10th poll).
Verify the correlator fuses SNMP-observed devices with evidence from other sensors (MAC/IP rules) into single HostEntitys and they render in topology/entity views.

Acceptance

Polling a device creates/enriches a HostEntity in @catalog with SNMP-sourced names, MACs, IPs.
A device also seen by netring (same MAC/IP) resolves to one entity, not two.
Registry lint + introspect include the new subject; docs/reference.md updated.

Part of #525. ## Problem Polled devices contribute **no identity evidence**: the sensor only publishes `state/snmp/evidence/self` (the poller host's own identity via `with_identity()`). `zensight-common/src/evidence.rs` explicitly anticipates SNMP as the canonical third-party observer ("snmp sysName"), and `HostEvidence.observer` exists for exactly this — but the registry (`zensight-common/registry/snmp.toml`) has no `evidence/device/{device}` subject. Result: routers/switches never appear in the correlator's entity catalog or topology; SNMP data can't be fused with netring/netlink observations of the same devices. ## Proposal - Per polled device, publish `HostEvidence` with `observer = Some(<poller host_id>)`: - `hostname` ← sysName; `vendor`/`platform` ← parsed sysDescr + sysObjectID enterprise arc; - `macs` ← ifPhysAddress walk (filter empty/virtual); - `ips` ← ipAddrTable / ipAddressTable walk (plus the address we poll); - stable per-device `host_id` derivation (decide: hash of engine ID / chassis MAC / sysName+address — must survive re-IP). - Registry: add `evidence/device/{device}` (state, `HostEvidence`) to `snmp.toml`; refresh on a slow cadence (e.g. every 10th poll). - Verify the correlator fuses SNMP-observed devices with evidence from other sensors (MAC/IP rules) into single `HostEntity`s and they render in topology/entity views. ## Acceptance - Polling a device creates/enriches a `HostEntity` in `@catalog` with SNMP-sourced names, MACs, IPs. - A device also seen by netring (same MAC/IP) resolves to **one** entity, not two. - Registry lint + `introspect` include the new subject; `docs/reference.md` updated.

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

marcpardo/zensight#537

No description provided.

Rows
Columns