RE: [nv-l] SNMP v2

[James Shanks <jshanks@us.ibm.com>]

Do you have the SNMP V2 format e-fix IY35928 applied?
That's not the latest but that's a start.

Your best bet is to 7.1.3 FixPack1 (which included IY35928) since FixPack2 will be out shortly with those other updated facilities I mentioned.  They are not currently available as an e-ifx to either 7.1.2 or 7.1.3 because of the number of modules and libraries affected.

James Shanks
Level 3 Support  for Tivoli NetView for UNIX and Windows
Tivoli Software / IBM Software Group

"Edwards, JT - ESM" <JEdwards3@wm.com> Sent by: owner-nv-l@lists.us.ibm.com 11/21/2003 03:03 PM Please respond to nv-l

To:        "'nv-l@lists.us.ibm.com'" <nv-l@lists.us.ibm.com>         cc:                 Subject:        RE: [nv-l] SNMP v2

James,
 
We are on AIX 4.3.3 with ML 10. We are using Netview 7.1.2.

J.T. Edwards
Sr. Systems Programmer
Enterprise Systems Management
Waste Management Incorporated
"Proud Sponsor of NASCAR"
Office: (713)265-1294
Mobile: (832)457-5239

-----Original Message-----
From: James Shanks [mailto:jshanks@us.ibm.com]
Sent: Friday, November 21, 2003 11:15 AM
To: nv-l@lists.us.ibm.com
Subject: Re: [nv-l] SNMP v2


You neglected to say what OS platform and what Level of code are you using.    I know it has to be UNIX, but . . .
There have been recent small changes made in SNMP V2 trap processing.  I would suggest you call Support and get the latest fix if you cannot wait for FixPack2.

In particular I have seen issues where trapd was not able to parse the timestamp in the event, and so it was rejected as invalid, even though everything else was OK.  But you will need the latest level of code so that you can get a meaningful  trapd.trace  that will explain why the trap is being rejected.  7.1.3 FP1 and lower will not tell you.   Though you can set the "hex dump all packets" option for trapd (which makes him run with -x as an option) and then toggle the trapd trace on with "trapd -T "and see what the incoming packet actually looks like in hex.  What you won't see is why we think it is invalid.  Support can help you decode the hex if you want, though using the latest level might make that unnecessary.


As for the mib2trap insertion, that only affects formatting, it has nothing to do with whether a trap is rejected as invalid.

You would need to look at your trapd.conf with xnmtrap and see whether indeed the addtrap scripts, which  you created with mib2trap and ran,  actually put in an entry for enterprise 1.3.6.1.4.1.2552.200.300.3, generic trap 6, specific 4.  If that was not added, then that is why you see "no format found".   That is the trap that trapd says he got.  Is that the enterprise id you were expecting?   If not, then that is something else you may want to discuss with Support.


James Shanks
Level 3 Support  for Tivoli NetView for UNIX and Windows
Tivoli Software / IBM Software Group

"Edwards, JT - ESM" <JEdwards3@wm.com> Sent by: owner-nv-l@lists.us.ibm.com 11/21/2003 11:50 AM Please respond to nv-l

To:        "'nv-l@lists.us.ibm.com'" <nv-l@lists.us.ibm.com>        cc:                Subject:        [nv-l] SNMP v2

Hiya folks,
 
It appears that Netview is having problems with processing SNMP v2 traps.
 
We get the following from Netview when we receive our Siteminder traps arrive:
 

Here is what came from Netview when it received the SNMP trap from Siteminder:

Mon Nov 17 10:22:55 2003 crpu117a.wm.com ? Trap found with no known format in trapd.conf(4)

Enterprise ENTERPRISES (1.3.6.1.4.1.2552.200.300.3) community public

generic trap:6 specific trap:4

Timestamp:0 Agentaddr:crpu117a.wm.com args(2):

[1] snmpV2.snmpModules.1.1.4.3 (ObjectIdentifier): private.enterprises.2552

[2] private.enterprises.2552.200.300.3.1.2 (OctetString): smservauth

SPECIFIC : 4 (hex: 4)

GENERIC : 6

CATEGORY : Status Events

ENTERPRISE : ENTERPRISES 1.3.6.1.4.1.2552.200.300.3

SOURCE : Source not known (?)

HOSTNAME : crpu117a.wm.com

SEVERITY : Indeterminate

LOGGEDTIME : 11/17/03 10:22:55

--------------------------------------------------------------snip---------------------------------------

Here is the gobby gook from the event log:

public<none>WARNING: invalid SNMPTrap packet from agent 10.208.4.170 source

-------------------------------------------------------------snip------------------------------------------

From the trapd engine

1069086174 3 Mon Nov 17 10:22:54 2003 crpu117a.wm.com ? Trap found with no known format in trapd.conf(4)

1069086174 3 Mon Nov 17 10:22:54 2003 crpu117a.wm.com ? Enterprise ENTERPRISES (1.3.6.1.4.1.2552.200.300.3) community public

1069086174 3 Mon Nov 17 10:22:54 2003 crpu117a.wm.com ? generic trap:6 specific trap:4

1069086174 3 Mon Nov 17 10:22:54 2003 crpu117a.wm.com ? Timestamp:0 Agentaddr:crpu117a.wm.com args(2):

1069086174 3 Mon Nov 17 10:22:54 2003 crpu117a.wm.com ? [1] snmpV2.snmpModules.1.1.4.3 (ObjectIdentifier): private.enterprises.2552

1069086174 3 Mon Nov 17 10:22:54 2003 crpu117a.wm.com ? [2] private.enterprises.2552.200.300.3.1.2 (OctetString): smservauth

1069086190 2 Mon Nov 17 10:23:10 2003 <none> T WARNING: invalid SNMPTrap packet from agent 10.208.4.170 source A pid -1

1069086301 2 Mon Nov 17 10:25:01 2003 <none> T WARNING: invalid SNMPTrap packet from agent 10.208.4.170 source A pid -1

1069086304 2 Mon Nov 17 10:25:04 2003 <none> T WARNING: invalid SNMPTrap packet from agent 10.208.4.170 source A pid -1

1069086304 2 Mon Nov 17 10:25:04 2003 <none> T WARNING: invalid SNMPTrap packet from agent 10.208.4.170 source A pid -1

1069086305 2 Mon Nov 17 10:25:05 2003 <none> T WARNING: invalid SNMPTrap packet from agent 10.208.4.170 source A pid -1

1069086305 2 Mon Nov 17 10:25:05 2003 <none> T WARNING: invalid SNMPTrap packet from agent 10.208.4.170 source A pid -1

1069086306 2 Mon Nov 17 10:25:06 2003 <none> T WARNING: invalid SNMPTrap packet from agent 10.208.4.170 source A pid -1

1069086350 2 Mon Nov 17 10:25:50 2003 <none> T WARNING: invalid SNMPTrap packet from agent 10.208.4.170 source A pid -1

1069086351 2 Mon Nov 17 10:25:51 2003 <none> T WARNING: invalid SNMPTrap packet from agent 10.208.4.170 source A pid

I have the traps properly inserted into Netview via mib2trap and had no problems whatsoever.

J.T. Edwards
Sr. Systems Programmer
Enterprise Systems Management
Waste Management Incorporated
"Proud Sponsor of NASCAR"
Office: (713)265-1294
Mobile: (832)457-5239