topic Re: SNMP MODULAR INPUTS in All Apps and Add-ons

SNMP MODULAR INPUTS

jarize_loyola — Fri, 27 Jan 2017 09:02:56 GMT

Hi Splunk Peeps!

Im trying to set up the SNMP Modular input to get the snmp traps data but unfortunately Im receiving this error
"Failed to register transport and run dispatcher: bind() for (u'SERVERNAME', 162) failed: [Errno -3] Temporary failure in name resolution snmp_stanza:snmp://SNMPTRAP5"

BR,
Jarize

Re: SNMP MODULAR INPUTS

Damien_Dallimor — Sun, 29 Jan 2017 12:33:08 GMT

DNS resolution errors for your server name your are setting in inputs.conf ?

Re: SNMP MODULAR INPUTS

jarize_loyola — Mon, 30 Jan 2017 08:47:35 GMT

Hello, I already set it to the hostname set in inputs.conf and same with the server.
The error was gone but still cant see any logs coming in.

Re: SNMP MODULAR INPUTS

Damien_Dallimor — Mon, 30 Jan 2017 08:58:43 GMT

Post your full inputs.conf stanza for your SNMP input.

Also describe in detail the configuration you are using to send the traps to Splunk.

Re: SNMP MODULAR INPUTS

jarize_loyola — Tue, 29 Sep 2020 12:39:50 GMT

Its working now. I can see logs coming in. I saw new error
"01-30-2017 17:20:20.992 +0800 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/snmp_ta/bin/snmp.py" Exception resolving MIB value in the caught trap: Invalid sub-ID in (ObjectSyntax().setComponentByPosition(0, SimpleSyntax().setComponentByPosition(1, OctetString('epsEnodeBUnreachable'))), None, None, None, None) at ObjectIdentifier snmp_stanza:snmp://F5"

Re: SNMP MODULAR INPUTS

Damien_Dallimor — Mon, 30 Jan 2017 10:30:10 GMT

Totally guessing here as I can't see you inputs.conf stanza , but I will presume you have not configured the custom MIB for the incoming OIDs , covered in the docs : https://splunkbase.splunk.com/app/1537/#/details

Re: SNMP MODULAR INPUTS

jarize_loyola — Tue, 29 Sep 2020 12:40:33 GMT

Hi Damien,

Here's the inputs.conf and its working now.
[snmp://SNMP_TA]
communitystring = public
do_bulk_get = 0
do_get_subtree = 0
index = snmptraps
ipv6 = 0
snmp_mode = traps
snmp_version = 2C
sourcetype = SNMP_TA
split_bulk_output = 0
trap_host = 10.169.91.87
trap_port = 162
trap_rdns = 0
v3_authProtocol = usmHMACMD5AuthProtocol
v3_privProtocol = usmDESPrivProtocol
mib_names = DISMAN-SCRIPT-MIB,DISMAN-SCHEDULE-MIB,DISMAN-EVENT-MIB

We are now trying to load the mibs we still have this error.
"01-31-2017 15:06:12.855 +0800 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/snmp_ta/bin/snmp.py" Exception resolving MIB value in the caught trap: Invalid sub-ID in (ObjectSyntax().setComponentByPosition(0, SimpleSyntax().setComponentByPosition(1, OctetString('ss7M3uaAssociationUp'))), None, None, None, None) at ObjectIdentifier snmp_stanza:snmp://SNMP_TA"

Re: SNMP MODULAR INPUTS

Damien_Dallimor — Wed, 01 Feb 2017 01:09:36 GMT

I'm going to guess that you did not convert the MIB files to python modules correctly / completely.Perhaps there were MIB dependencies (usually listed at the top of the MIB file) inside those DISMAN MIB's that you missed also ?

See my accepted answer here also :

https://answers.splunk.com/answers/216296/cannot-resolve-node-name-for-custom-mibs.html#answer-216812

Re: SNMP MODULAR INPUTS

jarize_loyola — Thu, 02 Feb 2017 07:27:41 GMT

Here are the errors every time were trying to convert the mibs

smidump -f python RFC1155-SMI.txt | libsmi2pysnmp > RFC1155-SMI.py
RFC1155-SMI.txt:100: range limit exceeds underlying basetype
RFC1155-SMI.txt:104: range limit exceeds underlying basetype
RFC1155-SMI.txt:108: range limit exceeds underlying basetype
smidump: module `RFC1155-SMI.txt' contains errors, expect flawed output

Re: SNMP MODULAR INPUTS

cpt12tech — Thu, 20 Apr 2017 01:26:54 GMT

If you're having problems with the SNMP-Modular input, may want to give this a try:
https://answers.splunk.com/answers/521362/found-a-simple-snmp-trap-receiver-for-windows-that.html#answer-522171