SNMP Modular Input: After adding custom MIBs, why are SNMP traps not human readable?

[nikkkc]

I configured the SNMP Modular Input App to Trap SNMP Messages from a Cisco Device (WLC). Well I get SNMP Messages, but they are binary. I was fallowing the documentation to make custom MIBs and I struggled with this part a lot, but finally I did it. (build the python files from Cisco.my files and zipped into a .egg file)

In the Input Data Configuration I paste the following Custom MIBs:

IANAifType-MIB,RFC1213-MIB,CISCO-LWAPP-DOT11-CLIENT-MIB,CISCO-LWAPP-AP-MIB,SNMPv2-MIB,AIRESPACE-REF-MIB,EXPRESSION-MIB,SNMPv2-SMI,SNMPv2-TC,CISCO-CALLHOME-MIB,INET-ADDRESS-MIB

But the Events in Splunk are still in binary:

public\xA7\x82.\xCEq
0\x82


public\xA7\x81\xF7Н
 0\x82
a

public\xA7\x82
RО
 0\x81\xD7

public\xA7\x81\xC9П
 0\x82


public\xA7\x81\xF8Р
 0\x82
_

public\xA7\x82
PС
 0\x81\xD6

public\xA7\x81\xC8Т
 0\x82


public\xA7\x81\xF7У
 0\x82
^

public\xA7\x82
OФ
 0\x81\xD6

public\xA7\x81\xC8Х
 0\x82


public\xA7\x81\xF7Ц
 0\x82
^

public\xA7\x82
OЧ
 0\x81\xA9

public\xA7\x81\x9BШ
 0\x81\xD6

public\xA7\x81\xC8Щ
 0\x82


public\xA7\x81\xF7Ъ
 0\x82
b

public\xA7\x82
SЫ
 0\x81\xD0

public\xA7\x81\xC2Ь
 0\x81\xFF

public\xA7\x81\xF1Э
 0\x82
_

public\xA7\x82
PЮ
 0\x81\xE9

public\xA7\x81\xDBЯ
 0\x81\xD6

public\xA7\x81\xC8а
 0\x82


public\xA7\x81\xF7б
 0\x82
4

public\xA7\x82
%в
 0\x81\xD6

public\xA7\x81\xC8г
 0\x82


public\xA7\x81\xF7д
 0\x82
b

public\xA7\x82
Sе

[nikkkc]

now i got the following error: SNMP could not find OID and also in Cisco Object Browser there is no MIB registert to the OBject

01-11-2016 14:36:53.685 +0100 ERROR ExecProcessor - message from "python E:\Splunk\etc\apps\snmp_ta\bin\snmp.py" Exception resolving MIB name in the caught trap: NoSuchObjectError({'str': 'No MIB registered that defines 1.3.6.1.4.1.9.9.599.1.3.1.1.28.172.41.58.5.98.203 object, closest known parent is 1.3.6.1.4.1.9.9.599.1.3.1.1 (CISCO-LWAPP-DOT11-CLIENT-MIB::cldcClientEntry)'}) snmp_stanza:snmp://Tag_Cisco_WLC_Trap

is there anywhere a good manual to find OID to a specific WLC or in genarl to a specific device?

[nikkkc · Accepted solution]

this works for me (it looks like there are different versions of CISCO MIB Files!!!, But where does they come from? I load all my MIBS with pysnmp! they should work together but they didnt!!!!):

http://community.hpe.com/t5/Network-Management-OpenView-NNM/LOAD-MIB/td-p/6723384
in fact, I found the CISCO-LWAPP-DOT11-MIB that contains cldRegulatoryDomain definition in this link :
"http://sourceforge.net/p/netdisco/mibs/ci/e995bb6977824588b8ed1f18a44c8c1c3f87fb4e/tree/cisco/CISCO...
I reloaded my CISCO-LWAPP-DOT11-MIB
Now , CISCO-LWAPP-AP-MIB is loaded .

[tomasmoser]

Hi,

Can you please share your .ogg file with all Cisco MIBs for WLC? That would be awesome.

I was following SNMP modular input instructions and for compilation into .py I used "mibdump.py" tool as the one that communite suggest today. However compilation keeps failing on CISCO-LWAPP-AP-MIB.my due to Integer32 type missing. I don't understand that. I used Cisco mibs for WLC 8.5 and mibs from Cisco v2 package from Cisco ftp.

Any help appreciated.

root@CZ-SLG003:~/mibs/cisco/wlc/8.5/all# mibdump.py CISCO-LWAPP-DOT11-CLIENT-MIB.my
Source MIB repositories: file:///usr/share/snmp/mibs, http://mibs.snmplabs.com/asn1/@mib@
Borrow missing/failed MIBs from: http://mibs.snmplabs.com/pysnmp/notexts/@mib@
Existing/compiled MIB locations: pysnmp.smi.mibs, pysnmp_mibs
Compiled MIBs destination directory: /root/.pysnmp/mibs
MIBs excluded from code generation: INET-ADDRESS-MIB, PYSNMP-USM-MIB, RFC-1212, RFC-1215, RFC1065-SMI, RFC1155-SMI, RFC1158-MIB, RFC1213-MIB, SNMP-FRAMEWORK-MIB, SNMP-TARGET-MIB, SNMPv2-CONF, SNMPv2-SMI, SNMPv2-TC, SNMPv2-TM, TRANSPORT-ADDRESS-MIB
MIBs to compile: CISCO-LWAPP-DOT11-CLIENT-MIB
Destination format: pysnmp
Parser grammar cache directory: not used
Also compile all relevant MIBs: yes
Rebuild MIBs regardless of age: no
Dry run mode: no
Create/update MIBs: yes
Byte-compile Python modules: yes (optimization level no)
Ignore compilation errors: no
Generate OID->MIB index: no
Generate texts in MIBs: no
Keep original texts layout: no
Try various file names while searching for MIB module: yes
Created/updated MIBs:
Pre-compiled MIBs borrowed:
Up to date MIBs: INET-ADDRESS-MIB, RFC-1212, RFC-1215, RFC1155-SMI, RFC1213-MIB, SNMP-FRAMEWORK-MIB, SNMPv2-CONF, SNMPv2-SMI, SNMPv2-TC
Missing source MIBs:
Ignored MIBs: BRIDGE-MIB, CISCO-LWAPP-DOT11-CLIENT-MIB, CISCO-LWAPP-DOT11-MIB, CISCO-LWAPP-MOBILITY-EXT-MIB, CISCO-LWAPP-RF-MIB, CISCO-LWAPP-TC-MIB, CISCO-LWAPP-WLAN-MIB, CISCO-SMI, CISCO-TC, ENTITY-MIB, IANAifType-MIB, IF-MIB, P-BRIDGE-MIB, Q-BRIDGE-MIB, RFC1271-MIB, RMON-MIB, RMON2-MIB, SNMPv2-MIB, TOKEN-RING-RMON-MIB
Failed MIBs: CISCO-LWAPP-AP-MIB (unknown type "(('Integer32', ''), [(u'true', 1), (u'false', 2)])" for defval "disable" of symbol "cLApCtsSxpMode" at MIB CISCO-LWAPP-AP-MIB)
root@CZ-SLG003:~/mibs/cisco/wlc/8.5/all#

[tomasmoser]

Problem solved. This info might help others too.

Cisco shares buggy mib CISCO-LWAPP-AP-MIB.my. There was a wrong definition of a variable cLApCtsSxpMode:

Value disable is wrong. It should be false

cLApCtsSxpMode OBJECT-TYPE
        SYNTAX      TruthValue
        MAX-ACCESS  read-create
        STATUS      current
        DESCRIPTION
        "This object represents sxp mode."
--        DEFVAL { disable }
        DEFVAL { false }
        ::= {  cLApEntry 89 }

[mgranger1]

I have been trying (unsuccessfully) to convert 3 mib files over to py in order to use them with the SNMP modular input:

CiscoPrime.mib (this may be custom to our organization)
CISCO-LWAPP-ROGUE-MIB.my
AIRESPACE-WIRELESS-MIB.my

Each time I try to follow the commands in the modular inputs documentation

smidump -f python MYMIB.mib | libsmi2pysnmp > MYMIB.py  

I get the following errors:

smidump: module `./CISCO-LWAPP-ROGUE-MIB.my' contains errors, expect flawed output
smidump: aborting due to severe parsing errors
smidump: use the -k option to force continuation
Empty input

I'm looking for any help. Can someone provide py versions of these MIB's? Alternately, is the modular input worth fighting with? Once you get the MIB's converted, does it work as expected? How did you find the above error? Any help would be appreciated.

Sincerely,
Matthew Granger

[nikkkc]

I got the following Error during try to use Cisco Custom MIB in SNMP Modular Input:

If i Search: "index=_internal ExecProcessor error snmp.py"

i get this result:

01-05-2016 15:07:46.072 +0100 ERROR ExecProcessor - message from "python E:\Splunk\etc\apps\snmp_ta\bin\snmp.py" pysnmp.smi.error.SmiError: MIB module "E:\Splunk\etc\apps\snmp_ta\bin\mibs\CISCO-LWAPP-AP-MIB.py" load error: ['Traceback (most recent call last):\n', ' File "E:\\Splunk\\etc\\apps\\snmp_ta\\bin\\pysnmp-4.2.5-py2.7.egg\\pysnmp\\smi\\builder.py", line 255, in loadModules\n exec(modData, g)\n', ' File "<string>", line 10, in <module>\n', ' File "E:\\Splunk\\etc\\apps\\snmp_ta\\bin\\pysnmp-4.2.5-py2.7.egg\\pysnmp\\smi\\builder.py", line 306, in importSymbols\n \'No symbol %s::%s at %s\' % (modName, symName, self)\n', 'SmiError: No symbol CISCO-LWAPP-DOT11-MIB::cldRegulatoryDomain at <pysnmp.smi.builder.MibBuilder instance at 0x0000002099F4F5C8>\n']

Can someone help me please?