All Apps and Add-ons

SNMP Modular Input: Why am I getting error "No module RFC-1212 loaded" trying to get an mib to work?

kumor
New Member

Hello,

I have been trying to get the following mib to work with SNMP in Splunk:

http://protocolsoftware.com/documents/mibs/saatrap.mib.txt

I changed the file name to SAATRAP.mib and I changed the name inside the file from 'saatrap' to 'SAATRAP'. After that I followed the directions at https://apps.splunk.com/app/1537/#/documentation to add a custom mib by issuing the following commands:

smidump -k -f python ./SAATRAP.mib | /usr/bin/libsmi2pysnmp > SAATRAP.py
smidump -k -f python ./RFC-1212.mib | /usr/bin/libsmi2pysnmp > RFC-1212.py

After issuing these commands I placed SAATRAP.py and RFC-1212.py into the etc/apps/snmp_ta/bin/mibs/ folder of my splunk installation, I added SAATRAP to the Custom Mib Names field under my SNMP data input. Now when I click Save for the my SNMP data input I get the following error:

01-02-2015 16:26:44.815 -0500 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/snmp_ta/bin/snmp.py" pysnmp.smi.error.SmiError: MIB module "/opt/splunk/etc/apps/snmp_ta/bin/mibs/SAATRAP.py" load error: ['Traceback (most recent call last):\n', '  File "/opt/splunk/etc/apps/snmp_ta/bin/pysnmp-4.2.5-py2.7.egg/pysnmp/smi/builder.py", line 255, in loadModules\n    exec(modData, g)\n', '  File "", line 10, in \n', '  File "/opt/splunk/etc/apps/snmp_ta/bin/pysnmp-4.2.5-py2.7.egg/pysnmp/smi/builder.py", line 302, in importSymbols\n    \'No module %s loaded at %s\' % (modName, self)\n', 'SmiError: No module RFC-1212 loaded at \n']

Any help regarding this error would be greatly appreciated.

Tags (2)
0 Karma

Damien_Dallimor
Ultra Champion

Did you also add "RFC-1212" to the Custom Mib Names ?

SAATRAP,RFC-1212
0 Karma

Damien_Dallimor
Ultra Champion

re-generate RFC-1212.py as RFC1212.py

dashes should not be in python module names.

SAATRAP,RFC1212
0 Karma

kumor
New Member

After regenerating RFC1212.mib as RFC1212.py I get the following error which is essentially the same as the first one I posted only without the '-' in the name.

01-08-2015 11:14:27.151 -0500 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/snmp_ta/bin/snmp.py" pysnmp.smi.error.SmiError: MIB module "/opt/splunk/etc/apps/snmp_ta/bin/mibs/SAATRAP.py" load error: ['Traceback (most recent call last):\n', '  File "/opt/splunk/etc/apps/snmp_ta/bin/pysnmp-4.2.5-py2.7.egg/pysnmp/smi/builder.py", line 255, in loadModules\n    exec(modData, g)\n', '  File "<string>", line 11, in <module>\n', '  File "/opt/splunk/etc/apps/snmp_ta/bin/pysnmp-4.2.5-py2.7.egg/pysnmp/smi/builder.py", line 302, in importSymbols\n    \'No module %s loaded at %s\' % (modName, self)\n', 'SmiError: No module RFC1212 loaded at <pysnmp.smi.builder.MibBuilder instance at 0x7fdee5c0ac68>\n']
0 Karma

Damien_Dallimor
Ultra Champion

Are you sure you generated the python files correctly without any conversion errors ? Open them up , do they correctly contain the rolled out MIB content ?

0 Karma

kumor
New Member

The results of running the following commands:

smidump -p ./RFC1155-SMI.mib --level=6 -k -f python ./RFC1212.mib | libsmi2pysnmp > ./RFC1212.py

smidump -p ./RFC1155-SMI.mib --level=6 -k -f python ./RFC1215.mib | libsmi2pysnmp > ./RFC1215.py

smidump -p ./RFC1212.mib -p ./RFC1155-SMI.mib -p ./RFC1215.mib -p ./RFC1155-SMI.mib -c /etc/smi.conf --level=6 -f python SAATRAP.mib | libsmi2pysnmp > ./SAATRAP.py

are respectively:

./RFC1212.mib:9: MACRO definitions are only allowed in SMI base modules
./RFC1212.mib:61: CHOICE type definitions are only allowed in SMI base modules
./RFC1212.mib:74: warning: module name `RFC1212' should match `*-MIB'
./RFC1212.mib:4: warning: identifier `ObjectName' imported from module `RFC1155-SMI' is never used
smidump: module `./RFC1212.mib' contains errors, expect flawed output

./RFC1215.mib:7: MACRO definitions are only allowed in SMI base modules
./RFC1215.mib:34: warning: module name `RFC1215' should match `*-MIB'
./RFC1215.mib:4: warning: identifier `ObjectName' imported from module `RFC1155-SMI' is never used
smidump: module `./RFC1215.mib' contains errors, expect flawed output

SAATRAP.mib:134: warning: module name `SAATRAP' should match `*-MIB'
SAATRAP.mib:96: warning: implicit node definition

but each python output file contains information that looks correct as far as I can tell since I do not have much experience with this.

0 Karma

krusty
Contributor

Are there any news regarding this problem?

I still have similar issues.

@kumor, is it possible that you post the saatrap.py?

0 Karma

kumor
New Member

Unfortunately I have not had much time to work on this, but here's a link to my SAATRAP.py file after removing the hyphen from RFC1212.mib and RFC1215.mib.

https://s3.amazonaws.com/nex-public-temp/saatrap/SAATRAP.py

0 Karma

krusty
Contributor

Thanks kumor,

I compare your SAATRAP.py with mine.
Both are absolutly equal to each other.

@Damien, have you any idea how we can proceed with this issue?

Only for you Information.
I downloaded the RFC-1212 MIB and save it with the filename RFC-1212.txt. Then I executed this command: smidump -k -f python RFC-1212.txt | libsmi2pysnmp > RFC-1212.py without any Errors. I try to Import this into my Inputs.conf file. The result is, that I've got this error message in splunkd.log.

01-16-2015 13:53:00.477 +0100 ERROR ExecProcessor - message from "python /splunk/opt/splunk/etc/apps/snmp_ta/bin/snmp.py" pysnmp.smi.error.SmiError: MIB module "/splunk/opt/splunk/etc/apps/snmp_ta/bin/mibs/SAGTRAP.py" load error: ['Traceback (most recent call last):\n', '  File "/splunk/opt/splunk/etc/apps/snmp_ta/bin/pysnmp-4.2.5-py2.7.egg/pysnmp/smi/builder.py", line 255, in loadModules\n    exec(modData, g)\n', '  File "<string>", line 11, in <module>\n', '  File "/splunk/opt/splunk/etc/apps/snmp_ta/bin/pysnmp-4.2.5-py2.7.egg/pysnmp/smi/builder.py", line 302, in importSymbols\n    \'No module %s loaded at %s\' % (modName, self)\n', 'SmiError: No module RFC-1212 loaded at <pysnmp.smi.builder.MibBuilder instance at 0x7ffe9af00560>\n']

Where is my mistake?

0 Karma

thaddeuslim
Explorer

Hi any updates on this? I am facing this exact same issue as well

0 Karma

krusty
Contributor

@thaddeuslim, we found a new solution for this issue. We do not use snmp to get swift traps into splunk anymore. Sorry.

0 Karma

bakdaulet
Loves-to-Learn Lots

Hello, can you tell what kind of solution did you find? Because i have the same problem.

0 Karma

kumor
New Member

Yes

I tried both

SAATRAP,RFC-1212

and

RFC-1212,SAATRAP
0 Karma
Get Updates on the Splunk Community!

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

March Community Office Hours Security Series Uncovered!

Hello Splunk Community! In March, Splunk Community Office Hours spotlighted our fabulous Splunk Threat ...

Stay Connected: Your Guide to April Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars in April. This post ...