SNMP Modular Input: Why am I getting error "No module RFC-1212 loaded" trying to get an mib to work?

[kumor]

Hello,

I have been trying to get the following mib to work with SNMP in Splunk:

http://protocolsoftware.com/documents/mibs/saatrap.mib.txt

I changed the file name to SAATRAP.mib and I changed the name inside the file from 'saatrap' to 'SAATRAP'. After that I followed the directions at https://apps.splunk.com/app/1537/#/documentation to add a custom mib by issuing the following commands:

smidump -k -f python ./SAATRAP.mib | /usr/bin/libsmi2pysnmp > SAATRAP.py
smidump -k -f python ./RFC-1212.mib | /usr/bin/libsmi2pysnmp > RFC-1212.py

After issuing these commands I placed SAATRAP.py and RFC-1212.py into the etc/apps/snmp_ta/bin/mibs/ folder of my splunk installation, I added SAATRAP to the Custom Mib Names field under my SNMP data input. Now when I click Save for the my SNMP data input I get the following error:

01-02-2015 16:26:44.815 -0500 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/snmp_ta/bin/snmp.py" pysnmp.smi.error.SmiError: MIB module "/opt/splunk/etc/apps/snmp_ta/bin/mibs/SAATRAP.py" load error: ['Traceback (most recent call last):\n', '  File "/opt/splunk/etc/apps/snmp_ta/bin/pysnmp-4.2.5-py2.7.egg/pysnmp/smi/builder.py", line 255, in loadModules\n    exec(modData, g)\n', '  File "", line 10, in \n', '  File "/opt/splunk/etc/apps/snmp_ta/bin/pysnmp-4.2.5-py2.7.egg/pysnmp/smi/builder.py", line 302, in importSymbols\n    \'No module %s loaded at %s\' % (modName, self)\n', 'SmiError: No module RFC-1212 loaded at \n']

Any help regarding this error would be greatly appreciated.

[Damien_Dallimor]

Did you also add "RFC-1212" to the Custom Mib Names ?

SAATRAP,RFC-1212

[Damien_Dallimor]

re-generate RFC-1212.py as RFC1212.py

dashes should not be in python module names.

SAATRAP,RFC1212

[kumor]

After regenerating RFC1212.mib as RFC1212.py I get the following error which is essentially the same as the first one I posted only without the '-' in the name.

01-08-2015 11:14:27.151 -0500 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/snmp_ta/bin/snmp.py" pysnmp.smi.error.SmiError: MIB module "/opt/splunk/etc/apps/snmp_ta/bin/mibs/SAATRAP.py" load error: ['Traceback (most recent call last):\n', '  File "/opt/splunk/etc/apps/snmp_ta/bin/pysnmp-4.2.5-py2.7.egg/pysnmp/smi/builder.py", line 255, in loadModules\n    exec(modData, g)\n', '  File "<string>", line 11, in <module>\n', '  File "/opt/splunk/etc/apps/snmp_ta/bin/pysnmp-4.2.5-py2.7.egg/pysnmp/smi/builder.py", line 302, in importSymbols\n    \'No module %s loaded at %s\' % (modName, self)\n', 'SmiError: No module RFC1212 loaded at <pysnmp.smi.builder.MibBuilder instance at 0x7fdee5c0ac68>\n']

[Damien_Dallimor]

Are you sure you generated the python files correctly without any conversion errors ? Open them up , do they correctly contain the rolled out MIB content ?

[kumor]

The results of running the following commands:

smidump -p ./RFC1155-SMI.mib --level=6 -k -f python ./RFC1212.mib | libsmi2pysnmp > ./RFC1212.py

smidump -p ./RFC1155-SMI.mib --level=6 -k -f python ./RFC1215.mib | libsmi2pysnmp > ./RFC1215.py

smidump -p ./RFC1212.mib -p ./RFC1155-SMI.mib -p ./RFC1215.mib -p ./RFC1155-SMI.mib -c /etc/smi.conf --level=6 -f python SAATRAP.mib | libsmi2pysnmp > ./SAATRAP.py

are respectively:

./RFC1212.mib:9: MACRO definitions are only allowed in SMI base modules
./RFC1212.mib:61: CHOICE type definitions are only allowed in SMI base modules
./RFC1212.mib:74: warning: module name `RFC1212' should match `*-MIB'
./RFC1212.mib:4: warning: identifier `ObjectName' imported from module `RFC1155-SMI' is never used
smidump: module `./RFC1212.mib' contains errors, expect flawed output

./RFC1215.mib:7: MACRO definitions are only allowed in SMI base modules
./RFC1215.mib:34: warning: module name `RFC1215' should match `*-MIB'
./RFC1215.mib:4: warning: identifier `ObjectName' imported from module `RFC1155-SMI' is never used
smidump: module `./RFC1215.mib' contains errors, expect flawed output

SAATRAP.mib:134: warning: module name `SAATRAP' should match `*-MIB'
SAATRAP.mib:96: warning: implicit node definition

but each python output file contains information that looks correct as far as I can tell since I do not have much experience with this.

[krusty]

Are there any news regarding this problem?

I still have similar issues.

@kumor, is it possible that you post the saatrap.py?

[kumor]

Unfortunately I have not had much time to work on this, but here's a link to my SAATRAP.py file after removing the hyphen from RFC1212.mib and RFC1215.mib.

https://s3.amazonaws.com/nex-public-temp/saatrap/SAATRAP.py

[krusty]

Thanks kumor,

I compare your SAATRAP.py with mine.
Both are absolutly equal to each other.

@Damien, have you any idea how we can proceed with this issue?

Only for you Information.
I downloaded the RFC-1212 MIB and save it with the filename RFC-1212.txt. Then I executed this command: smidump -k -f python RFC-1212.txt | libsmi2pysnmp > RFC-1212.py without any Errors. I try to Import this into my Inputs.conf file. The result is, that I've got this error message in splunkd.log.

01-16-2015 13:53:00.477 +0100 ERROR ExecProcessor - message from "python /splunk/opt/splunk/etc/apps/snmp_ta/bin/snmp.py" pysnmp.smi.error.SmiError: MIB module "/splunk/opt/splunk/etc/apps/snmp_ta/bin/mibs/SAGTRAP.py" load error: ['Traceback (most recent call last):\n', '  File "/splunk/opt/splunk/etc/apps/snmp_ta/bin/pysnmp-4.2.5-py2.7.egg/pysnmp/smi/builder.py", line 255, in loadModules\n    exec(modData, g)\n', '  File "<string>", line 11, in <module>\n', '  File "/splunk/opt/splunk/etc/apps/snmp_ta/bin/pysnmp-4.2.5-py2.7.egg/pysnmp/smi/builder.py", line 302, in importSymbols\n    \'No module %s loaded at %s\' % (modName, self)\n', 'SmiError: No module RFC-1212 loaded at <pysnmp.smi.builder.MibBuilder instance at 0x7ffe9af00560>\n']

Where is my mistake?

[thaddeuslim]

Hi any updates on this? I am facing this exact same issue as well

[krusty]

@thaddeuslim, we found a new solution for this issue. We do not use snmp to get swift traps into splunk anymore. Sorry.

[bakdaulet]

Hello, can you tell what kind of solution did you find? Because i have the same problem.

[kumor]

Yes

I tried both

SAATRAP,RFC-1212

and

RFC-1212,SAATRAP