All Apps and Add-ons

SNMP modular input not indexing data for multiple oid's in v3

d12harshal
Path Finder

SNMP v3 (AuthNoPriv) is not indexing data when it contains multiple comma separated OID's in configuration.
[snmp://<ip>]
destination = <ip>
do_bulk_get = 1
host = <ip>
index = netapp
ipv6 = 0
mib_names = NETWORK-APPLIANCE-MIB
object_names = 1.3.6.1.4.1.789.1.5.11.1.9,1.3.6.1.4.1.789.1.5.4.1.1,1.3.6.1.4.1.789.1.5.4.1.10,1.3.6.1.4.1.789.1.5.4.1.14,1.3.6.1.4.1.789.1.5.4.1.15,1.3.6.1.4.1.789.1.5.4.1.16,1.3.6.1.4.1.789.1.5.4.1.17,1.3.6.1.4.1.789.1.5.4.1.18,1.3.6.1.4.1.789.1.5.4.1.19
snmp_mode = attributes
snmp_version = 3
snmpinterval = 60
sourcetype = IP
split_bulk_output = 1
v3_authProtocol = usmHMACMD5AuthProtocol
v3_privProtocol = usmDESPrivProtocol
v3_securityName = User_name
v3_authKey = PassWord

But if I configure it with only one OID then it is getting data into Splunk.

object_names = 1.3.6.1.4.1.789.1.5.11.1.9

This problem is with SNMP v3 version please help.

Thanks in advance
Harshal

0 Karma

Damien_Dallimor
Ultra Champion

Well , according to your log message :

Exception with bulkCmd to <ip>:161: string index out of range

One of your OIDs is most likely incorrect for performing an SNMP walk.

0 Karma

d12harshal
Path Finder

Hi Damien, I have tested SNMP with SNMP v2 and it works for multiple OIDs successfully. When I change it to SNMP v3 it doesn't working with multiple OIDs, but it works with single OID (one OID) at a time.
Following is the error for SNMP v3 multiple OIDs: "No SNMP response received before timeout".
Thanks

0 Karma

askhat_pernebek
Path Finder

Hello!
Did you solve this problem?
I have similar problem, but with multiple hosts. I have 140 servers, which cpu i must monitor, and use snmp polling for it. But from 140 servers, i get only 110-120. And after every restart of splunk, the number of servers change between 110-120. For example if taking from server A smnp logs, after restart it may not work.
And in splunkd.log getting similar error like yours:
05-20-2020 09:54:41.578 +0600 ERROR ExecProcessor - message from "/opt/splunk/bin/python2.7 /opt/splunk/etc/apps/snmp_ta/bin/snmp.py" obj.handle_error()
05-20-2020 10:16:31.405 +0600 ERROR ExecProcessor - message from "/opt/splunk/bin/python2.7 /opt/splunk/etc/apps/snmp_ta/bin/snmp.py" Exception with getCmd to 192.168.1.34:161: poll error: Traceback (most recent call last):

0 Karma

askhat_pernebek
Path Finder

By the way, for one input I'm writing 3 hosts. And now have 47 data inputs.

0 Karma

d12harshal
Path Finder

06-20-2014 14:02:58.404 +0200 ERROR ExecProcessor - message from "python "D:\Program files\Splunk\etc\apps\snmp_ta\bin\snmp.py"" snmp_stanza:snmp://<ip> snmp_destination:<ip> snmp_port:161

0 Karma

d12harshal
Path Finder

I have configured all OIDs separately to check whether it indexes data. Then Splunk is collecting data from all OIDs. But when I configure multiple OIDs at one time following message occurred please help.

Disabled "Perform GET BULK" and "Split Bulk Results".

06-20-2014 14:02:58.404 +0200 ERROR ExecProcessor - message from "python "D:\Program files\Splunk\etc\apps\snmp_ta\bin\snmp.py"" Exception with getCmd to <ip>:161: poll error: Traceback (most recent call last):

0 Karma

d12harshal
Path Finder

And also following error.
6/18/14
1:44:32.817 PM
06-18-2014 13:44:32.817 +0200 ERROR ExecProcessor - message from "python "D:\Program files\Splunk\etc\apps\snmp_ta\bin\snmp.py"" No SNMP response received before timeout snmp_stanza:snmp://<ip> snmp_destination:<ip> snmp_port:161

But if I configure it with one or two OIDs Splunk indexing data and no error message please help. I am using SNMP modular input v1.2.3 and Splunk 6.0

0 Karma

d12harshal
Path Finder

06-18-2014 11:35:43.593 +0200 ERROR ExecProcessor - message from "python "D:\Program files\Splunk\etc\apps\snmp_ta\bin\snmp.py"" Exception with bulkCmd to :161: string index out of range snmp_stanza:snmp:// snmp_destination: snmp_port:161

0 Karma

Damien_Dallimor
Ultra Champion

Any error messages ?

Search -> index=_internal ExecProcessor error snmp.py

0 Karma
Take the 2021 Splunk Career Survey

Help us learn about how Splunk has
impacted your career by taking the 2021 Splunk Career Survey.

Earn $50 in Amazon cash!