SNMPTD - Trap monitor not displaying received traps

[Joachim Stenhjem]

Hi

UIM20.3
Any suggestions or experience for the SNMPTD trap probe v3.30 and problems for displaying the received traps.
I've also tried the hotfix list and the latest 3.30T3 release. No change.



------------------------------
Senior engineer
NetNordic.com
Norway
------------------------------

[Jonathan GENTILHOMME]

Hi Joachim,

First: The SNMPTD probe upgrades beyond version 3.30, does not include any modification on the functionality of the probe for which you encounter a problem. You will not have any improvement with the current HotFix.

Second: Note that the SNMPTD probe will only display SNMP Traps received in UDP. It will not display any "GET" requests received over TCP or UDP.

Have you been able to make theses checks:

 - with Wireshark (or equivalent) to make sure that the network adapter was receiving the SNMP Traps

You can use this filter in your Wireshark capture:


 - check that your snmptd probe, in settings, is listening on the required UDP ports (162, but you can also add 161. Either a parameter such as "161,162", with tilds to separate the list of ports)

 - if the two previous points are OK, use a small software to simulate an SNMP trap from another server in the same subnet (if it's possivle). If you are not too "command line" friendly, I recommend you: iReasoning MIB Brower. It integrate a simulator with GUI (https://www.ireasoning.com/download.shtml)
    o If you don't see anything in Wireshark, even after simulating an SNMP trap, don't forget to look at your Firewall settings.

The received "SNMP Traps" will even being show even if you don't have the associated MIBs. So at this point, the problem is probably not there.

If you wish, you can attach one of your log files with "level" set to 5. This will allow us to see if the probe is receiving something, and if it doesn't fail during its initialization.

Best regards,
Jonathan

------------------------------
Lead Monitoring Solution Architect
AXA Investment Managers Paris
------------------------------

[Joachim Stenhjem]

Hi, Jonathan!
Thanks for your feedback. My concern is only for the obvious bug in the probe and if anyone had any suggestions for workaround. We've the probe running on several zones, but some of them are showing these passive trap debug issue.

Thank again for you efforts.
Br
J

------------------------------
Senior engineer
NetNordic.com
Norway
------------------------------

[Andrew Cooper]

Joachim

I am not sure what you mean by the "obvious" bug in the probe.  If you are receiving v1 or v2 traps on a UDP it is listening on then they should be displayed.  For v3 you need to have registered the "engineID" before it is displayed, which is a pain.

As to the decoding the traps based on the "registered" mibs is a different issue. The probe has difficulty with some of the newer constructs (look at the release date of v3.30) :)

Regards, Andrew

------------------------------
Knows a little about UIM/DXim, AE, Automic
------------------------------

[Joachim Stenhjem]

Thanks for your feedback, Andrew! The "bug" is not receiving the traps or parcening the traps, but displaying them in the SNMP Trap Monitor. The SNMP trap monitor tool is normally and in many other of our monitoring robots functional and good tool to efficient pick the correct traps to monitor. See my original post. I'm sorry for my unprecise statement in my original post.
rgs
J

------------------------------
Senior engineer
NetNordic.com
Norway
------------------------------

[Luc Christiaens]

Tested on w2016 and uim 20.3.2 and snmptd trap monitor works fine with me.

[Andrew Cooper]

Luc

are you running IM (trap monitor) on the same system where the snmptd probe is installed? I run IM on a different host (primary hub) and the snmptd probe is on a robot connected to a different 2nd layer hub and I see the same issue as Joachim, it's just that I do not use the trap monitor (always used the log) that I never noticed before.

Regards, Andrew

------------------------------
Knows a little about UIM/DXim, AE, Automic
------------------------------

[Luc Christiaens]

Yes, in this test environment all components are on the same server