Re: snmptrapd - decoding OIDs not working

On Mon, Mar 19, 2012 at 12:47 PM, Steele, John <[email protected]> wrote:
> I am trying to use net snmp to receive traps from a CISCO network component.
> It is receiving the traps but is not decoding them correctly
>
>
>
> Translate gives me a decoded MIB. Snmptrapd does not.  I have not found a
> way of getting it to accept the additional Cisco MIBs
>
>
>
> snmptrapd.conf
>
> createuser -e 0x800000090300002414C27803 user_v3_priv SHA v3_authpw1 AES
> v3_encpwd
>
> authuser log user_v3_priv
>
> snmpTrapdAddr udp:200.1.1.100:1162
>
>
>
> format2 %V\n% PDU Address: %b \n PDU Hostname: %B \n Date: %0.4y-%0.2m-%0.2l
> %0.2h:%0.2j:%0.2k \n Enterprise OID: %N \n Trap Type: %w \n Trap Sub-Type:
> %q \n Community/Infosec Context: %P \n Uptime: %T \n Description: %W \n PDU
> Attribute/Value Pair Array:\n%v \n -------------- \n
>
>
>
> Command Line
>
> c:\usr\bin\snmptrapd -C -c c:\usr\temp\snmptrapd.conf -Lo

You must tell snmptrapd where the mibs are with -m just like you would
snmpd.  All of the options for start/stop apply to all of the
daemons/utilities.

>
>
>
> Output with no MIBS
>
> PDU Address: UDP: [200.1.1.1]:53778->[0.0.0.0]:0
>
> PDU Hostname: <UNKNOWN>
>
> Date: 2012-03-19 17:08:39
>
> Enterprise OID: .
>
> Trap Type: 0
>
> Trap Sub-Type: 0
>
> Community/Infosec Context: TRAP2, SNMP v3, user user_v3_priv, context
>
> Uptime: 0
>
> Description: Cold Start
>
> PDU Attribute/Value Pair Array:
>
> iso.3.6.1.2.1.1.3.0 = Timeticks: (52281014) 6 days, 1:13:30.14
>
> iso.3.6.1.6.3.1.1.4.1.0 = OID: iso.3.6.1.4.1.9.9.43.2.0.1
>
> iso.3.6.1.4.1.9.9.43.1.1.6.1.3.192 = INTEGER: 1
>
> iso.3.6.1.4.1.9.9.43.1.1.6.1.4.192 = INTEGER: 2
>
> iso.3.6.1.4.1.9.9.43.1.1.6.1.5.192 = INTEGER: 3
>
> --------------
>
> Output using format2 using standard MIBs plus CISCO MIBS
>
> PDU Address: UDP: [200.1.1.1]:53778->[0.0.0.0]:0
>
> PDU Hostname: <UNKNOWN>
>
> Date: 2012-03-19 16:06:28
>
> Enterprise OID: .
>
> Trap Type: 0
>
> Trap Sub-Type: 0
>
> Community/Infosec Context: TRAP2, SNMP v3, user user_v3_priv, context
>
> Uptime: 0
>
> Description: Cold Start
>
> PDU Attribute/Value Pair Array:
>
> DISMAN-EXPRESSION-MIB::sysUpTimeInstance = Timeticks: (51907902) 6 days,
> 0:11:19
>
> .02
>
> SNMPv2-MIB::snmpTrapOID.0 = OID: SNMPv2-SMI::enterprises.9.9.41.2.0.1
>
> SNMPv2-SMI::enterprises.9.9.41.1.2.3.1.2.147 = STRING: "SYS"
>
> SNMPv2-SMI::enterprises.9.9.41.1.2.3.1.3.147 = INTEGER: 6
>
> SNMPv2-SMI::enterprises.9.9.41.1.2.3.1.4.147 = STRING: "CONFIG_I"
>
> SNMPv2-SMI::enterprises.9.9.41.1.2.3.1.5.147 = STRING: "Configured from
> console
>
> by admin on vty0 (200.1.1.100)"
>
> SNMPv2-SMI::enterprises.9.9.41.1.2.3.1.6.147 = Timeticks: (51907902) 6 days,
> 0:1
>
> 1:19.02
>
> --------------
>
> As far as I can tell I have copied the CISCO MIBs into the correct place and
> the snmptranslate  utility can translate the OIDs correctly.
>
> C:\usr\bin>snmptranslate 1.3.6.1.4.1.9.9.43.2.0.1
>
> CISCO-CONFIG-MAN-MIB::ciscoConfigManEvent
>
>
>
>
>
> John Steele
>
> HP Enterprise Services UK Ltd
> 1-3 Bartley Wood Business Park, Units A & B, Hook, United Kingdom,RG27 9XA
>
>
>
> Mobile: +44 7875 876573
>
> Email: [email protected]
>
>
>
> HP Enterprise Services UK Ltd registered office: Cain Road, Bracknell, Berks
> RG12 1HN.  Registered No: 90597 England.
>
>
>
> The contents of this message and any attachments to it are confidential and
> may be legally privileged. If you have received this message in error, you
> should delete it from your system immediately and advise the sender.  To any
> recipient of this message within HP, unless otherwise stated you should
> consider this message and attachments as "HP CONFIDENTIAL".
>
>
>
>
>
> Please consider the environment before printing this email.
>
>
>
>
>
>
> ------------------------------------------------------------------------------
> This SF email is sponsosred by:
> Try Windows Azure free for 90 days Click Here
> http://p.sf.net/sfu/sfd2d-msazure
> _______________________________________________
> Net-snmp-users mailing list
> [email protected]
> Please see the following page to unsubscribe or change other options:
> https://lists.sourceforge.net/lists/listinfo/net-snmp-users
>

------------------------------------------------------------------------------
This SF email is sponsosred by:
Try Windows Azure free for 90 days Click Here 
http://p.sf.net/sfu/sfd2d-msazure
_______________________________________________
Net-snmp-users mailing list
[email protected]
Please see the following page to unsubscribe or change other options:
https://lists.sourceforge.net/lists/listinfo/net-snmp-users