Re: [Devmon] "devmon tests go purple" issue

[xbgmsharp <xbg...@gm...>]

Re,

Could you add this line:

          my ($bindings) = $session->decode_get_response($response);
          if(!defined $bindings or $bindings eq '') {
            my $snmp_err;
        do_log("DEBUG SNMP MSG: $SNMP_Session::errmsg()",0) if $g{'debug'}
            ($snmp_err = $SNMP_Session::errmsg) =~ s/\n.*//s;

on line  474 in the file modules/dm_snmp.pm.

SNMP Error:
Received SNMP response with error code
  error status: tooBig
  index 0
SNMPv2c_Session (.......

I got this error  the error code "error status: tooBig" is explain.
http://www.juniper.net/security/auto/vulnerabilities/vuln2591.html

it seen very weird.
But if i remove a test everything is fine. Also if i pool it by hand 
with smnpwalk or snmpget it is working.
Could you also test and tell me you have the same error msg.

Here is a shell command which allow you test all oid from a template.

find . -type f -name "oids" | xargs cat | cut -d ':' -f 2 | tr -d ' ' | 
grep -v "^$" | awk '{ print "snmpwalk -t 5 -On -v2c -c COMMUNAUTY  IP " 
$1 }' | sh



Francois.




Nathan Hand a écrit :
> On Tue, 18 Dec 2007 23:05:48 +0100, "xbgmsharp" <xbg...@gm...>
> said:
>   
>>> Short summary:  If any single oid fails to retrieve then devmon stops
>>> collecting the rest of the oids in the template.
>>>
>>> I've confirmed this hypothesis with with -f -p -vvvvvvvvvvv. Devmon
>>> says something about "too many failures" and "skipping device".
>>> Perhaps devmon should only skip that single column and still test the
>>> others.
>>>       
>> In the code,  when 2 tests fails it stop chec the device and send a  
>> clear status.
>>
>> in modules/dm_snmp.pm
>>
>>    535        # We dont want to do every table if we are failing alot of
>>    walks
>>    536         if($failed_query > 2) {
>>    537           my $error_str =
>>    538             "Failed too many queries on $dev, aborting query";
>>    539           $data_out{'error'}{$error_str} = 1;
>>    540           send_data($sock, \%data_out);
>>    541           $session->close();
>>    542           next DEVICE;
>>    543         }
>>
>>
>> I have the same problem with memory on my pix.
>>
>> But it never made the test go purple.
>>     
>
> The interesting thing is it makes _other_ tests go purple.
>
> My guess is that because it aborts the device query it doesn't send any
> message for subsequent tests on that device, not even clear messages. So
> after an hour the other tests go purple. 
>
>