Re: [Devmon] "devmon tests go purple" issue

[xbgmsharp <xbg...@gm...>]

 From this:
http://www.cisco.com/en/US/docs/net_mgmt/ciscoworks_ciscoview/4.1/quick/guide/cvgstrcv.html


SNMP Error Messages
 tooBig:
The request you made cannot fit into a single packet. Generally, 
CiscoView splits requests for physical view status until the device can 
respond. In certain cases, CiscoView assumes that if an agent times out 
on 20 or more variables, the agent might not be able to respond because 
the request is too big; it splits the request and resends it. Check that 
the MTU size on the SNMP interface is as large as possible so that 
CiscoView does not waste bandwidth by sending more than one request.



xbgmsharp a écrit :
> Re,
>
> Could you add this line:
>
>           my ($bindings) = $session->decode_get_response($response);
>           if(!defined $bindings or $bindings eq '') {
>             my $snmp_err;
>         do_log("DEBUG SNMP MSG: $SNMP_Session::errmsg()",0) if $g{'debug'}
>             ($snmp_err = $SNMP_Session::errmsg) =~ s/\n.*//s;
>
> on line  474 in the file modules/dm_snmp.pm.
>
> SNMP Error:
> Received SNMP response with error code
>   error status: tooBig
>   index 0
> SNMPv2c_Session (.......
>
> I got this error  the error code "error status: tooBig" is explain.
> http://www.juniper.net/security/auto/vulnerabilities/vuln2591.html
>
> it seen very weird.
> But if i remove a test everything is fine. Also if i pool it by hand 
> with smnpwalk or snmpget it is working.
> Could you also test and tell me you have the same error msg.
>
> Here is a shell command which allow you test all oid from a template.
>
> find . -type f -name "oids" | xargs cat | cut -d ':' -f 2 | tr -d ' ' | 
> grep -v "^$" | awk '{ print "snmpwalk -t 5 -On -v2c -c COMMUNAUTY  IP " 
> $1 }' | sh
>
>
>
> Francois.
>
>
>
>
> Nathan Hand a écrit :
>   
>> On Tue, 18 Dec 2007 23:05:48 +0100, "xbgmsharp" <xbg...@gm...>
>> said:
>>   
>>     
>>>> Short summary:  If any single oid fails to retrieve then devmon stops
>>>> collecting the rest of the oids in the template.
>>>>
>>>> I've confirmed this hypothesis with with -f -p -vvvvvvvvvvv. Devmon
>>>> says something about "too many failures" and "skipping device".
>>>> Perhaps devmon should only skip that single column and still test the
>>>> others.
>>>>       
>>>>         
>>> In the code,  when 2 tests fails it stop chec the device and send a  
>>> clear status.
>>>
>>> in modules/dm_snmp.pm
>>>
>>>    535        # We dont want to do every table if we are failing alot of
>>>    walks
>>>    536         if($failed_query > 2) {
>>>    537           my $error_str =
>>>    538             "Failed too many queries on $dev, aborting query";
>>>    539           $data_out{'error'}{$error_str} = 1;
>>>    540           send_data($sock, \%data_out);
>>>    541           $session->close();
>>>    542           next DEVICE;
>>>    543         }
>>>
>>>
>>> I have the same problem with memory on my pix.
>>>
>>> But it never made the test go purple.
>>>     
>>>       
>> The interesting thing is it makes _other_ tests go purple.
>>
>> My guess is that because it aborts the device query it doesn't send any
>> message for subsequent tests on that device, not even clear messages. So
>> after an hour the other tests go purple. 
>>
>>   
>>     
>
> -------------------------------------------------------------------------
> SF.Net email is sponsored by:
> Check out the new SourceForge.net Marketplace.
> It's the best place to buy or sell services
> for just about anything Open Source.
> http://ad.doubleclick.net/clk;164216239;13503038;w?http://sf.net/marketplace
> _______________________________________________
> Devmon-support mailing list
> Dev...@li...
> https://lists.sourceforge.net/lists/listinfo/devmon-support
>
>