Re: [Devmon] "devmon tests go purple" issue

[xbgmsharp <xbg...@gm...>]

Hi all,

After a day of DEBUG. I works.
I modify the file dm_snmp.pm which do snmp pooling.
So now instead of pooling all leaf oid in one request, 1 oid equal 1 request.
So now than i am pooling each oid separitly devmon should not go purple.
I try to make it per pakets like 5 or 10 but devmon get lost when corresponding data with test done in dm_tests.pm

I will let it working on some PIX and F5 devices and commit by the end of the week.

All of this, is for not getting SNMP Error: "error status: tooBig".
Because of this error all my leaf test was going clear.

Comments?

Regards,
Francois





xbgmsharp a écrit :
>  From this:
> http://www.cisco.com/en/US/docs/net_mgmt/ciscoworks_ciscoview/4.1/quick/guide/cvgstrcv.html
>
>
> SNMP Error Messages
>  tooBig:
> The request you made cannot fit into a single packet. Generally, 
> CiscoView splits requests for physical view status until the device can 
> respond. In certain cases, CiscoView assumes that if an agent times out 
> on 20 or more variables, the agent might not be able to respond because 
> the request is too big; it splits the request and resends it. Check that 
> the MTU size on the SNMP interface is as large as possible so that 
> CiscoView does not waste bandwidth by sending more than one request.
>
>
>
> xbgmsharp a écrit :
>   
>> Re,
>>
>> Could you add this line:
>>
>>           my ($bindings) = $session->decode_get_response($response);
>>           if(!defined $bindings or $bindings eq '') {
>>             my $snmp_err;
>>         do_log("DEBUG SNMP MSG: $SNMP_Session::errmsg()",0) if $g{'debug'}
>>             ($snmp_err = $SNMP_Session::errmsg) =~ s/\n.*//s;
>>
>> on line  474 in the file modules/dm_snmp.pm.
>>
>> SNMP Error:
>> Received SNMP response with error code
>>   error status: tooBig
>>   index 0
>> SNMPv2c_Session (.......
>>
>> I got this error  the error code "error status: tooBig" is explain.
>> http://www.juniper.net/security/auto/vulnerabilities/vuln2591.html
>>
>> it seen very weird.
>> But if i remove a test everything is fine. Also if i pool it by hand 
>> with smnpwalk or snmpget it is working.
>> Could you also test and tell me you have the same error msg.
>>
>> Here is a shell command which allow you test all oid from a template.
>>
>> find . -type f -name "oids" | xargs cat | cut -d ':' -f 2 | tr -d ' ' | 
>> grep -v "^$" | awk '{ print "snmpwalk -t 5 -On -v2c -c COMMUNAUTY  IP " 
>> $1 }' | sh
>>
>>
>>
>> Francois.
>>
>>
>>
>>
>> Nathan Hand a écrit :
>>   
>>     
>>> On Tue, 18 Dec 2007 23:05:48 +0100, "xbgmsharp" <xbg...@gm...>
>>> said:
>>>   
>>>     
>>>       
>>>>> Short summary:  If any single oid fails to retrieve then devmon stops
>>>>> collecting the rest of the oids in the template.
>>>>>
>>>>> I've confirmed this hypothesis with with -f -p -vvvvvvvvvvv. Devmon
>>>>> says something about "too many failures" and "skipping device".
>>>>> Perhaps devmon should only skip that single column and still test the
>>>>> others.
>>>>>       
>>>>>         
>>>>>           
>>>> In the code,  when 2 tests fails it stop chec the device and send a  
>>>> clear status.
>>>>
>>>> in modules/dm_snmp.pm
>>>>
>>>>    535        # We dont want to do every table if we are failing alot of
>>>>    walks
>>>>    536         if($failed_query > 2) {
>>>>    537           my $error_str =
>>>>    538             "Failed too many queries on $dev, aborting query";
>>>>    539           $data_out{'error'}{$error_str} = 1;
>>>>    540           send_data($sock, \%data_out);
>>>>    541           $session->close();
>>>>    542           next DEVICE;
>>>>    543         }
>>>>
>>>>
>>>> I have the same problem with memory on my pix.
>>>>
>>>> But it never made the test go purple.
>>>>     
>>>>       
>>>>         
>>> The interesting thing is it makes _other_ tests go purple.
>>>
>>> My guess is that because it aborts the device query it doesn't send any
>>> message for subsequent tests on that device, not even clear messages. So
>>> after an hour the other tests go purple. 
>>>
>>>   
>>>