Adding Custom MIBs

[nandipatisunil]

Any updates on this

"This is all just an interim measure until pysnmp supports plain text MIB files, a development feature in the pipeline for pysnmp. When that feature is ready , all you will have to do is drop the plain text MIB in the SPLUNK_HOME/etc/apps/snmp_ta/bin/mibs and the SNMP Modular Input will do the rest. Watch this space !"

I am having a rough time converting my custom MIBs to Py and adding them to the egg.
I am using Windows 7. As per the documentation it says i need to have pysnmp to get the utility to convert it. Is there a way around?

[Damien_Dallimor]

General note : as soon as the underlying library (pysnmp) supports plain text MIBS , a work item in the project pipeline , then this need to convert 3rd party MIBs to python modules will go away. You'll just drop in your plain text MIB files and SNMP Mod Input will automatically pick them up and load them in.

[Damien_Dallimor]

As per the documentation , currently 3rd party MIBs need to be converted to Python modules and dropped in snmp_ta/bin/mibs. In the future you'll be able to bypass this conversion step and just drop in the plain text MIB file.

[saurabhkunte]

Hello,

Is this still a requirement ? Also, some of the custom MIBs i want to import are with .txt extension. Please let me know. Thanks.

[nandipatisunil]

Hi Damien, So does that mean currently it does not work if i drop the MIB in the location?

[MartinMcNutt · Accepted solution]

As a windows person, this was a very painful process for me. I was able to use the smidump from Here to compile the Mib into a python file.

Example:
smidump -f python SYMANTEC-EMAIL-SECURITY.MIB >SYMANTEC-EMAIL-SECURITY.MIB.PY




another Example from nandipatisunil's comments: 
smidump -f python -p <path to="" load_mib_module=""> -p <path to="" load="" another="" mib="" module=""> mymibfile.mib > mymibfile.py

[nandipatisunil]

Thanks Martin. I threw the .py file in the mibs folder. I mentioned my MIB name in the MIB names column in my SNMP data input settings. I was expecting the trap data i am receiving on my 162 port to be decrypted to more key value pairs using the definitions in my custom MIB. however i am still seeing most of the data is still sitting in the message and not getting converted to more keys. Am i missing something more?

[MartinMcNutt]

No need for the egg. Just throw the .py file in the mibs folder and you are ready to go. The latest version removed the *.egg requirement.

[nandipatisunil]

finally i did something like this and was able to create the .py file

smidump -f python -p -p mymibfile.mib > mymibfile.py

Now figuring out a way to 'egg' up.

[nandipatisunil]

I tried copying the MIBs into the bin folder as suggested, i also created a environment variable SMIPATH to point to my mibs folder where i had the SNMPV2-SMI, RFC1155-SMI, etc.

But I still am getting the same error messages.

[MartinMcNutt]

When I was working with the Brightmail gateways, I placed all the mibs on the page (about 4-5 of them) and placed them into the BIN folder.

When I executed the smidump, I didnt have any trouble.

If this works for you too...let me know and I will update my answer to reflect these changes.

BTW: Are you able to place a windows Tag on this?

[nandipatisunil]

I downloaded the smidump from suggested link above. When trying to run the command

smidump -f python alarms.mib >alarms.mib.py

getting the following errors

alarms.mib:5: failed to locate MIB module SNMPv2-SMI'
alarms.mib:7: failed to locate MIB moduleRFC1155-SMI'
alarms.mib:9: failed to locate MIB module RFC-1212'
alarms.mib:11: failed to locate MIB moduleRFC-1215'
alarms.mib:1012: unknown type IpAddress'
...
alarms.mib:14: unknown object identifier labelenterprises'
smidump: module `alarms.mib' contains errors, expect flawed output

I can see all the MIBs at ..\smi\mibs\ietf.

[MartinMcNutt]

32bit / 64bit is not an issue as this util is simply converting the MIB into a python supported file. You will use the utility for 1 second and never use it again unless the MIBs get update. So make sure you make note of it.

Once you have the converted MIB you drop it into the MIB folder and configure the data input. When enter the MIB name you have to drop the .py extention.

Splunk will run python in the background to pull the information.

[nandipatisunil]

does this support windows 64 bit?