SNMP Modular Input: Why am I getting an error with SNMP polling of a Cisco switch when there are MIB dependencies?

[rjesse]

Hi Everyone,

Currently, I am attempting to use the SNMP modular input for SNMP polling of a Cisco Switch.

I have had success using a single MIB converted to a .py, but when attempting to use multiple MIB names converted to .py files, I get the following:

03-09-2015 20:11:42.003 -0600 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/snmp_ta/bin/snmp.py" pysnmp.smi.error.SmiError: MIB module "/opt/splunk/etc/apps/snmp_ta/bin/mibs/CISCOSBCpuCounters.py" load error: ['Traceback (most recent call last):\n', '  File "/opt/splunk/etc/apps/snmp_ta/bin/pysnmp-4.2.5-py2.7.egg/pysnmp/smi/builder.py", line 255, in loadModules\n    exec(modData, g)\n', '  File "<string>", line 7, in <module>\n', '  File "/opt/splunk/etc/apps/snmp_ta/bin/pysnmp-4.2.5-py2.7.egg/pysnmp/smi/builder.py", line 294, in importSymbols\n    \'importSymbols: empty MIB module name\'\n', 'SmiError: importSymbols: empty MIB module name\n']

It appears that there is a dependency that cannot be resolved in the MIB files from a CISCO MIB which relies on SNMPv2-SMI. The error leads me to believe that the CISCO MIB requires the SNMPv2-SMI file, however, the SNMPv2-SMI works by itself.

All the mibs and py files are located in /opt/splunk/etc/apps/snmp_ta/bin/mibs, and this is also set to my SMIPATH.

build-pysnmp-mib -o SNMPv2-SMI.py SNMPv2-SMI.my 

works as it does not have dependencies, however:

build-pysnmp-mib -o CISCOSBCpuCounters.py CISCOSBCpuCounters.mib
WARNING: empty MIB module name seen in smidump output at CISCOSB-CPU-COUNTERS-MIB

Will fail due to dependencies.

smidump of the CISCO MIB gives the error that the SNMPv2-SMI module is not found.

smidump -f smiv2 CISCOSMB.mib -k -l5
CISCOSMB.mib:5: macro `MODULE-IDENTITY' has not been imported from module `SNMPv2-SMI'

So, wherever a MIB file, such as the CISCO MIB, below, has a MODULE-IDENTITY from another MIB (SNMPv2-SMI), there seems to be a failure to find the second MIB file, as in the first few lines of the CISCO MIB:

CISCOSB-CPU-COUNTERS-MIB DEFINITIONS ::= BEGIN

IMPORTS
    Counter32, MODULE-IDENTITY, OBJECT-TYPE
        FROM SNMPv2-SMI

Any assistance to help with resolving would be most appreciated. pysnmp-4.2.5 installed, Python 2.6, Splunk 6.2.2, SNMP modular input 1.2.7.

Thanks!

EDIT: This issue persists, but I am a bit closer to the root cause.

When converting a MIB to a .py, the conversion fails if there is a MIB dependency. For example:

INPUT: smidump -p ./SNMPv2-SMI.mib --level=6 -k -f python ./SNMPv2-CONF.mib | libsmi2pysnmp > ./SNMPv2-CONF.py

OUTPUT ./SNMPv2-CONF.mib:4: identifier `ObjectSyntax' cannot be imported from module `SNMPv2-SMI'
smidump: module `./SNMPv2-CONF.mib' contains errors, expect flawed output

This fails, as the MIB being converted, SNMPv2-CONF has a dependency on the MIB SNMPv2-SMI. Thus the .py generated for SNMPv2-CONF will not work in Splunk. This issue persists even though dependant MIBs are preloaded (-p option). The MIB->.py conversion is successful only if there are no dependancies in the converted MIB. This issue persists across multiple vendor MIBs, and across Python v 2.6 and 2.7.

This leads me to think that the issue is with pysnmp and/and libsmi2pysnmp. Spunk SNMP modular input is working and will accept .py files that have been converted elsewhere, such as provided by https://github.com/Jaykul/snmp-demo1 . So we, at this point, can not create any vendor specific .py files for use in Splunk.

Any direction would be appreciated!

[rjesse · Accepted solution]

@Damien: Thanks for your pointer!

This issue was not caused by the SNMP Modular input. Rather, the conversion from MIB file to PY was the issue. For the conversion to be successfull from MIB to Py, the MIB must first be in SMI version 2 format. One of the MIB files I had was a version 1 MIB. Therefore, that MIB would need to be converted from SMI1 to SMI2, then convert to py. Before converting a MIB to, validate the starting version is 2.

First, convert a SMIv2 to SMIv2:

smidump --level=6 -k -f smiv2  CISCOSB-mib.mib > CISCO-mib2.mib

Then convert SMIv2 to PY:

smidump --level=6 -k -f python -p ./SNMPv2-SMI.mib CISCO-mib2.mib | libsmi2pysnmp > ./CISCO-mib2.py

SMIv2 MIB will have a MODULE-IDENTITY node, but SMIv1 MIBs have no MODULE-IDENTITY node. Additionally, helpful to turn verbose error reporting on with "--level=6", rather than a silent fail.

[Damien_Dallimor]

See if the answer here helps your MIB resolution when you are trying to perform the py conversion : http://answers.splunk.com/answers/216296/cannot-resolve-node-name-for-custom-mibs.html#answer-216812