All Apps and Add-ons
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Search instead for 
Did you mean: 
Ask a Question

ERROR ExecProcessor when using custom MIBS

nujauh
New Member
‎06-09-2015 10:46 PM

06-10-2015 03:16:55.965 +0800 ERROR ExecProcessor - message from "python /SERVICE01/splunk/etc/apps/snmp_ta/bin/snmp.py" pysnmp.smi.error.SmiError: MIB module "/SERVICE01/splunk/etc/apps/snmp_ta/bin/mibs/HUAWEI-ENTITY-EXTENT-MIB.py" load error: ['Traceback (most recent call last):\n', ' File "/SERVICE01/splunk/etc/apps/snmp_ta/bin/pysnmp-4.2.5-py2.7.egg/pysnmp/smi/builder.py", line 255, in loadModules\n exec(modData, g)\n', ' File "<string>", line 11, in <module>\n', ' File "/SERVICE01/splunk/etc/apps/snmp_ta/bin/pysnmp-4.2.5-py2.7.egg/pysnmp/smi/builder.py", line 299, in importSymbols\n self.loadModules(modName, **userCtx)\n', ' File "/SERVICE01/splunk/etc/apps/snmp_ta/bin/pysnmp-4.2.5-py2.7.egg/pysnmp/smi/builder.py", line 259, in loadModules\n \'MIB module \"%s\" load error: %s\' % (modPath, traceback.format_exception(*sys.exc_info()))\n', 'SmiError: MIB module "/SERVICE01/splunk/etc/apps/snmp_ta/bin/mibs/HUAWEI-MIB.py" load error: [\'Traceback (most recent call last):\n\', \' File "/SERVICE01/splunk/etc/apps/snmp_ta/bin/pysnmp-4.2.5-py2.7.egg/pysnmp/smi/builder.py", line 255, in loadModules\n exec(modData, g)\n\', \' File "<string>", line 320\n\', \' as = MibIdentifier((1, 3, 6, 1, 4, 1, 2011, 2, 36))\n\', \' ^\n\', \'SyntaxError: invalid syntax\n\']\n']

/SERVICE01/splunk/etc/apps/launcher/local # more inputs.conf
[snmp://HUAWEI-ENTITY-EXTENT-MIB]
communitystring =
destination =
do_bulk_get = 0
do_get_subtree = 0
ipv6 = 0
mib_names = HUAWEI-ENTITY-EXTENT-MIB
object_names = .1.3.6.1.4.1.2011.5.25.31.1.1.1.1.5.67633161
snmp_mode = attributes
snmp_version = 2C
snmpinterval = 300
sourcetype = snmp_ta
split_bulk_output = 0
trap_rdns = 0
v3_authProtocol = usmHMACMD5AuthProtocol
v3_privProtocol = usmDESPrivProtocol
index = snmp_ta

splunk/etc/apps/snmp_ta/bin/mibs # ll
total 4848
-rw-r--r-- 1 root root 106241 Jun 9 08:50 HUAWEI-ENTITY-EXTENT-MIB.py
-rw-r--r-- 1 root root 57835 Jun 9 08:50 HUAWEI-MIB.py
-rw-r--r-- 1 root root 102147 Jun 9 08:50 HUAWEI-SYS-MAN-MIB.py
-rw------- 1 root root 4669138 Jun 8 06:04 pysnmp_mibs-0.1.4-py2.7.egg

Tags (1)
0 Karma
Reply

Damien_Dallimor
Ultra Champion
‎06-10-2015 06:25 AM

Try importing all the MIBS.

Change :

mib_names = HUAWEI-ENTITY-EXTENT-MIB

To:

mib_names = HUAWEI-ENTITY-EXTENT-MIB,HUAWEI-MIB,HUAWEI-SYS-MAN-MIB
0 Karma
Reply

Damien_Dallimor
Ultra Champion
‎06-10-2015 08:14 PM

You most likely have not converted your MIBS to python modules correctly , perhaps smidump did not resolve the MIB dependencies correctly , something I see often.

See this answer regarding MIB dependencies : http://answers.splunk.com/answers/216296/cannot-resolve-node-name-for-custom-mibs.html#answer-216812

0 Karma
Reply

nujauh
New Member
‎06-22-2015 11:24 PM

retry with smidump and smi.conf, how to know the MIB dependencies

server01:/tmp/MIB # smidump -f python HUAWEI-MIB.mib | libsmi2pysnmp > HUAWEI-MIB.py
HUAWEI-MIB.mib:31: revision for last update is missing
server01:/tmp/MIB # smidump -c /etc/smi.conf -k -f python HUAWEI-ENTITY-EXTENT-MIB.mib | libsmi2pysnmp > HUAWEI-ENTITY-EXTENT-MIB.py
smidump: module `HUAWEI-ENTITY-EXTENT-MIB.mib' contains errors, expect flawed output
server01:/tmp/MIB # more /etc/smi.conf
....skip.....
path :/tmp/MIB
....skip.....
load HUAWEI-MIB

0 Karma
Reply

Damien_Dallimor
Ultra Champion
‎06-23-2015 12:02 AM

Open up the plain text MIB , the imports(dependencies) will be listed near the top of the file

0 Karma
Reply

nujauh
New Member
‎06-23-2015 01:57 AM

it seems that only the HUAWEI-MIB is private one. what should i do next？thanks!

server01:/tmp/MIB # more HUAWEI-ENTITY-EXTENT-MIB.mib

-- HUAWEI-ENTITY-EXTENT-MIB.mib
-- MIB generated by Visual MIB Builder Version 4.0 Build 341

-- Friday, July 15, 2011 at 16:41:48

HUAWEI-ENTITY-EXTENT-MIB DEFINITIONS ::= BEGIN

    IMPORTS
        entPhysicalIndex, entPhysicalVendorType, PhysicalClass, PhysicalIndex            
            FROM ENTITY-MIB            
        hwDatacomm            
            FROM HUAWEI-MIB            
        InterfaceIndex            
            FROM IF-MIB            
        EnabledStatus            
            FROM P-BRIDGE-MIB            
        SnmpAdminString            
            FROM SNMP-FRAMEWORK-MIB            
        OBJECT-GROUP, MODULE-COMPLIANCE, NOTIFICATION-GROUP            
            FROM SNMPv2-CONF            
        Integer32, Unsigned32, Counter64, BITS, OBJECT-TYPE, MODULE-IDENTITY, NOTIFICATION-TYPE            
            FROM SNMPv2-SMI            
        DateAndTime, DisplayString, RowStatus, TEXTUAL-CONVENTION, AutonomousType            
            FROM SNMPv2-TC;
0 Karma
Reply

Damien_Dallimor
Ultra Champion
‎06-23-2015 02:18 AM

Well , see where it says "FROM" and then after that is the name of a MIB. You need those.They are dependencies.

0 Karma
Reply

nujauh
New Member
‎06-24-2015 10:47 PM

i add all MIBs listed and errors occurred.

06-25-2015 05:47:46.179 +0800 ERROR ExecProcessor - message from "python /SERVICE01/splunk/etc/apps/snmp_ta/bin/snmp.py" pysnmp.smi.error.SmiError: MIB module "/SERVICE01/splunk/etc/apps/snmp_ta/bin/mibs/HUAWEI-MIB.py" load error: ['Traceback (most recent call last):\n', ' File "/SERVICE01/splunk/etc/apps/snmp_ta/bin/pysnmp-4.2.5-py2.7.egg/pysnmp/smi/builder.py", line 255, in loadModules\n exec(modData, g)\n', ' File "", line 320\n', ' as = MibIdentifier((1, 3, 6, 1, 4, 1, 2011, 2, 36))\n', ' ^\n', 'SyntaxError: invalid syntax\n']

server01:/SERVICE01/splunk/etc/apps/launcher/local # more inputs.conf
[snmp://HUAWEI-ENTITY-EXTENT-MIB]
communitystring =
destination =
do_bulk_get = 0
do_get_subtree = 0
ipv6 = 0
mib_names = ENTITY-MIB,HUAWEI-MIB,IF-MIB,P-BRIDGE-MIB,SNMP-FRAMEWORK-MIB,SNMPv2-CONF,SNMPv2-SMI,HUAWEI-ENTITY-EXTENT-MIB
object_names = .1.3.6.1.4.1.2011.5.25.31.1.1.1.1.5.67633161
snmp_mode = attributes
snmp_version = 2C
snmpinterval = 300
sourcetype = snmp_ta
split_bulk_output = 0
trap_rdns = 0
v3_authProtocol = usmHMACMD5AuthProtocol
v3_privProtocol = usmDESPrivProtocol
index = snmp_ta
disabled = 0

server01:/SERVICE01/splunk/etc/apps/snmp_ta/bin/mibs # ll
total 4844
-rw-r--r-- 1 root root 48199 Jun 24 01:51 ENTITY-MIB.py
-rw-r--r-- 1 root root 106241 Jun 24 04:18 HUAWEI-ENTITY-EXTENT-MIB.py
-rw-r--r-- 1 root root 57835 Jun 25 05:47 HUAWEI-MIB.py
-rw-r--r-- 1 root root 32222 Jun 24 01:51 P-BRIDGE-MIB.py
-rw-r--r-- 1 root root 7902 Jun 24 01:51 SNMP-FRAMEWORK-MIB.py
-rw-r--r-- 1 root root 902 Jun 24 01:51 SNMPv2-CONF.py
-rw-r--r-- 1 root root 3357 Jun 24 01:51 SNMPv2-SMI.py
-rw-r--r-- 1 root root 3134 Jun 24 01:51 SNMPv2-TC.py
-rw------- 1 root root 4669138 Jun 8 06:04 pysnmp_mibs-0.1.4-py2.7.egg

0 Karma
Reply

nujauh
New Member
‎06-10-2015 07:39 PM

same error

06-11-2015 01:10:20.069 +0800 ERROR ExecProcessor - message from "python /SERVICE01/splunk/etc/apps/snmp_ta/bin/snmp.py" pysnmp.smi.error.SmiError: MIB module "/SERVICE01/splunk/etc/apps/snmp_ta/bin/mibs/HUAWEI-ENTITY-EXTENT-MIB.py" load error: ['Traceback (most recent call last):\n', ' File "/SERVICE01/splunk/etc/apps/snmp_ta/bin/pysnmp-4.2.5-py2.7.egg/pysnmp/smi/builder.py", line 255, in loadModules\n exec(modData, g)\n', ' File "", line 11, in \n', ' File "/SERVICE01/splunk/etc/apps/snmp_ta/bin/pysnmp-4.2.5-py2.7.egg/pysnmp/smi/builder.py", line 299, in importSymbols\n self.loadModules(modName, **userCtx)\n', ' File "/SERVICE01/splunk/etc/apps/snmp_ta/bin/pysnmp-4.2.5-py2.7.egg/pysnmp/smi/builder.py", line 259, in loadModules\n \'MIB module \"%s\" load error: %s\' % (modPath, traceback.format_exception(*sys.exc_info()))\n', 'SmiError: MIB module "/SERVICE01/splunk/etc/apps/snmp_ta/bin/mibs/HUAWEI-MIB.py" load error: [\'Traceback (most recent call last):\n\', \' File "/SERVICE01/splunk/etc/apps/snmp_ta/bin/pysnmp-4.2.5-py2.7.egg/pysnmp/smi/builder.py", line 255, in loadModules\n exec(modData, g)\n\', \' File "", line 320\n\', \' as = MibIdentifier((1, 3, 6, 1, 4, 1, 2011, 2, 36))\n\', \' ^\n\', \'SyntaxError: invalid syntax\n\']\n']

0 Karma
Reply

nujauh
New Member
‎06-10-2015 07:39 PM

/splunk/etc/apps/launcher/local # more inputs.conf
[snmp://HUAWEI-ENTITY-EXTENT-MIB]
communitystring =
destination =
do_bulk_get = 0
do_get_subtree = 0
ipv6 = 0
mib_names = HUAWEI-ENTITY-EXTENT-MIB,HUAWEI-MIB,HUAWEI-SYS-MAN-MIB
object_names = .1.3.6.1.4.1.2011.5.25.31.1.1.1.1.5.67633161
snmp_mode = attributes
snmp_version = 2C
snmpinterval = 300
sourcetype = snmp_ta
split_bulk_output = 0
trap_rdns = 0
v3_authProtocol = usmHMACMD5AuthProtocol
v3_privProtocol = usmDESPrivProtocol
index = snmp_ta

0 Karma
Reply
Get Updates on the Splunk Community!

More Ways To Control Your Costs With Archived Metrics | Register for Tech Talk

Tuesday, May 14, 2024  |  11AM PT / 2PM ET Register to Attend Join us for this Tech Talk and learn how to ...

.conf24 | Personalize your .conf experience with Learning Paths!

Personalize your .conf24 Experience Learning paths allow you to level up your skill sets and dive deeper ...

Threat Hunting Unlocked: How to Uplevel Your Threat Hunting With the PEAK Framework ...

WATCH NOWAs AI starts tackling low level alerts, it's more critical than ever to uplevel your threat hunting ...