XI : snmp trap "auth error"

[ericssonvietnam]

Hi,

No sure if this issue qualifies for XI support but i hope you might have faced it before and can point me in right direction.
I've configured Xi to process snmp traps and for most of the nodes its working fine. ( i.e +100 nodes) But from one ..i am getting below repetitive mesg

Data received:

Code: Select all

CLIENTHOST

UDP: [CLIENTHOST]:26839->[NAgiosXI]

DISMAN-EVENT-MIB::sysUpTimeInstance 0:0:00:35.01

SNMPv2-MIB::snmpTrapOID.0 SNMPv2-MIB::[color=#FF0000]authenticationFailure[/color]

SNMPv2-MIB::snmpTrapEnterprise.0 NET-SNMP-MIB::netSnmpAgentOIDs.10

Snmpd.conf on CLIENT HOST looks like below:-
[root@ ~]# grep -v ^# /etc/snmp/snmpd.conf | sed '/^$/d'

Code: Select all

trap2sink NagiosXI public
com2sec notConfigUser  default       public
group   notConfigGroup v1           notConfigUser
group   notConfigGroup v2c           notConfigUser
view    systemview    included   .1
view    systemview    included   .1.3.6.1.2.1.1
view    systemview    included   .1.3.6.1.2.1.25.1.1
access  notConfigGroup ""      any       noauth    exact  systemview none none
pass .1.3.6.1.4.1.4413.4.1 /usr/bin/ucd5820stat
rocommunity public nagiosXI .1

Any help will be appreciated.

[Box293]

But from one ..i am getting below repetitive mesg

Can you explain in a little more detail. What exactly is wrong with the message you received?

Where is this being logged on the XI server?

[ericssonvietnam]

I am getting this log in /var/log/snmptt/snmptthandler.debug when debug is ON. Problem is its two frequent, and "auth" error in snmp is known for wrong community but as you can also see from config, community is default to public

[gormank]

You probably want to log into that device and check the logs to see what address is trying to log in and failing. Then go to that device and figure out what its doing and why.

[Box293]

Thanks @gormank that is good troubleshooting advice.

@ericssonvietnam did this help track down your problem?

[ericssonvietnam]

Sorry for late response. I already checked and found one application using snmp service to send traps manually. And i've asked concernd department to provide details..currently waiting for it.

[tgriep]

The SNMP authenication settings are setup in this file on the XI server. Take a look at that file and see if the settings are correct.
/etc/snmp/snmptrapd.conf