Errors upon uploading mibs

[jimparsons]

We are transitioning from using IBM-Tivoli-NetCool for trap handling to Nagios. Tivoli has a mibmanager app that transforms plain mib files into 'rules files' and 'lookup files' which are then placed on the trap receiver server. Our current Development Nagios XI is version-5.8.1 running on RHEL-7.6. When uploading mib files to Nagios, often I will get error messages, "Total translations: 0, Successful translations: 0, MIB was added, but did not contain any TRAP-TYPE definitions." While I don't immediately scroll down to check every mib, I've noticed there is a long list of mib names that have '# Associated Traps = 0'. Even after working with 'rules' & 'lookup' files for a few years, it's difficult to determine which .mib, .my or .txt file Nagios can use. Any suggestions?

[ssax]

The whole thing with SNMP Traps and MIBs is that they could be using variables/etc from another MIB (what most vendors do), they could even be using traps from other MIBs (IF-MIB linkUp/linkDown as an example) so they wouldn't be defined in those MIBs.

The file name extensions of .mib, .my, and .txt do not matter, only this portion inside the file matters for identifying it:

Code: Select all

IF-MIB DEFINITIONS ::= BEGIN

It's always been a complex process for me:
- Open MIB, look at the top at the IMPORTS section to make sure you have the complete MIB set:

Code: Select all

IMPORTS
    MODULE-IDENTITY, OBJECT-TYPE, Counter32, Gauge32, Counter64,
    Integer32, TimeTicks, mib-2,
    NOTIFICATION-TYPE                        FROM SNMPv2-SMI
    TEXTUAL-CONVENTION, DisplayString,
    PhysAddress, TruthValue, RowStatus,
    TimeStamp, AutonomousType, TestAndIncr   FROM SNMPv2-TC
    MODULE-COMPLIANCE, OBJECT-GROUP,
    NOTIFICATION-GROUP                       FROM SNMPv2-CONF
    snmpTraps                                FROM SNMPv2-MIB
    IANAifType                               FROM IANAifType-MIB;

So then I check to make sure I have all of those required MIBs:

Code: Select all

FROM SNMPv2-SMI
FROM SNMPv2-TC
FROM SNMPv2-CONF
FROM SNMPv2-MIB
FROM IANAifType-MIB

Then I open up each on of those and keep doing that process and noting all of the required MIBs and then collect them all, I grep them for NOTIFY to find the traps and then process only those.

Once that entire spidering process above is done and you've collected all the MIBs, that is a complete MIB pack for that original MIB (IF-MIB in this case as an example).

OR you can come from the other way around (which is usually what I recommend) and just Google for the trap OID, find the MIB it's in, and only do the required MIBs for that specific MIB OID via the same above process.

It's complicated but is the nature of SNMP MIBs.

Let us know if we can clarify anything.

[jimparsons]

ssax, you have been most helpful. You have given me job security until I retire at 140 - and not a minute sooner. As I said, we are migrating from Tivoli-NetCool. Their mibmanager app did this automatically. We could select all the pertinent files and export them to a single package to be installed on the trap receiver. Do you know of a mibmanager app for Nagios?

[ssax]

There isn't one specifically for Nagios that I'm aware of but I've seen people use ireasoning's MIB Browser.

[jimparsons]

I seem to have hit a wall. The first mib I loaded with all of its Imports - 'ACCOUNTING-CONTROL-MIB' loaded fine and has two 'Associated Traps'. Every one since then has bounced back the err "Total translations: 0" - even with all the Imports for the Imports. All the files involved had the "DEFINITIONS ::= BEGIN" line in them after the filename. Do I need to go through all the Import branches of the whole existing list of mibs before I try adding any new ones? Do I need to remove the mibs, from Nagios, that have no Traps - other than SNMPv2-SMI, which has no Imports request?

[ssax]

Please run this command as root and send me the resulting /tmp/SNMPFILES.tar.gz file:

Code: Select all

GZIP=-9 tar czvf /tmp/SNMPFILES.tar.gz /etc/snmp /usr/share/snmp/mibs

[jimparsons]

Attaching the file - Jim Parsons

[ssax]

Thank you, investigating now.

[ssax]

From your MIB set it looks like these ones are the ones that were installed after the ACCOUNTING-CONTROL-MIB and contain NOTIF:

Code: Select all

[root@xi8 mibs]# ls -ltr /usr/share/snmp/mibs/ | tail -n39 | awk '{print $9}' | xargs -I % grep -H NOTIF %
/usr/share/snmp/mibs/ACCOUNTING-CONTROL-MIB.mib:    MODULE-IDENTITY, OBJECT-TYPE, NOTIFICATION-TYPE,
/usr/share/snmp/mibs/ACCOUNTING-CONTROL-MIB.mib:acctngFileNearlyFull NOTIFICATION-TYPE
/usr/share/snmp/mibs/ACCOUNTING-CONTROL-MIB.mib:acctngFileFull NOTIFICATION-TYPE
/usr/share/snmp/mibs/RFC1904.txt:   2.2 The NOTIFICATION-GROUP macro ...............................    4
/usr/share/snmp/mibs/RFC1904.txt:   4. Mapping of the NOTIFICATION-GROUP macro .....................   11
/usr/share/snmp/mibs/RFC1904.txt:   4.1 Mapping of the NOTIFICATIONS clause ........................   11
/usr/share/snmp/mibs/RFC1904.txt:   4.5 Mapping of the NOTIFICATION-GROUP value ....................   12
/usr/share/snmp/mibs/RFC1904.txt:NOTIFICATION-GROUP MACRO ::=
/usr/share/snmp/mibs/RFC1904.txt:                  "NOTIFICATIONS" "{" Notifications "}"
/usr/share/snmp/mibs/RFC1904.txt:4.  Mapping of the NOTIFICATION-GROUP macro
/usr/share/snmp/mibs/RFC1904.txt:   notifications.  The NOTIFICATION-GROUP macro serves this purpose.  It
/usr/share/snmp/mibs/RFC1904.txt:   should be noted that the expansion of the NOTIFICATION-GROUP macro is
/usr/share/snmp/mibs/RFC1904.txt:4.1.  Mapping of the NOTIFICATIONS clause
/usr/share/snmp/mibs/RFC1904.txt:   The NOTIFICATIONS clause, which must be present, is used to name each
/usr/share/snmp/mibs/RFC1904.txt:   NOTIFICATION-GROUP macro appears.
/usr/share/snmp/mibs/RFC1904.txt:4.5.  Mapping of the NOTIFICATION-GROUP value
/usr/share/snmp/mibs/RFC1904.txt:   The value of an invocation of the NOTIFICATION-GROUP macro is the
/usr/share/snmp/mibs/RFC1904.txt:snmpBasicNotificationsGroup NOTIFICATION-GROUP
/usr/share/snmp/mibs/RFC1904.txt:    NOTIFICATIONS { coldStart, authenticationFailure }
/usr/share/snmp/mibs/RFC1904.txt:   variations with respect to OBJECT-TYPE and NOTIFICATION-TYPE macros
/usr/share/snmp/mibs/RFC1904.txt:   invocation of the OBJECT-TYPE or NOTIFICATION-TYPE macro.
/usr/share/snmp/mibs/RFC-2578.txt:   2.5 The NOTIFICATION-TYPE macro ...............................10
/usr/share/snmp/mibs/RFC-2578.txt:   8 Mapping of the NOTIFICATION-TYPE macro ......................34
/usr/share/snmp/mibs/RFC-2578.txt:   8.5 Mapping of the NOTIFICATION-TYPE value ....................35
/usr/share/snmp/mibs/RFC-2578.txt:     NOTIFICATION-TYPE, is used to concisely convey the syntax and
/usr/share/snmp/mibs/RFC-2578.txt:NOTIFICATION-TYPE MACRO ::=
/usr/share/snmp/mibs/RFC-2578.txt:     objects, make use of the OBJECT-TYPE and NOTIFICATION-TYPE macros;
/usr/share/snmp/mibs/RFC-2578.txt:        IDENTITY, NOTIFICATION-TYPE, Opaque, OBJECT-TYPE, OBJECT-
/usr/share/snmp/mibs/RFC-2578.txt:          OBJECT-TYPE, MODULE-IDENTITY, NOTIFICATION-TYPE, OBJECT-GROUP,
/usr/share/snmp/mibs/RFC-2578.txt:          OBJECT-IDENTITY, NOTIFICATION-GROUP, MODULE-COMPLIANCE,
/usr/share/snmp/mibs/RFC-2578.txt:        IDENTITY NOTIFICATION-GROUP NOTIFICATION-TYPE NOTIFICATIONS NULL
/usr/share/snmp/mibs/RFC-2578.txt:8.  Mapping of the NOTIFICATION-TYPE macro
/usr/share/snmp/mibs/RFC-2578.txt:   The NOTIFICATION-TYPE macro is used to define the information
/usr/share/snmp/mibs/RFC-2578.txt:   PDU).  It should be noted that the expansion of the NOTIFICATION-TYPE
/usr/share/snmp/mibs/RFC-2578.txt:8.5.  Mapping of the NOTIFICATION-TYPE value
/usr/share/snmp/mibs/RFC-2578.txt:   The value of an invocation of the NOTIFICATION-TYPE macro is the name
/usr/share/snmp/mibs/RFC-2578.txt:   Sections 4.2.6 and 4.2.7 of [6] describe how the NOTIFICATION-TYPE
/usr/share/snmp/mibs/RFC-2578.txt:   entConfigChange NOTIFICATION-TYPE
/usr/share/snmp/mibs/RFC-2580.txt:   2.2 The NOTIFICATION-GROUP macro ...................................4
/usr/share/snmp/mibs/RFC-2580.txt:   4 Mapping of the NOTIFICATION-GROUP macro .........................12
/usr/share/snmp/mibs/RFC-2580.txt:   4.1 Mapping of the NOTIFICATIONS clause ...........................12
/usr/share/snmp/mibs/RFC-2580.txt:   4.5 Mapping of the NOTIFICATION-GROUP value .......................13
/usr/share/snmp/mibs/RFC-2580.txt:NOTIFICATION-GROUP MACRO ::=
/usr/share/snmp/mibs/RFC-2580.txt:                  "NOTIFICATIONS" "{" Notifications "}"
/usr/share/snmp/mibs/RFC-2580.txt:4.  Mapping of the NOTIFICATION-GROUP macro
/usr/share/snmp/mibs/RFC-2580.txt:   notifications.  The NOTIFICATION-GROUP macro serves this purpose.  It
/usr/share/snmp/mibs/RFC-2580.txt:   should be noted that the expansion of the NOTIFICATION-GROUP macro is
/usr/share/snmp/mibs/RFC-2580.txt:4.1.  Mapping of the NOTIFICATIONS clause
/usr/share/snmp/mibs/RFC-2580.txt:   The NOTIFICATIONS clause, which must be present, is used to specify
/usr/share/snmp/mibs/RFC-2580.txt:   module as the NOTIFICATION-GROUP macro appears.
/usr/share/snmp/mibs/RFC-2580.txt:4.5.  Mapping of the NOTIFICATION-GROUP value
/usr/share/snmp/mibs/RFC-2580.txt:   The value of an invocation of the NOTIFICATION-GROUP macro is the
/usr/share/snmp/mibs/RFC-2580.txt:   snmpBasicNotificationsGroup NOTIFICATION-GROUP
/usr/share/snmp/mibs/RFC-2580.txt:       NOTIFICATIONS { coldStart, authenticationFailure }
/usr/share/snmp/mibs/RFC-2580.txt:   variations with respect to OBJECT-TYPE and NOTIFICATION-TYPE macros
/usr/share/snmp/mibs/RFC-2580.txt:   invocation of the OBJECT-TYPE or NOTIFICATION-TYPE macro.
/usr/share/snmp/mibs/RFC-2580.txt:   (an OBJECT-GROUP or a NOTIFICATION-GROUP) after experience is gained
/usr/share/snmp/mibs/SNMPv2-SMI.mib:NOTIFICATION-TYPE MACRO ::=
/usr/share/snmp/mibs/SNMPv2-CONF.mib: NOTIFICATION-GROUP MACRO ::=
/usr/share/snmp/mibs/SNMPv2-CONF.mib:                   "NOTIFICATIONS" "{" Notifications "}"
/usr/share/snmp/mibs/APPN-MIB.mib:        OBJECT-TYPE, MODULE-IDENTITY, NOTIFICATION-TYPE
/usr/share/snmp/mibs/APPN-MIB.mib:        MODULE-COMPLIANCE, OBJECT-GROUP, NOTIFICATION-GROUP
/usr/share/snmp/mibs/APPN-MIB.mib:alertTrap NOTIFICATION-TYPE
/usr/share/snmp/mibs/APPN-MIB.mib:appnTrapNotifGroup    NOTIFICATION-GROUP
/usr/share/snmp/mibs/APPN-MIB.mib:        NOTIFICATIONS {
/usr/share/snmp/mibs/SNA-NAU-MIB.mib:        OBJECT-TYPE, MODULE-IDENTITY, NOTIFICATION-TYPE
/usr/share/snmp/mibs/SNA-NAU-MIB.mib:                        the LU-LU session or an SNA NOTIFY request on
/usr/share/snmp/mibs/SNA-NAU-MIB.mib:                        the LU-LU session or an SNA NOTIFY request on
/usr/share/snmp/mibs/SNA-NAU-MIB.mib:snaNodeStateChangeTrap NOTIFICATION-TYPE
/usr/share/snmp/mibs/SNA-NAU-MIB.mib:snaNodeActFailTrap NOTIFICATION-TYPE
/usr/share/snmp/mibs/SNA-NAU-MIB.mib:                        the LU-LU session or an SNA NOTIFY request on
/usr/share/snmp/mibs/SNA-NAU-MIB.mib:                        the LU-LU session or an SNA NOTIFY request on
/usr/share/snmp/mibs/SNA-NAU-MIB.mib:snaLuStateChangeTrap NOTIFICATION-TYPE
/usr/share/snmp/mibs/SNA-NAU-MIB.mib:snaLuSessnBindFailTrap NOTIFICATION-TYPE
/usr/share/snmp/mibs/APPN-TRAP-MIB.mib:        NOTIFICATION-TYPE
/usr/share/snmp/mibs/APPN-TRAP-MIB.mib:        MODULE-COMPLIANCE, OBJECT-GROUP, NOTIFICATION-GROUP
/usr/share/snmp/mibs/APPN-TRAP-MIB.mib:appnIsrAccountingDataTrap NOTIFICATION-TYPE
/usr/share/snmp/mibs/APPN-TRAP-MIB.mib:appnLocalTgOperStateChangeTrap NOTIFICATION-TYPE
/usr/share/snmp/mibs/APPN-TRAP-MIB.mib:appnLocalTgCpCpChangeTrap NOTIFICATION-TYPE
/usr/share/snmp/mibs/APPN-TRAP-MIB.mib:appnPortOperStateChangeTrap NOTIFICATION-TYPE
/usr/share/snmp/mibs/APPN-TRAP-MIB.mib:appnLsOperStateChangeTrap NOTIFICATION-TYPE
/usr/share/snmp/mibs/APPN-TRAP-MIB.mib:dlurDlusStateChangeTrap NOTIFICATION-TYPE
/usr/share/snmp/mibs/APPN-TRAP-MIB.mib:appnTrapMibIsrNotifGroup    NOTIFICATION-GROUP
/usr/share/snmp/mibs/APPN-TRAP-MIB.mib:        NOTIFICATIONS {
/usr/share/snmp/mibs/APPN-TRAP-MIB.mib:appnTrapMibTopoNotifGroup    NOTIFICATION-GROUP
/usr/share/snmp/mibs/APPN-TRAP-MIB.mib:        NOTIFICATIONS {
/usr/share/snmp/mibs/APPN-TRAP-MIB.mib:appnTrapMibDlurNotifGroup    NOTIFICATION-GROUP
/usr/share/snmp/mibs/APPN-TRAP-MIB.mib:        NOTIFICATIONS {
/usr/share/snmp/mibs/ATM2-MIB.txt:       MODULE-IDENTITY, OBJECT-TYPE, NOTIFICATION-TYPE,
/usr/share/snmp/mibs/ATM2-MIB.txt:       MODULE-COMPLIANCE, OBJECT-GROUP, NOTIFICATION-GROUP
/usr/share/snmp/mibs/ATM2-MIB.txt:  atmIntfPvcFailuresTrap    NOTIFICATION-TYPE
/usr/share/snmp/mibs/ATM2-MIB.txt:    atmSwitchServcNotifGroup     NOTIFICATION-GROUP
/usr/share/snmp/mibs/ATM2-MIB.txt:    NOTIFICATIONS { atmIntfPvcFailuresTrap }
/usr/share/snmp/mibs/SNMPv2-SMI-v1.txt:-- No macro NOTIFICATION-TYPE in SNMPv1
/usr/share/snmp/mibs/AWCVX-MIB.txt:-- NOTIFICATION-GROUP

There are also duplicates in there:

Code: Select all

[root@xi8 mibs]# grep -h 'DEFINITIONS ::= BEGIN' /usr/share/snmp/mibs/* | awk '{print $1}' | sort | uniq -d
CISCO-ATM-CELL-LAYER-CAPABILITY
CISCO-SMI
DELL-RAC-MIB
DISMAN-EVENT-MIB
IANAifType-MIB
INTEL-LAN-ADAPTERS-MIB
MIB-Dell-10892
RFC1213-MIB
SNMPv2-CONF
SNMPv2-SMI
SNMPv2-TC
SNMP-VIEW-BASED-ACM-MIB

I'm wondering if the NOTIFICATION-GROUP ones are being parsed.

[jimparsons]

SSax - It's entirely possible some, or many, of these mibs were replaced by newer ones. We have had the Tivoli-NetCool system over a decade. I was first introduced to the 'rules' and 'lookup' files in Tivoli back in 2014 I believe. I simply copied what was represented in Tivoli and went searching online for the mibs behind the 'rules' files. And, following your recommendation to pay attention to the 'Imports' section of each mib, my search has tripled - at least. Had to incorporate a spreadsheet to keep things straight. It has proved fruitful though. I delete the mibs from the 'Admin - Manage MIBs' page before uploading any of the 'Import' list and the target mib. Some have uploaded without complaint and generated 34 Trap definitions to this point. I am attaching a newer SNMPFILES.tar.gz file. When I uploaded the previous file, I believe there were only 2 new traps.
The ADSL-LINE-MIB.my file says "NOTIFICATION-GROUP FROM SNMPv2-CONF" which is installed. ADSL-LINE-MIB.my was re-installed and has 12 trap definitions.
Is there anything in particular we are supposed to do with the 'Notification' phrases? Before seeing your note, I had seen 'Notification required' in one of the traps I was working on and raised it to 'Critical' severity.