SNMP Error in Packet

[JohnFLi]

I think I know the answer for this, but I just want to be sure....

I recently set up check_snmp to monitor various sensors on our Avtech RoomAlert devices (yeah, that was fun learning about mibs)
After awhile, I got it to work.....so that is good.....

And now for the issue:

Every so often, instead of returning OK, or critical for a check, Nagios reports back with "External command error: Error in packet There is no such variable name in this MIB. Failed object: iso.3.6.1.4.1.20916.1.8.1.3.6.0"

Then after awhile, it will report back fine and dandy, which shows that I have the check right. Because of these issues, I have the check send the notifications our after 10 failures. The check interval of 10 min.

Just wondering why I get those errors periodicly....

Any ideas?

[sreinhardt]

That particular response is generated by the remote device, not that nagios server. It is telling you that it received your request, but for some reason that oid is not available. Are you using a load balanced IP or something similar where it might be hitting a redundant device instead? Are there any logs from your remote device regarding this? Finally, are you using the full numeric oid, or actually providing iso.3.6.1.4.1.20916.1.8.1.3.6.0? Some devices do not like mixed naming conventions, and it might be best to change iso to is numeric identifier instead.

[JohnFLi]

Nope, no load balancing.....the check I am doing is formated like this:
(This example is for a switch that is either 'open' or 'closed')

Code: Select all

define service {
	#NAGIOSQL_CONFIG_NAME          	RA24E_Switch_03
	host_name                      	RoomAlert24E
	service_description            	RoomALERT24E Large Alarm
	display_name                   	RoomAlert 24E Large Alarm
	use                            	local-service
	check_command                  	check_snmp_RoomAlert!-o .1.3.6.1.4.1.20916.1.5.1.3.3.0 -C public -P 1 -l "Large Alarm" -w "0" -c "0"
	max_check_attempts             	10
	check_interval                 	5
	retry_interval                 	1
	active_checks_enabled          	1
	check_period                   	24x7
	check_freshness                	1
	notification_options           	w,c,r
	register                       	1
}	

and logging of the RoomALert device is next to worthless.

[abrist]

Is "check_snmp_RoomAlert" a command that uses check_snmp or something similar? I ask because check_snmp can be run with a verbose (-vvv) flag for extra debugging info.
If so, please run the check from the cli a bunch of times (until it fails) with the -vvv switch and post the output.

[JohnFLi]

yes, check_snmp_RoomAlert is a copy of check_snmp. I like to try to make things in groups. I use that one for all my RoomAlert devices.

i will try the -vvv right now

[abrist]

Great, post the full output of the verbose command and we can move from there.

[JohnFLi]

Finally caught the bugger. I did it twice so that you can see that it failed, and then worked with all the same settings (First failed, second passed)

Code: Select all

[root@g1vpnag01 libexec]# ./check_snmp roomalert32we -o .1.3.6.1.4.1.20916.1.8.1.3.15.0 -C public -P 1 -l "Switch Sen 15" -w "0" -c "0" -v
/usr/bin/snmpget -Le -t 1 -r 5 -m '' -v 1 [authpriv] roomalert32we:161 .1.3.6.1.4.1.20916.1.8.1.3.15.0
External command error: Error in packet
Reason: (noSuchName) There is no such variable name in this MIB.
Failed object: iso.3.6.1.4.1.20916.1.8.1.3.15.0

[root@g1vpnag01 libexec]# ./check_snmp roomalert32we -o .1.3.6.1.4.1.20916.1.8.1.3.15.0 -C public -P 1 -l "Switch Sen 15" -w "0" -c "0" -v
/usr/bin/snmpget -Le -t 1 -r 5 -m '' -v 1 [authpriv] roomalert32we:161 .1.3.6.1.4.1.20916.1.8.1.3.15.0
iso.3.6.1.4.1.20916.1.8.1.3.15.0 = INTEGER: 0
SNMP OK - Switch Sen 15 0 | 'Switch Sen 15'=0;0;0; 
[root@g1vpnag01 libexec]# 

with the -vvv switch (first one passed, second one failed)

Code: Select all

[root@g1vpnag01 libexec]# ./check_snmp roomalert32we -o .1.3.6.1.4.1.20916.1.8.1.3.15.0 -C public -P 1 -l "Switch Sen 15" -w "0" -c "0" -vvv
/usr/bin/snmpget -Le -t 1 -r 5 -m '' -v 1 [authpriv] roomalert32we:161 .1.3.6.1.4.1.20916.1.8.1.3.15.0
iso.3.6.1.4.1.20916.1.8.1.3.15.0 = INTEGER: 0
Processing oid 1 (line 1)
  oidname: iso.3.6.1.4.1.20916.1.8.1.3.15.0
  response: INTEGER: 0
SNMP OK - Switch Sen 15 0 | 'Switch Sen 15'=0;0;0; 


[root@g1vpnag01 libexec]# ./check_snmp roomalert32we -o .1.3.6.1.4.1.20916.1.8.1.3.15.0 -C public -P 1 -l "Switch Sen 15" -w "0" -c "0" -vvv
/usr/bin/snmpget -Le -t 1 -r 5 -m '' -v 1 [authpriv] roomalert32we:161 .1.3.6.1.4.1.20916.1.8.1.3.15.0
External command error: Error in packet
Reason: (noSuchName) There is no such variable name in this MIB.
Failed object: iso.3.6.1.4.1.20916.1.8.1.3.15.0

[root@g1vpnag01 libexec]# 

[sreinhardt]

that is very strange. Since the verbose output really isn't going into much more detail, could we bother you for a tcpdump? It still seems to me, a remote device issue, but tcpdump should pretty easily define that for us.

Code: Select all

tcpdump -nnXSs 0 -w /tmp/snmp.pcap 'port 161'

Now try to get us a passing and a failing one. If possible, I would really really appreciate having the successful and failed ones in separate pcaps, but either way will show what we need with any luck.

Running the snmpget command directly, and seeing what snmpget outputs, would be a good idea as well. The command should be:

Code: Select all

/usr/bin/snmpget -Le -t 1 -r 5 -m '' -v 1 [authpriv] roomalert32we:161 .1.3.6.1.4.1.20916.1.8.1.3.15.0

[JohnFLi]

OK, that was kinda painful.
The Nagios server ip is 10.100.1.83
Target device ip is :10.100.3.121

Code: Select all

[root@g1vpnag01 libexec]# /usr/bin/snmpget -Le -t 1 -r 5 -m '' -v 1 roomalert32we:161 -c public .1.3.6.1.4.1.20916.1.8.1.3.5.0
Error in packet
Reason: (noSuchName) There is no such variable name in this MIB.
Failed object: iso.3.6.1.4.1.20916.1.8.1.3.5.0

Code: Select all

[root@g1vpnag01 libexec]# /usr/bin/snmpget -Le -t 1 -r 5 -m '' -v 1 roomalert32we:161 -c public .1.3.6.1.4.1.20916.1.8.1.3.5.0
iso.3.6.1.4.1.20916.1.8.1.3.5.0 = INTEGER: 0

Attached is the dump file
change the extention to pcap

[sreinhardt]

Well, the pcap definitely showed the results I need. check_snmp is requesting the same throughout your requests, but something on your remote machine's end intermittently responds with no such object. You might have to do some form of updates or contact that devices vendor, but the pcap confirms what the snmpget binary is reporting back to you.

In the pcap, it looks like the first request response pair failed, and responded with nosuchname, meaning the device does not have an oid in it's tree that matches.
Later on, I can see many successful ones to the same device with proper responses from the same remote device.