trying to decode OIDs...

[Blaine Blodgette]

Blaine Blodgette [http://community.zenoss.org/people/blaineb] created the discussion

"trying to decode OIDs..."

To view the discussion, visit: http://community.zenoss.org/message/70951#70951

--------------------------------------------------------------
Still sorta new to Zenoss and trying to figure out how exactly to best use this system for monitoring the network.

I have setup a Netgear switch to send traps to my Zenoss server.  The traps that are sent to Zenoss show up as obscure messages such as "snmp trap 1.3.6.1.4.1.4526.17.0.151"

All I want to find out how to do, is to be able to configure Zenoss so that it knows what that means and automatically translates it to something human readable.  I know that MIBs store these sort of mappings, but I am at a huge loss right now as to how to:
1)  Find the correct MIB that I need
2)  Load that MIB into Zenoss (I have read that this is best done via command line, but that tutorial I found at http://community.zenoss.org/docs/DOC-2450 http://community.zenoss.org/docs/DOC-2450 seems more complicated than the process should be, so please let me know if there is any simpler way)
3)  Configure this device in Zenoss so that these translations are done automatically
--------------------------------------------------------------

Reply to this message by replying to this email -or- go to the discussion on Zenoss Community
[http://community.zenoss.org/message/70951#70951]

Start a new discussion in zenoss-users by email
[discussions-community-forums-zenoss--***@community.zenoss.org] -or- at Zenoss Community
[http://community.zenoss.org/choose-container!input.jspa?contentType=1&containerType=14&container=2003]

[nilie]

nilie [http://community.zenoss.org/people/nilie] created the discussion

"Re: trying to decode OIDs..."

To view the discussion, visit: http://community.zenoss.org/message/70927#70927

--------------------------------------------------------------
First you have to download the MIB for your device, ideally from the manufacturer web site if not, search the Internet and hope you'll find it somewhere.
Second, go to Advanced-> MIBs and use the buttons at the bottom to load the MIB, don't necessarily mean you'll have to do it at the CLI.
That should be it, Zenoss will use it automatically to do the mapping.
--------------------------------------------------------------

Reply to this message by replying to this email -or- go to the discussion on Zenoss Community
[http://community.zenoss.org/message/70927#70927]

Start a new discussion in zenoss-users by email
[discussions-community-forums-zenoss--***@community.zenoss.org] -or- at Zenoss Community
[http://community.zenoss.org/choose-container!input.jspa?contentType=1&containerType=14&container=2003]

[Blaine B]

Blaine B [http://community.zenoss.org/people/blaineb] created the discussion

"Re: trying to decode OIDs..."

To view the discussion, visit: http://community.zenoss.org/message/70955#70955

--------------------------------------------------------------
I loaded 2 different "Netgear" MIBs into Zenoss, yet the traps still are not decoded.  The second trap I'm talking about specifically in addition to the one I pasted in the original post is "snmp trap 1.3.6.1.6.3.1.1.5.3"

For some reason, this is not happening automatically.
--------------------------------------------------------------

Reply to this message by replying to this email -or- go to the discussion on Zenoss Community
[http://community.zenoss.org/message/70955#70955]

Start a new discussion in zenoss-users by email
[discussions-community-forums-zenoss--***@community.zenoss.org] -or- at Zenoss Community
[http://community.zenoss.org/choose-container!input.jspa?contentType=1&containerType=14&container=2003]

[jmp242]

jmp242 [http://community.zenoss.org/people/jmp242] created the discussion

"Re: trying to decode OIDs..."

To view the discussion, visit: http://community.zenoss.org/message/70957#70957

--------------------------------------------------------------
Your MIBs may not cover that trap. Only Netgear knows. If you know what the trap is about, you could use an event transform to change that to whatever you want...

--
James Pulver
ZCA Member
LEPP Computer Group
Cornell University
--------------------------------------------------------------

Reply to this message by replying to this email -or- go to the discussion on Zenoss Community
[http://community.zenoss.org/message/70957#70957]

Start a new discussion in zenoss-users by email
[discussions-community-forums-zenoss--***@community.zenoss.org] -or- at Zenoss Community
[http://community.zenoss.org/choose-container!input.jspa?contentType=1&containerType=14&container=2003]

[Blaine B]

Blaine B [http://community.zenoss.org/people/blaineb] created the discussion

"Re: trying to decode OIDs..."

To view the discussion, visit: http://community.zenoss.org/message/70960#70960

--------------------------------------------------------------
What exactly do you mean by an event transform?  Is that the same as the "Reclassify an event" button when the event is selected?

I tried browsing the MIB through Advanced > MIBs, but most of the ones that I load into Zenoss don't show any OID mappings at all in the list.  Some of them do, but they don't seem to be the ones that I need.
--------------------------------------------------------------

Reply to this message by replying to this email -or- go to the discussion on Zenoss Community
[http://community.zenoss.org/message/70960#70960]

Start a new discussion in zenoss-users by email
[discussions-community-forums-zenoss--***@community.zenoss.org] -or- at Zenoss Community
[http://community.zenoss.org/choose-container!input.jspa?contentType=1&containerType=14&container=2003]

[nilie]

nilie [http://community.zenoss.org/people/nilie] created the discussion

"Re: trying to decode OIDs..."

To view the discussion, visit: http://community.zenoss.org/message/70930#70930

--------------------------------------------------------------
Also try to search for standard If-MIB (especially the section refering to RFC 2863, +The Interfaces Group MIB+), download it and load it into Zenoss. This is the one that translates 1.3.6.1.6.3.1.1.5.3 into meaningful definitions.
--------------------------------------------------------------

Reply to this message by replying to this email -or- go to the discussion on Zenoss Community
[http://community.zenoss.org/message/70930#70930]

Start a new discussion in zenoss-users by email
[discussions-community-forums-zenoss--***@community.zenoss.org] -or- at Zenoss Community
[http://community.zenoss.org/choose-container!input.jspa?contentType=1&containerType=14&container=2003]

[Blaine B]

Blaine B [http://community.zenoss.org/people/blaineb] created the discussion

"Re: trying to decode OIDs..."

To view the discussion, visit: http://community.zenoss.org/message/71080#71080

--------------------------------------------------------------
Okay I checked IF-MIB within Zenoss under Advanced > MIBs and it shows the trap (both of them in this list actually, are what I have been seeing some of the time from this particular NetGear switch), but for some reason, the traps still are not automatically "decoded" when the events show up in Zenoss for that switch.

Loading Image... Loading Image...
--------------------------------------------------------------

Reply to this message by replying to this email -or- go to the discussion on Zenoss Community
[http://community.zenoss.org/message/71080#71080]

Start a new discussion in zenoss-users by email
[discussions-community-forums-zenoss--***@community.zenoss.org] -or- at Zenoss Community
[http://community.zenoss.org/choose-container!input.jspa?contentType=1&containerType=14&container=2003]

[Shane Scott]

Shane Scott [http://community.zenoss.org/people/hackman238] created the discussion

"Re: trying to decode OIDs..."

To view the discussion, visit: http://community.zenoss.org/message/71096#71096

--------------------------------------------------------------
Blaine:

Did you restart zentrap? If ZenOSS v4.1.1 then add  configsipsize 0 to $ZENHOME/etc/zentrap.conf and restart zentrap.

--Shane Scott (Hackman238)
--------------------------------------------------------------

Reply to this message by replying to this email -or- go to the discussion on Zenoss Community
[http://community.zenoss.org/message/71096#71096]

Start a new discussion in zenoss-users by email
[discussions-community-forums-zenoss--***@community.zenoss.org] -or- at Zenoss Community
[http://community.zenoss.org/choose-container!input.jspa?contentType=1&containerType=14&container=2003]

[Blaine B]

Blaine B [http://community.zenoss.org/people/blaineb] created the discussion

"Re: trying to decode OIDs..."

To view the discussion, visit: http://community.zenoss.org/message/71098#71098

--------------------------------------------------------------
I'm running Zenoss 4.2.0

I restarted zentrap and then made the switch send the traps again as a test and now they seem to be telling me in English that the link went up/down as expected.

Now the only other thing is that I am getting the following trap that seems to be only partially decoded:
| Resource: | SX03 |
| Component: |
|
| Event Class: | /Unknown |
| Status: | New |
| Message: | snmp trap netgear.17.0.151 |
I have looked all over through Netgear MIBs and am unable to find the netgear.17.x OIDs...  This may be unsolvable, but at least restarting zentrap seems to have fixed my main issue.

Thanks!
--------------------------------------------------------------

Reply to this message by replying to this email -or- go to the discussion on Zenoss Community
[http://community.zenoss.org/message/71098#71098]

Start a new discussion in zenoss-users by email
[discussions-community-forums-zenoss--***@community.zenoss.org] -or- at Zenoss Community
[http://community.zenoss.org/choose-container!input.jspa?contentType=1&containerType=14&container=2003]

[nilie]

nilie [http://community.zenoss.org/people/nilie] created the discussion

"Re: trying to decode OIDs..."

To view the discussion, visit: http://community.zenoss.org/message/70929#70929

--------------------------------------------------------------
The OID you mention, is for a standard snmp v2 trap belonging to If-MIB group and it is sent by the device when the link goes down. Can you open the MIB database you downloaded from Netgear (it should be a text file), search for the string 1.3.6.1.6.3.1.1.5.3 and see what is the definition ? Also, do you see the same OID in Zenoss in the MIB section ?
--------------------------------------------------------------

Reply to this message by replying to this email -or- go to the discussion on Zenoss Community
[http://community.zenoss.org/message/70929#70929]

Start a new discussion in zenoss-users by email
[discussions-community-forums-zenoss--***@community.zenoss.org] -or- at Zenoss Community
[http://community.zenoss.org/choose-container!input.jspa?contentType=1&containerType=14&container=2003]

[phonegi]

phonegi [http://community.zenoss.org/people/phonegi] created the discussion

"Re: trying to decode OIDs..."

To view the discussion, visit: http://community.zenoss.org/message/70961#70961

--------------------------------------------------------------
You can frequently find information on the OID just by googling. One basic rule: any OID beginning with 1.3.6.1.4.1.xxx is a custom OID - defined by manufacturer xxx. Manufacturers apply to the IANA to receive their own OID tree, where they can create whatever OIDs they like. The IANA lists these manufacturers here: http://www.iana.org/assignments/enterprise-numbers http://www.iana.org/assignments/enterprise-numbers.

As noted above, once you find the MIB that defines an OID, you load it into Zenoss and Zenoss will automatically convert the OID to it's defined name.
--------------------------------------------------------------

Reply to this message by replying to this email -or- go to the discussion on Zenoss Community
[http://community.zenoss.org/message/70961#70961]

Start a new discussion in zenoss-users by email
[discussions-community-forums-zenoss--***@community.zenoss.org] -or- at Zenoss Community
[http://community.zenoss.org/choose-container!input.jspa?contentType=1&containerType=14&container=2003]