graylog-labs / graylog-plugin-snmp

Graylog plugin to receive SNMP traps
Other
27 stars 7 forks source link

Fix OID #10

Closed fiorindavide closed 8 years ago

fiorindavide commented 8 years ago

Seems like OIDs are not translated correctly. Method getSymbolById inside SnmpOIDDecoder - findMibSymbol:(http://www.mibble.org/doc/release/api/net/percederberg/mibble/Mib.html) "Differing from the getSymbolByValue() methods, this method may return a symbol with only a partial OID match. If an exact match for the OID is present in the MIB, this method will always return the same result as getSymbolByValue(). Otherwise, the symbol with the longest matching OID will be returned, making it possible to identify a MIB symbol from an OID containing table row indices or similar. " Here's my solution:

    private String findMibSymbol(String oid) {
        final List<Mib> mibs = loader.getAllMibs();
        LOG.debug("Searching through " + String.valueOf(mibs.size()) + " MIBs");
        String name = null;
        for (Mib mib : mibs) {
            MibValueSymbol symbol = mib.getSymbolByOid(oid);
            if(symbol != null) {
                String oid_tmp = oid.substring(0, oid.length()-2);
                if(symbol.getValue().toString().equals(oid_tmp)) {
                    name = symbol.getName();
                    return name;
                }
            }

        }
        return name;
    }
mariussturm commented 8 years ago

Hi, thanks for the heads-up. You always return name so what should happen when the additional substring test fails?

mariussturm commented 8 years ago

Ah messed up with the formation, now I see whats going on. Ok, will test your suggestion and add it to the code if it works for us.

mariussturm commented 8 years ago

Could you please explain a little bit what the actual problem is how your code improve the situation? Maybe with example OIDs. I still don't understand why we should check for a sub-string of the OID?

mariussturm commented 8 years ago

Closing this, feel free to ping me again when you have more feedback.