Closed andreaconsadori closed 9 years ago
Looks like your device is using a PDU type that is not supported by the SNMP standard. Which device are you using?
stormshield firewall (old name was netasq)here the mibs http://documentation.netasq.com/firewall/guide/v1/en/default.htm?turl=Documents%2Fstormshieldnetworkmibs.htm
Thanks for the update. Can you show us the configuration of the SNMP agent? It's possible that we need to update the implementation and expose some more configuration options. Thank you!
graylog snmp agent is default root@Graylog:/var/lib/mibs# cat /etc/snmp/snmp.conf## As the snmp packages come without MIB files due to license reasons, loading# of MIBs is disabled by default. If you added the MIBs you can reenable# loaging them by commenting out the following line.mibs : i put only mib file path in snmp input configuration "port: 1620mibs_path: /var/lib/mibsoverride_source:bind_address: 0.0.0.0"
Date: Wed, 12 Aug 2015 01:50:58 -0700 From: notifications@github.com To: graylog-plugin-snmp@noreply.github.com CC: andrea.consadori@hotmail.it Subject: Re: [graylog-plugin-snmp] Unable to decode SNMP PDU (#3)
Thanks for the update. Can you show us the configuration of the SNMP agent? It's possible that we need to update the implementation and expose some more configuration options. Thank you!
— Reply to this email directly or view it on GitHub.
if usefould i also send you the dump of the incoming trap
From: andrea.consadori@hotmail.it To: reply@reply.github.com Subject: RE: [graylog-plugin-snmp] Unable to decode SNMP PDU (#3) Date: Wed, 12 Aug 2015 11:11:18 +0200
graylog snmp agent is default root@Graylog:/var/lib/mibs# cat /etc/snmp/snmp.conf## As the snmp packages come without MIB files due to license reasons, loading# of MIBs is disabled by default. If you added the MIBs you can reenable# loaging them by commenting out the following line.mibs : i put only mib file path in snmp input configuration "port: 1620mibs_path: /var/lib/mibsoverride_source:bind_address: 0.0.0.0"
Date: Wed, 12 Aug 2015 01:50:58 -0700 From: notifications@github.com To: graylog-plugin-snmp@noreply.github.com CC: andrea.consadori@hotmail.it Subject: Re: [graylog-plugin-snmp] Unable to decode SNMP PDU (#3)
Thanks for the update. Can you show us the configuration of the SNMP agent? It's possible that we need to update the implementation and expose some more configuration options. Thank you!
— Reply to this email directly or view it on GitHub.
and finally the firewall snmp agent config xxx>cat /var/snmp/snmpd.conf############################################################################# snmpd.conf## - created by buildsnmp# - do not edit by hand###########################################################################
############################################################################ SECTION: System Information Setup## This section defines some of the information reported in# the "system" mib group in the mibII tree. syslocation xxxsyscontact who@wheresysname xxxsysservices 72 ############################################################################ SECTION: Access Control Setup## This section defines who is allowed to talk to your running# snmp agent. rocommunity publicrouser xxx ############################################################################ SECTION: Trap Destinations## Here we define where the snmp agent will send traps trapsink 192.168.0.95:1620 public ############################################################################ SECTION: DisMan Event MIB## Here we define when and what traps should be generated agentSecName internalrouser internallinkUpDownNotifications yes authtrapenable 2interface em5 6 30000000interface em4 6 30000000
From: andrea.consadori@hotmail.it To: reply@reply.github.com Subject: RE: [graylog-plugin-snmp] Unable to decode SNMP PDU (#3) Date: Wed, 12 Aug 2015 11:16:02 +0200
if usefould i also send you the dump of the incoming trap
From: andrea.consadori@hotmail.it To: reply@reply.github.com Subject: RE: [graylog-plugin-snmp] Unable to decode SNMP PDU (#3) Date: Wed, 12 Aug 2015 11:11:18 +0200
graylog snmp agent is default root@Graylog:/var/lib/mibs# cat /etc/snmp/snmp.conf## As the snmp packages come without MIB files due to license reasons, loading# of MIBs is disabled by default. If you added the MIBs you can reenable# loaging them by commenting out the following line.mibs : i put only mib file path in snmp input configuration "port: 1620mibs_path: /var/lib/mibsoverride_source:bind_address: 0.0.0.0"
Date: Wed, 12 Aug 2015 01:50:58 -0700 From: notifications@github.com To: graylog-plugin-snmp@noreply.github.com CC: andrea.consadori@hotmail.it Subject: Re: [graylog-plugin-snmp] Unable to decode SNMP PDU (#3)
Thanks for the update. Can you show us the configuration of the SNMP agent? It's possible that we need to update the implementation and expose some more configuration options. Thank you!
— Reply to this email directly or view it on GitHub.
if usefould i also send you the dump of the incoming trap
A dump of the raw trap data would be great so we can test it locally.
here the file http://www.filedropper.com/dump_1
here the file http://www.filedropper.com/dump_1
This file doesn't seem to exist. Getting a 404 :confused:
i can download it... you have preferred file sharing platform?
Date: Thu, 13 Aug 2015 01:26:07 -0700 From: notifications@github.com To: graylog-plugin-snmp@noreply.github.com CC: andrea.consadori@hotmail.it Subject: Re: [graylog-plugin-snmp] Unable to decode SNMP PDU (#3)
here the file http://www.filedropper.com/dump_1
This file doesn't seem to exist. Getting a 404
— Reply to this email directly or view it on GitHub.
i can download it... you have preferred file sharing platform?
Yes, it works now. :smile: Sorry for the noise...
I can reproduce the issue with your snmpd config as well and will try to search for a fix.
@andreaconsadori I just released version 0.3.0 of the plugin. This should fix the issues you had. (tested with your payload)
You have to delete your existing SNMP inputs and create them again because some internals have changed. (delete it before installing the new plugin)
The new release artifacts should show up here once travis finished building them.
i download the mibs, change the path and restart graylog-server but i still have this error msg