MonitorWare Knowledge Base

I was trying to test the SNMP function in Rsyslog. But I got this message and no trap was originated:

8647.887016000:main queue:Reg/w0: Filter: check for property 'msg' (value 'omsnmp_sendsnmp: Invalid SyslogMessage OID, error code '-61' - 'Bad variable type (Type of attribute is OBJECT IDENTIFIER, not OCTET STRING)'
') contains 'ERROR': FALSE
8647.887042000:main queue:Reg/w0: Filter: check for property 'msg' (value 'omsnmp_sendsnmp: Invalid SyslogMessage OID, error code '-61' - 'Bad variable type (Type of attribute is OBJECT IDENTIFIER, not OCTET STRING)'
') contains 'ERROR': FALSE
8647.887066000:main queue:Reg/w0: Filter: check for property 'msg' (value 'omsnmp_sendsnmp: Invalid SyslogMessage OID, error code '-61' - 'Bad variable type (Type of attribute is OBJECT IDENTIFIER, not OCTET STRING)'
') contains 'ERROR': FALSE
8647.887089000:main queue:Reg/w0: Filter: check for property 'msg' (value 'omsnmp_sendsnmp: Invalid SyslogMessage OID, error code '-61' - 'Bad variable type (Type of attribute is OBJECT IDENTIFIER, not OCTET STRING)'
') contains 'ERROR': FALSE


Can anybody help?

My rsyslog.conf:

$ModLoad omsnmp.so
$actionsnmptarget 10.26.49.109
$actionsnmpcommunity public
.
.
:msg,contains,"ERROR" msnmp:

Thanks

• Custom written rsyslog.conf?
• Maintenance Contract?
• Installation support?

Hi,

seems like the default SyslogMessageOID is wrong.
Please try this OID during meanwhile. I will look into this and change the default to OID which has the type "OCTEC_STRING'.

Code: Select all

$actionsnmpsyslogmessageoid 1.3.6.1.4.1

best regards,
Andre Lorbach

Andre.

I did that yesterday and it works. I see the snmp packet sent through the debug mode:

4404.433695000:main queue:Reg/w0: Called action, logging to omsnmp.soomsnmp_sendsnmp: ENTER - Syslogmessage = '<133>Feb 29 14:13:24 us3cons4 LDAP_Errors[29/Feb/2008:14:13:22 +0000] - ERROR<8318> - Repl. Transport - conn=-1 op=-1 msgId=-1 - [S] Bind failed with response: Failed to bind to remote (900).'
4404.433811000:main queue:Reg/w0: omsnmp_sendsnmp: LEAVE

So I am assuming that should send trap to the snmptrapd or manager. I don't see that received on the other end. is there anything else I need to do?

My rsyslog.conf:

$ModLoad omsnmp.so

$actionsnmptransport udp
$actionsnmptarget 10.26.49.109
$actionsnmptargetport 162
$actionsnmpversion 1
$actionsnmpcommunity public
$actionsnmpsyslogmessageoid 1.3.6.1.4.1
..
...
$InputFileName /opt/server/us3cons4/logs/errors
$InputFileTag LDAP_Errors
$InputFileStateFile errors
$InputRunFileMonitor
#:msg,contains,"ERROR" @10.26.49.109
:msg,contains,"ERROR" msnmp:


Thanks,

This debug output actually looks fine.
It should have been delivered to 10.26.49.109 on Port 162 UDP.

It might be that the snmptrapd agent rejected the trap because of the OID.

Just for a test, try this OID (i.o.d.i.private.enterprises.netSnmp.netSnmpExamples.netSnmpExampleNotifications.netSnmpExampleNotification):

Code: Select all

$actionsnmpsyslogmessageoid 1.3.6.1.4.1.8072.2.3.1


I will research this issue during meantime.

best regards,
Andre Lorbach