Highlighted
Respected Contributor.
Respected Contributor.
986 views

Failed to parse trap coming from what ip-address ?

NNM 10.01.002 Windows

Occasionally I see "Failed to parse trap" when I run the command nnmtrapdump.ovpl -t
The hexdump below doesnt tell me from what ip-address the trap is coming from but maybe it is hidden in there somewhere ? If so, could you please advice me on how to decode the ip-address.

Thanks

 

WARNING: Failed to parse trap
(hex): length = 235
     0:  30 81 e8 02 01 03 30 0e 02 02 3d f5 02 02 05 dc     0.....0...=.....
    16:  04 01 03 02 01 03 04 38 30 36 04 0b 26 47 40 00     .......806..&G@.
    32:  00 00 00 00 00 00 00 02 01 06 02 04 01 dd b6 3b     ...............;
    48:  04 06 73 6b 76 6e 6e 6d 04 0c 71 ce 0e e0 71 1f     ..------..q...q.
    64:  b0 a2 5e 18 47 ba 04 08 00 00 00 06 77 a2 c2 62     ..^.G.......w..b
    80:  04 81 98 ac 31 93 da 14 f9 64 51 4e 51 ee 76 8e     ....1....dQNQ.v.
    96:  47 e4 92 82 1d e9 6e 01 8a c3 34 22 e3 f0 c7 12     G.....n...4"....
   112:  84 ec c2 e2 86 ac 71 f7 b7 dc e2 fa 79 72 91 f7     ......q.....yr..
   128:  ae e5 bf f9 62 e6 2e 03 08 b4 b3 5b b2 44 22 c5     ....b......[.D".
   144:  2c df 89 3d db cc ca e2 53 58 a9 22 99 5e 8a f6     ,..=....SX.".^..
   160:  ba 44 b5 cc cb ef 34 9d 11 cf 8e b6 49 5b 42 80     .D....4.....I[B.
   176:  24 ab 34 97 1e c0 09 a1 46 20 38 4f 79 25 95 57     $.4.....F 8Oy%.W
   192:  a0 92 7c fa 35 42 c6 18 07 ff 71 18 58 08 74 41     ..|.5B....q.X.tA
   208:  eb be 74 60 a1 c1 b2 05 bf 54 54 02 53 db c7 fd     ..t`.....TT.S...
   224:  4b 07 2e 35 0a 57 0c e6 75 75 55 -- -- -- -- --     K..5.W..uuU.....

0 Likes
3 Replies
Highlighted
Absent Member.. Absent Member..
Absent Member..

Re: Failed to parse trap coming from what ip-address ?

Hello,

Please check nnm-trace.log file and find the log message of com.hp.ov.nms.trapd

If there is too little information or the level of com.hp.ov.nms.trapd is just at CONFIG or INFO, please consider set the higher logging level by command:

nnmsetlogginlevel.ovpl com.hp.ov.nms.trapd FINEST

 

I just know this way to see the IP address trap which is failed to parse.

 

Best Regards,

--------------HP Support--------------
If you find that this or any post resolves your issue, please be sure to mark it as an accepted solution.
0 Likes
Highlighted
Respected Contributor.
Respected Contributor.

Re: Failed to parse trap coming from what ip-address ?

Hello again, this is what I found in the log :

 

2015-10-21 11:22:33.670 WARNING [com.hp.ov.nms.trapd.pipeline.mdb.TrapAuditMDB] (Thread-61 (group:HornetQ-client-global-threads-148453767)) Unable to parse trap: com.hp.ov.snmp.exceptions.SnmpException: Management address map is not available.

at com.hp.ov.nms.trapd.NMTrapData.parseTrap(NMTrapData.java:257)
 at com.hp.ov.nms.trapd.pipeline.mdb.TrapAuditMDB.getTrapData(TrapAuditMDB.java:120)
 at com.hp.ov.nms.trapd.pipeline.mdb.TrapAuditMDB.handleTraps(TrapAuditMDB.java:90)
 at com.hp.ov.nms.trapd.pipeline.mdb.TrapAuditMDB.onMessage(TrapAuditMDB.java:64)

                  and a lot of javalines and then :

2015-10-21 11:22:33.670 SEVERE [com.hp.ov.nms.trapd.NMTrapData] (Thread-61 (group:HornetQ-client-global-threads-148453767)) SnmpPdu was null, unable to lookup Trap-OID.

 

I cant locate the command nnmsetlogginlevel.ovpl  !

 

I tried Wireshark with the capturefilter :   snmp.trap and snmp.msgUserName matches "skvnnm" ,

but even though there is a new "Failed to parse trap" in nnmtrapdump  I cant catch it in Wireshark with this filter !

Strange !  looks like it is generated from "within" NNM, or ??

Regards

Erwin Brandt

 

0 Likes
Highlighted
Acclaimed Contributor.
Acclaimed Contributor.

Re: Failed to parse trap coming from what ip-address ?

Hello

 

Please run tcpdump command and put the output to an file and open the file in wireshark and you can check from where the trap is coming.

 

Usage

 

tcpdump -w /tmp/traps.log -i default-lan

 

where default-lan is the default lan interface in your NNM server.

 

But is there any reason why you want to parse a trap which fails.

0 Likes
The opinions expressed above are the personal opinions of the authors, not of Micro Focus. By using this site, you accept the Terms of Use and Rules of Participation. Certain versions of content ("Material") accessible here may contain branding from Hewlett-Packard Company (now HP Inc.) and Hewlett Packard Enterprise Company. As of September 1, 2017, the Material is now offered by Micro Focus, a separately owned and operated company. Any reference to the HP and Hewlett Packard Enterprise/HPE marks is historical in nature, and the HP and Hewlett Packard Enterprise/HPE marks are the property of their respective owners.