MIBs
Management Information Base (MIB) files are virtual databases of variables describing the conditions at each SNMP device. MIBs provide a hierarchical structure of uniquely identify managed objects and their individual object identifiers (OIDs) that can be read and used by the Trapd LAM.
The Trapd LAM is shipped with a base set of MIBs in the $MOOGSOFT_HOME/etc/mibs
directory. These contain all of the basic imports that complex MIBs require. If custom MIBs are required these must be parsed using the Mibparser utility. See Parse MIBs for Trap Integration for more information.
MIB Best Practice
Moogsoft cannot provide enterprise-specific MIBs as part of the distribution. Customers are responsible for supplying their own vendor- or enterprise-specific MIBs that are current to the devices sending the traps. Traps are processed incorrectly if these MIBs are out-of-date or missing.
If there is no MIB for a trap, you can write a basic MIB to cover the required translation and OID-to-name conversion. If you do not have any specific MIBs you have to create trap processing modules manually.
MIB Loading Sanity Checks
The Trapd LAM is strict with OID definitions in MIBs and performs a number of sanity checks on the them. Some of the scenarios and logging warnings you can expect in these checks include:
MIB name already in use
If there are two or more MIBs with the same name, the Trapd LAM uses the last read MIB and ignores any previous versions. It is important to ensure that there are no discrepancies like this as you could have undesired behavior in trap resolution.
Imported MIB not found
If a MIB imports and references another MIB that cannot be found in $MOOGSOFT_HOME/etc/mibs
, any definitions using that reference are not resolvable. In this scenario, the Trapd LAM logs the following warning message :
WARN: Import [SNMPv2-SMI] not found for Mib [NET-SNMP-MIB]
Conflicting names in MIB
If the same name is used to identify two or more different OIDs, only the first entry is accepted. For example, if internet
is defined twice in two different OIDs, the Trapd LAM only considers the first to be part of the MIB:
internet OBJECT IDENTIFIER ::= { dod 1 } internet OBJECT IDENTIFIER ::= { dod 2 } directory OBJECT IDENTIFIER ::= { internet 1 }
In this example, directory is considered to be {dod 1 internet 1}
.
Conflicting OIDs in MIB:
If a MIB maps the same OID to two or more different names, only the first definition is accepted. The Trapd LAM logs subsequent definitions with a warning message such as:
netSnmpModuleIDs OBJECT IDENTIFIER ::= { netSnmpEnumerations 1 } snmpDomainsConflict OBJECT IDENTIFIER ::= { netSnmpEnumerations 1 }
In this example, { netSnmpEnumerations 1 }
is defined twice under two different names so only the latest occurrence of { netSnmpEnumerations }
is considered part of the MIB. Here is an example of an OID conflict warning log message:
WARN : OID Conflict: Full OID [1.3.6.1.4.1.8072.3.1] has conflicting names, Mib [NET-SNMP-MIB -> snmpDomainsConflict] & Mib [NET-SNMP-MIB -> netSnmpModuleIDs]
Conflicting names between two or more MIBs
If the same OID is mapped to multiple names between two or more MIBs, the Trapd LAM only accepts the first definition. The Trapd LAM logs any subsequent definitions with a warning message:
WARN: OID Conflict: Full OID [1.3.6.1.4.1.42.1.1] has conflicting names, Mib [MIB-1 -> deviceTemperature] & Mib [MIB-2 -> deviceTemp]
Object extends unknown parent
If an object definition references a parent which is not defined or imported in the MIB, then that object is not resolvable. The Trapd LAM logs a warning message such as:
snmpDomainsConflict OBJECT IDENTIFIER ::= { snmpv3 1 }
In this example, snmpv3
has not been defined or imported, so snmpDomainsConflict
cannot be resolved and Trapd LAM displays a log warning message:
WARN: Mib [NET-SNMP-MIB]:Unable to resolve and find SINGLE parent for Mib Object [snmpDomainsConflict ::= { snmpv3 1 }]
Hex String Output values
MIBs are used to define SNMP OIDs (Object Identifiers) and their attributes, so the agent know how to interpret a trap message. When you define an object in the MIBs, you can give it optional attributes such as:
DISPLAY-HINT
: Used to indicate to the agent how to display a value of this object.DEFVAL
: Tells the agent the default value for the object and the input type (string, hex, integer).
The Trapd LAM uses these definitions in MIBs to determine when a value should be outputted as a hexadecimal string (hex). If they are not used, the Trapd LAM attempts to output the value in human-readable ASCII format, which may not be as intended. For example, if a hex format is not specified, an object with the value 4D4F4F47
is outputted as the ASCII string MOOG
when the intended output is 4D4F4F47
.
DISPLAY-HINT Guidelines
The DISPLAY-HINT
clause instructs Trapd LAM how to display the hex string using the format: [digits]x[delimiter]
.
[digits]
represent the number of bytes to group before delimiting[delimiter]
is a single character which is used as the delimiter.
For example, an object with DISPLAY-HINT "1x_"
for value of 9e3f4242
outputs as follows: 9E_3F_42_42
An object with DISPLAY-HINT "2x-" clause for the same value outputs as a string: 9E3F-4242.
A varbind with DISPLAY-HINT "1x:"
and a value of 5cf9388e7dd4
outputs 5C:F9:38:8E:7D:D4.
This is the expected output for a MAC address.
DEFVAL Guidelines
The DEFVAL
definitions specify a hex type and also result in Trapd LAM outputting values as hex strings. The default format is 1x.
A DEFVAL definition specifies a hex type in the following format, normally followed by an upper or lower case 'h':
DEFVAL { '0000-ffff'h } DEFVAL { ''H }
If both DISPLAY-HINT
and DEFVAL
define recognisable hex formats, the DISPLAY-HINT
format is used. If neither DISPLAY-HINT
or DEFVAL
definition is correctly specified, the octet string values use the following logic:
If the value contains only printable ASCII characters (a range of
0x20
to0x7E
, and\t \n \v \f \r
) then the value is output as a human readable ASCII String.If the value does not contain the above specified printable characters then the value is outputted as a Hex String in the default format of
1x
.
If a Hex DISPLAY-HINT
or a Hex type DEFVAL
is supplied for a MIB object then the Trapd LAM outputs these values as hex strings, regardless of any syntax definitions. The Trapd LAM does not resolve or associate syntax definitions.
Base Set of MIBs:
The base set of MIBs that is shipped in the $MOOGSOFT_HOME/etc/mibs
directory contains the following:
AGENTX-MIB.txt | IPV6-UDP-MIB.txt | SNMP-MPD-MIB.txt | ||
BRIDGE-MIB.txt | LM-SENSORS-MIB.txt | SNMP-NOTIFICATION-MIB.txt | ||
DISMAN-EVENT-MIB.txt | MTA-MIB.txt | SNMP-PROXY-MIB.txt | ||
DISMAN-SCHEDULE-MIB.txt | MoogTraps.txt | SNMP-TARGET-MIB.txt | ||
DISMAN-SCRIPT-MIB.txt | NET-SNMP-AGENT-MIB.txt | SNMP-USER-BASED-SM-MIB.txt | ||
EtherLike-MIB.txt | NET-SNMP-EXAMPLES-MIB.txt | SNMP-USM-AES-MIB.txt | ||
HCNUM-TC.txt | NET-SNMP-EXTEND-MIB.txt | SNMP-USM-DH-OBJECTS-MIB.txt | ||
HOST-RESOURCES-MIB.txt | NET-SNMP-MIB.txt | SNMP-VIEW-BASED-ACM-MIB.txt | ||
HOST-RESOURCES-TYPES.txt | NET-SNMP-PASS-MIB.txt | SNMPv2-CONF.txt | ||
IANA-ADDRESS-FAMILY-NUMBERS-MIB.txt | NET-SNMP-TC.txt | SNMPv2-MIB.txt | ||
IANA-LANGUAGE-MIB.txt | NET-SNMP-VACM-MIB.txt | SNMPv2-SMI.txt | ||
IANA-RTPROTO-MIB.txt | NETWORK-SERVICES-MIB.txt | SNMPv2-TC.txt | ||
IANAifType-MIB.txt | NOTIFICATION-LOG-MIB.txt | SNMPv2-TM.txt | ||
IF-INVERTED-STACK-MIB.txt | RFC-1212.txt | TCP-MIB.txt | ||
IF-MIB.txt | RFC-1215.txt | TRANSPORT-ADDRESS-MIB.txt | ||
INET-ADDRESS-MIB.txt | RFC1155-SMI.txt | UCD-DEMO-MIB.txt | ||
IP-FORWARD-MIB.txt | RFC1213-MIB.txt | UCD-DISKIO-MIB.txt | ||
IP-MIB.txt | RMON-MIB.txt | UCD-DLMOD-MIB.txt | ||
IPV6-ICMP-MIB.txt | SCTP-MIB.txt | UCD-IPFWACC-MIB.txt | ||
IPV6-MIB.txt | SMUX-MIB.txt | UCD-SNMP-MIB.txt | ||
IPV6-TC.txt | SNMP-COMMUNITY-MIB.txt | UDP-MIB.txt | ||
IPV6-TCP-MIB.txt | SNMP-FRAMEWORK-MIB.txt |