SNMP Traps - Mangled packet issue

s.jayaram · ‎11-29-2010

One of our client using EMC SMARTS trap Adapter to collect SNMP traps from Resource Manager Essentials > Tools > Change Audit > Automated Action. recieves mangled packet every night around midnight from the LMS3.1 server as shown below. I could not find any scheduled process at midnight on the server. Attached is a file capture during that period

Any idea what is causing this ?

26-Nov-2010 12:01:29 AM+554ms E. Australia Standard Time] t@2712 SNMP_TrapsHandler [0.0.0.0:162] Processor
SNM2-E-SNMP_AGENTERRORSTATS-Below message for SNMP agent at
    '10.200.4.57:9033', was suppressed 0 times since The Epoch
SNMP-EPARSER-Mangled or incorrect packet; parsing aborted and data discarded;
    in file "h:/FOUNDATION-7.2.0.X/137/smarts/snmp/lib/SNMP_Parser.c" at line
    1312

[26-Nov-2010 12:01:50 AM+272ms E. Australia Standard Time] t@2712 SNMP_TrapsHandler [0.0.0.0:162] Processor
SNM2-E-SNMP_AGENTERRORSTATS-Below message for SNMP agent at
'10.200.4.57:9060', was suppressed 0 times since The Epoch
SNMP-EPARSER-Mangled or incorrect packet; parsing aborted and data discarded;
in file "h:/FOUNDATION-7.2.0.X/137/smarts/snmp/lib/SNMP_Parser.c" at line

Joe Clarke · ‎12-04-2010

I looked at the trap PDUs that correspond the timestamps in the log output, and I do not see any problems. Is there additional debugging you can enable in the Smarts application that will indicate why it thinks these traps are mangled?

The traps themselves come from RME because it looks like you have enabled Inventory and Config collection failure notification, and RME cannot fetch the config from certain devices. It appears that perhaps RME is doing periodic config collection or polling around 11:30 pm when these traps start to get generated.

s.jayaram · ‎12-09-2010

Hi,

Thanks for the response,

Attached is the debug received fo review.

Let me know if you can find any issues

Regards

SJ

Joe Clarke · ‎12-10-2010

I still don't see any problem. The trap seems to be expanded correctly by Smarts, then it throws an error. I suggest you persue this with EMC for now. If they can provide a more pointed problem with the trap. We can then look into that. For now, my thinking is that there is a problem with Smarts (possibly due to the format of the failure details).