topic SNMP Authentication failure trap in Server Management - Systems Insight Manager

SNMP Authentication failure trap

paquins — Tue, 12 May 2009 13:38:30 GMT

Hi
Using Hp Insight Manager v5.0, I have around 300 computers managed and sending traps to IM. Around 20 computers/servers give numerous authentication failure traps and I am trying to correct this problem. After searching the web, I have found that this problem is often related to incorrect community strings and I have checked that first. Community strings are OK.
For instance, a server HP Proliant G5 with Windows W2k3 server is sending 6 auth traps at the same time everyday. Another computer running Windows XP is sending 50 traps everyday.

My questions are:
How do I diagnose what is happening?
What do I need to check?
What exactly is generating these traps?
TIA
Steve

Exact message is:
Description
An authenticationFailure trap signifies that the SNMPv2 entity, acting in an agent role, has received a protocol message that is not properly authenticated. While all implementations of the SNMPv2 must be capable of generating this trap, the snmpEnableAuthenTraps object indicates whether this trap will be generated.

Trap details
Mib Information
The associated MIB File Name for this trap issnmpv2-mib.mib and the MIB identifier SNMPv2-MIB

Re: SNMP Authentication failure trap

David Claypool — Tue, 12 May 2009 14:51:39 GMT

Do you have any other application using SNMP in your network? Everything can be fine between you HP SIM server and your targets, but if someone else is doing SNMP scanning with the wrong community string, the authentication trap will be generated. Best practice is to disable that trap, BTW, because it can easily overwhelm your SNMP trap receiver.

Re: SNMP Authentication failure trap

paquins — Tue, 12 May 2009 16:02:14 GMT

Yes. OpManager is also using SNMP to collect data at 5 minutes intervals. But the frequency of the authentication traps(5-10 traps once a day) does not correspond to the polling frequency of OpManager(every 5 minutes).
How do I find who is doing SNMP requests on my server?
You suggest that it is best practice to disable authentication traps? Do you have reading info on suggested best practices on SNMP config?

Steve