"Generic Unregistered" and "authentication failure" alerts in HP SIM 6.1

[mathewr]

Hi,

Can anyone help me with the below questions:

1. Why do we see "Generic Unregistered" alerts and how do we fix it?

2. Why do we see "authentication failure" alerts and how do we fix it?

3. Though I see disk failure alerts from a specific linux server through HPSIM 5.2, I don't see any alerts from that server through HPSIM 6.1. I couldn't figure out why this behaviour only for one server in the plant. All other servers are generating alerts through both HP SIM 5.2 and 6.1. Any clues on these

HPSIM 5.2 is running on linux server and HP SIM 6.1 is running on a Windows 2008 virtual machine.

MIBs have been imported to the management server for HPSIM. After updating MIBs, the number of "Generic Unregistered" alerts have been reduced and started getting more specific alerts like "authentication failure".

However, I don't see any specific issues with authentication or server health on these associated servers.

1. Detailed Description for "Generic Unregistered" alerts as shown below.

Description: A genericUnregistered trap signifies that a system has sent a trap to the management server for a MIB that has not yet been compiled. Try compiling any MIBs from the vendor for this system to obtain additional information. See Details for more information.

Event Category: Proliant Miscellaneous Events

Trap Details
Variable Description Value

Enterprise OID String. 1.3.6.1.4.1.8072.4      
Generic Trap ID. 6      
Specific Trap ID. 2      

Mib Information: The associated MIB File Name for this trap is cpqgen.mib and the MIB identifier CPQGEN-MIB  

2.

Description: An authenticationFailure trap signifies that the SNMP entity has received a protocol message that is not properly authenticated. While all implementations of SNMP entities MAY be capable of generating this trap, the snmpEnableAuthenTraps object indicates whether this trap will be generated.
Event Category: Unassigned

Trap Details
Mib Information: The associated MIB File Name for this trap is snmpv2-mib.mib and the MIB identifier SNMPv2-MIB      

Any help on this is appreciated very much.

Thanks and Regards,

Renju.

[shocko]

Is SIM 6.1 running the latest MIB files? If not, import and register them. Also, are the systems sending these traps supported y SIM i.e.. Do you have MIBS for them? Check if unregistered events are enabled in the event filter settings. If SIM cannot decode an SNMP OID and this is enabled then it will generate the generic event. AS far as auth, it may be linked to the first issue so sort that out first :)

[mathewr]

Hi Shocko,

Thanks for your response. Though MIBs are updated to v8.70, we still see these alerts. All these systems are HP servers.

So it must be supported by HPSIM.

Please find more details below.

Hardware Models:

-------------------------

1. Proliant DL380 G5.
2. Proliant DL585 G5.

OS versions of the servers causing alerts:

--------------------------------------------------------

1. Red Hat Enterprise Linux AS release 4 (Nahant Update 5)
2. Red Hat Enterprise Linux AS release 4 (Nahant Update 6)
3. SUSE LINUX Enterprise Server 9 (i586)VERSION = 9 PATCHLEVEL = 4
4. Redhat AS 4.0 Patch Level 4
5. Microsoft Windows 2008 R2

Could you or anybody else think of any other scenario which causes these alerts ?

Yes, SNMP trap for "Generic Unregistered" alerts are enabled. We would like to identify whether these servers are trying to tell us about any specific issues on these servers.  So far we could not identify any obvious hardware issues on these servers.

Any help on this is much appreciated.

Thanks and Regards,

Renju.

[shocko]

I would register all the MIBS (take a back of the MIBS driectory first!) and see if the issue persists. Whats happens when you send a test trap fro one of the servers? Is the trap recognized?

[shocko]

To register the MIBS see:

• http://www.hp.com/wwsolutions/misc/hpsim-helpfiles/simsnmp.pdf

[mathewr]

Hi Shocko,

Thanks again. If we see the MIB under SNMP trap settings, that means these MIBs are already registered. Is it not ? In other words, only the registered MIBs will appear under Options --> Events --> SNMP trap settings ? I see all these MIBs under SNMP trap settings. So what could be the next possible reason? If I send a test trap from any of these servers, then it comes as Generic Unregistered alerts.

However, it gives valid alerts regarding disk failures etc. as expected whenever there is a real hardware failure, except for only one server. We observed that HP SIM 6.1 did not give a disk failure alert from one particular server whereas HP SIM 5.2 captured it without fail.

Still Generic Unregistered alert issue persisits. Any help is much appreciated.

Thanks and Regards,

Renju.

[shocko]

Test trap should not come in as generic unregistered. I would even just re-register the mib for test traps and see if that helps.

[shocko]

From the cmd line run

• mxmib -l

and post output. This should tell us exactly what MIBS are registered. After that we can use the -t switch on a MIB to make sure all traps are registered.

[mathewr]

Hi Shocko,

Please find LIST OF MIBS

adaptec.mib
asmib.mib
atmf.mib
avsnmpv1.mib
bkupexec.mib
bladetype2-acl.mib
bladetype2-network.mib
bladetype2-physical.mib
bladetype2-qos.mib
bladetype2-switch.mib
bladetype2-trap.mib
bridge.mib
cageagt.mib
cisco-cdp.mib
cisco-cluster.mib
cisco-config-copy.mib
cisco-config-man.mib
cisco-entity-fru-control.mib
cisco-entity-vendortype-oid.mib
cisco-envmon.mib
cisco-flash.mib
cisco-ftp-client.mib
cisco-igmp-filter.mib
cisco-image.mib
cisco-ip-stat.mib
cisco-l2l3-interface-config.mib
cisco-lag.mib
cisco-mac-notification.mib
cisco-memory-pool.mib
cisco-pae.mib
cisco-pagp.mib
cisco-ping.mib
cisco-port-security-mib.mib
cisco-process.mib
cisco-products.mib
cisco-rttmon.mib
cisco-stack-mib.mib
cisco-stackmaker.mib
cisco-stp-extensions.mib
cisco-syslog.mib
cisco-tc.mib
cisco-tcp.mib
cisco-udldp.mib
cisco-vlan-iftable-relationship.mib
cisco-vlan-membership.mib
cisco-vtp.mib
compaq-agent.mib
compaq-id-rec.mib
cpq-traps.mib
cpq54nn.mib
cpqapli.mib
cpqappg80.mib
cpqclus.mib
cpqcmc.mib
cpqcr.mib
cpqdceeo.mib
cpqdmii.mib
cpqdsccs.mib
cpqfca.mib
cpqfix.mib
cpqgen.mib
cpqhlth.mib
cpqhost.mib
cpqhostb.mib
cpqhsv110v3.mib
cpqica.mib
cpqida.mib
cpqide.mib
cpqidrec.mib
cpqiodrv.mib
cpql2mgt.mib
cpqlinos.mib
cpqn5226a.mib
cpqnic.mib
cpqpower.mib
cpqrack.mib
cpqrecov.mib
cpqrpm.mib
cpqsanapp.mib
cpqsanevent.mib
cpqSasSwitch.mib
cpqscsi.mib
cpqservice.mib
cpqsinfo.mib
cpqsm2.mib
cpqsrvmn.mib
cpqstat.mib
cpqstdeq.mib
cpqstsys.mib
cpqswcc.mib
cpqthrsh.mib
cpqups.mib
cpqwcrm.mib
cpqwinos.mib
dataprotector.mib
dell10892.mib
dellarymgr.mib
dlghwinf.mib
ems.mib
emsmibax.mib
entity-mib.mib
etherlike.mib
EVA4400_ABM.mib
evapamib.mib
fa-mib40.mib
fddi-smt73-mib.mib
fe-mib.mib
fpipes.mib
gbe2c-1-10g-l2l3.mib
gbe2c-10g-l2l3.mib
gbe2c-l2l3.mib
h22agent.mib
HCNUM-TC.mib
hp-mccluster.mib
hp-switch-pl.mib
hpeccmib.mib
hpipf02trap.mib
hpipftrap.mib
hpn.mib
hpnetctz.mib
hpnr.mib
hpov-nnm.mib
hpovsam.mib
hpovsam_im.mib
hpprfmib.mib
hpsgcluster.mib
hpsvrmgmt-oid.mib
hpswa.mib
hptat.mib
hptrap.mib
hs_agent.mib
hubnvle.mib
ianaiftype-mib.mib
ibmmmalert.mib
ibmserveraid.mib
ibmums.mib
ibmumsevent.mib
ieee8021-pae.mib
ieee8023-lag.mib
if-mib.mib
igmp-mib.mib
LEFTHAND-NETWORKS-GLOBAL-REG-MIB.mib
LEFTHAND-NETWORKS-NSM-CLUSTERING-MIB.mib
LEFTHAND-NETWORKS-NSM-DNS-MIB.mib
LEFTHAND-NETWORKS-NSM-INFO-MIB.mib
LEFTHAND-NETWORKS-NSM-MIB.mib
LEFTHAND-NETWORKS-NSM-NETWORK-MIB.mib
LEFTHAND-NETWORKS-NSM-NOTIFICATION-MIB.mib
LEFTHAND-NETWORKS-NSM-NTP-MIB.mib
LEFTHAND-NETWORKS-NSM-SECURITY-MIB.mib
LEFTHAND-NETWORKS-NSM-STATUS-MIB.mib
LEFTHAND-NETWORKS-NSM-STORAGE-MIB.mib
lsf001.mib
mlxraid.mib
msa2000traps.mib
ndstrap.mib
NET-SNMP-AGENT-MIB.mib
NET-SNMP-MIB.mib
nsaasr.mib
nsadimm.mib
nsaevent.mib
nsainfo.mib
nsapci.mib
nsarps.mib
nsascsi.mib
nsatrcfg.mib
nsatrmgr.mib
nsavolcp.mib
nsnicmib.mib
nwalarm.mib
nwserver.mib
old-cisco-chassis.mib
old-cisco-flash.mib
old-cisco-interfaces.mib
old-cisco-ip.mib
old-cisco-sys.mib
old-cisco-tcp.mib
old-cisco-ts.mib
ovis-v2.mib
p-bridge-mib.mib
parselog.mib
pcisnet.mib
pfc.mib
powernet.mib
q-bridge.mib
qlogicmib2.mib
radlan-mib.mib
rfc-1215.mib
rfc1155-smi.mib
rfc1155.mib
rfc1213.mib
rfc1215.mib
rfc1271-mib.mib
rfc1514.mib
rmon-mib.mib
rmon2-mib.mib
smsagent.mib
snmp-mpd-mib.mib
snmp-notification-mib.mib
SNMPv2-CONF.mib
snmpv2-mib.mib
SNMPv2-SMI-v1.mib
SNMPv2-SMI.mib
snmpv2-tc-v1.mib
SNMPv2-TC.mib
svrclu.mib
svrmgt.mib
svrntc.mib
switch.mib
symtrap.mib
tcp-mib.mib
token-ring-rmon-mib.mib
token.mib
truclu.mib
ucd-snmp-mib.mib
udp-mib.mib
unified.mib
v5_0ficon.mib
v5_1ha.mib
v5_3sw.mib
vc-domain-mib.mib
vc-module-mib.mib
VMWARE-AGENTCAP-MIB.mib
VMWARE-ENV-MIB.mib
VMWARE-OBSOLETE-MIB.mib
VMWARE-PRODUCTS-MIB.mib
VMWARE-RESOURCES-MIB.mib
VMWARE-ROOT-MIB.mib
VMWARE-SYSTEM-MIB.mib
VMWARE-TC-MIB.mib
VMWARE-TRAPS-MIB.mib
VMWARE-VC-EVENT-MIB.mib
VMWARE-VMINFO-MIB.mib
VMWARE-VMKERNEL-MIB.mib
wbt3mib.mib
xp1024trapmib.mib
zesa.mib
zhrm.mib
zsmp.mib
ztmx.mib
ztsa.mib

COMMAND COMPLETED SUCCESSFULLY

C:\Users\Administrator>

Any input is appreciated.

[mathewr]

cpqgen.mib is the one which generates "Generic Unregistered" alerts and snmpv2-mib.mib is the one which generates "authentication failure" alerts. As I mentioned before, we do not want to miss any critical issues from any server; hence we would like to have a suitable fix instead of just disabling SNMP trap for these MIBs. Any help is appreciated very much.

Also we have noticed a strange behaviour from one particular server where HP SIM 6.1 did not report disk failure on that server; however HP SIM 5.2 reported that disk failure. All other servers are giving disk failure alerts in both the versions of HP SIM.

Any clue on this ?