snmpdm : High CPU and system hang up

[Ravi_79]

Hello Everyone,

System details : HP 9000, N-class 4 CPUs
OS : HP-ux 11.00 ( PA Risc )

Recently i had system hung up due to high system cpu utlization. So i have to reboot the server and kill high cpu used process. Now System is fine. I tried to analyze the problem.

snmpdm is process caused system hung-up.
1) Why snmpdm is caused this problem ( like 100% CPU ). I never had this problem last 2 years. It is runing same hardware and OS.
2) If i stop this process, do i get any problem. I think, i am not using this process anywhere. what will not work, if i stop this process.
3) does snmpdm problem cause with network intruse device. ( hack system ). my network person kept some hack system in the internal network. ( to test our servers )

Any help will be appreciated.

Regards
Ravi.

[Robert Bennett_3]

Ravi -

Here are my snmpdm notes. The patches noted are old so you will have to get newest version.

1 - Why - either need a patch or snmpd.conf needs to be revised.
2 - Stopping process will stop MIB monitoring (OenView or NNM)
3 - I'm not sure

snmpdm - Useful Information



Edit /etc/SnmpAgent.d/snmpd.conf verify that the following 5 lines are correct:

Get-community-name: public

Set-community-name: godfrey3

Location: VeryRemoteCity, State

Contact: Unix Admin

Trap-dest:



Install the latest emanate agent patch for SNMP

(PHSS_21045 10.20 or PHSS_21046 for 11.x - check if superceded)

(corrects a mib2agt slowly uses memory problem)



Verify that the snmp master daemon starts: ps -ef|grep snmp

snmpdm


Verify that the snmp agent processes are running: ps -ef|grep agt

/usr/sbin/trapdestagt

/usr/sbin/hp_unixagt

/usr/sbin/mib2agt



To start (this is the easiest way. See man pages for the other way)

snmpd

(executes master plus all agents listed in SnmpAgtStart.d)



To kill:

kill -9 {snmpd process id)

NOTE: snmpd -k and/or snmpdm -k does not work





VERIFICATION IF ALL AGENTS ARE NOT RUNNING:



Change to the following directories and make sure these links are there, if not make them.



cd /sbin/rc2.d - used for sytem startup

ln -s /sbin/init.d/SnmpHpunix S565SnmpHpunix

ln -s /sbin/init.d/SnmpMib2 S565SnmpMib2

ln -s /sbin/init.d/SnmpTrpDst S565SnmpTrpDst



cd /sbin/rc1.d - used for system shutdown

ln -s /sbin/init.d/SnmpHpunix K435SnmpHpunix

ln -s /sbin/init.d/SnmpMib2 K345SnmpMib2

ln -s /sbin/init.d/SnmpTrpDst K435SnmpTrpDst



cd /sbin/SnmpAgtStart.d - used for snmpdm startup/kill



ln -s /sbin/init.d/SnmpHpunix S565SnmpHpunix

ln -s /sbin/init.d/SnmpMib2 S565SnmpMib2

ln -s /sbin/init.d/SnmpTrpDst S565SnmpTrpDst



ln -s /sbin/init.d/SnmpHpunix K435SnmpHpunix

ln -s /sbin/init.d/SnmpMib2 K345SnmpMib2

ln -s /sbin/init.d/SnmpTrpDst K435SnmpTrpDst



Hope this helps

B

[Anthony Lennan · Accepted solution]

Hi Ravi,

I can confirm that the cause of your snmpdm process using 100% CPU has almost certainly been caused by your network administrator doing intrusion testing.

I have noted exactly the same issue with snmpdm using 100% CPU on a number of the servers here where I work. I have traced the cause of the issue back to our network team who do occasional port scans on the network. I have noted that the issue has been present on servers running both 11.00 and 11.11.

You may be able to confirm my theory by looking at /var/adm/syslog/syslog.log and looking for any illegal port errors that may have been logged during the intrusion testing. Then compare those times to the timestamp on your /var/adm/snmpd.log file.

If the intrusion testing that your network administrator was performing was just a one off thing then you can probably get away without doing anything as it shouldn't be common problem. Otherwise you could always try installing the latest patches like recommended above.

Regards,
Anthony