HP SIM to OV Trap Issue

[Robert Streitz]

Since upgrading from SIM 5.2 to 6.0, the traps that we are forwarding from SIM to OV, are leaving SIM and arriving to OV. However, when attempting to Log the event, OV is recieving the "BER Error: Wrong field in sequence expected class:APPLICATION(1) tag:3 but found class:UNIVERSAL(0) tag:2". We suspect that there is an issue with having the trap showing SNMPv2 and the trap header showing "version: version-1 (0). Anyone seeing this or have suggestions? See attachement from wireshark. Thanks.

[Robert Streitz]

Note.....after DL'ing the attachment, rename to .JPG, then open. Sorry.

[Ulli Kassner]

I'm having the exact same problem with traps that SIM is supposed to forward to our syslog server (which understands SNMP). In Wireshark I can see the traps leave the SIM server and arrive at the syslog server but they're not processed and displayed. I can also confirm the inconsistency of SNMPv1 being announced in the header and then SNMPv2 being called in the message body.

Two additional things seem strange to me:
1. SIM sends the trap twice in a row with slightly different content and both are received but not processed.

2. Wireshark also shows me the "BER Error" but I'm unsure if this might be a Wireshark issue since Google found documents indicating that this is a false positive by Wireshark.

Does anybody have a hint for us? Thanks!

[Ulli Kassner]

I found out that the issue with the messages arriving twice was a configuration mistake. But the Problem with the malformated SNMP traps remains... anybody?

[Köhne]

Hello,

we got similar errors with Tivoli TEC SNMP adapter and BMC BEM SNMP adapter as well.
Is there a solution pronounced?

Tivoli:
Thu Jul 8 10:54:14 2010 LOW: KERNEL , err 00, /libtecad/main.c line 0330: Main loop : receiving event
Thu Jul 8 10:54:14 2010 MINOR: DRVSPEC, err 01, on/driver_snmp.c line 0747: Error parsing pdu packlet
Thu Jul 8 10:54:14 2010 MAJOR: DRVSPEC, err 01, on/driver_snmp.c line 0597: snmp_receive_trap() failed
Thu Jul 8 10:54:14 2010 MINOR: DRIVER , err 01, ibtecad/driver.c line 0291: TECAD_GetEvent() failed
Thu Jul 8 10:54:14 2010 MINOR: KERNEL , err 01, /libtecad/main.c line 0334: GetEvent error

BMC:
Convert::ASN1 error: decode error 02<=>43 at /BMCT/bem/Impact/server/lib/perl/Convert/ASN1/_decode.pm line 108.

[emerson2]

HP released patch to HP SIM 6 solving the problem. You need to replace some jar files and restart HP SIM.

Look for files at ftp://sim6pach@ftp.usa.hp.com

HOTFIX60_004.jar
HOTFIX60_TrapHandler.jar
nnm.jar
patch1.jar

Kind regards,
Roman

[Torben Holm]

Hi.

How to install these patches ? And is it all right to patch SIM 6.1 with these ?

I count on to put all the JAR files in the HP SIM patch directory ???

[Darrin Rawls]

No, SIM 6.1 doesn't need any 6.0 hot fixes as those fixes are already contained.

[Robert Streitz]

ftp://sim6pach@ftp.usa.hp.com

Link is broken? Cannot connect. Thx.

[emerson2]

Url is working fine. Did you enter valid password for user sim6pach (Sim6pach)?

How to apply patch:

1. Download the jar files , copy them to the <>\patch
2. Once copied restart the sim service
3. Log into SIM
4. Go to help and about.
5. Under patch you should see the names of the jar files copied.

Once this is done, try the forwarding of the traps.

[Darrin Rawls]

That link doesn't work for me either. I think that is a support hot fix, and your browser has cached your credentials. To get this hot fix, I believe you have to call in to support.

[Köhne]

We have upgraded to HPSIM version 6.1.
The SNMP traps are still broken.
Has anyone experienced the same problem and even more interesting has anyone a cure for this?

[Robert Streitz]

Was anyone ever able to login to the ftp site? I can get to the site (or at-least the password prompt), but cannot get logged in. Need a password for the site to login and download the 4 files. Does anyone have a valid password or the 4 files that they can zip/email to me?

Would be greatly appreciated.

Thanks.

[Köhne]

Upgrading to 6.1 does not cure the problem.
If the patches are included in 6.1., those patches most likely would not cure the problem for 6.0, would they?

[emerson2]

Enter to your Internet explorer ( or another FTP client ) client following url:

ftp://sim6pach:Sim6pach@ftp.usa.hp.com

In the case it not work in IE, check the FTP settings in IE ( i.e. passive FTP mode is set, proxy settings ... )

[Köhne]

Patches implemented, SNMP traps are ok now!

[Robert Streitz]

Issue is not getting to the site, but supplying the password for the site, which I do NOT have.

[Ulli Kassner]

using SIM 6.1 and the patches works for me! the traps are now in the right format an can be processed by our syslog server!

@robert.streitz: the link ftp://sim6pach:Sim6pach@ftp.usa.hp.com already contains the username and password prior to the @. the username is "sim6pach" and the password "Sim6pach" which is a bit strange cause it's misspelled. In Firefox the link works with the standard setting just by clicking on it. You could also try opening it by copying the whole link to a windows explorer address bar.

[Robert Streitz]

Thx all. I called support and they emailed me the files. I have applied them (copied and restarted SIM). Fingers are crossed.