Smarts SAM: Event Text in a trap is displayed in hexadecimal format instead of ASCII format

Products

VMware Smart Assurance

Issue/Introduction

Symptoms:

Traps that have non printable characters

Smarts Service Assurance Manager (Smarts SAM) 8.1.x, 9.0 through 9.3.x, Event Text in a trap is displayed in hexadecimal format instead of ASCII format as it was in Smarts SAM 7.2

For instance:

In the ITOTrapConv.log, you will see the oids that are being displayed as HEX

======================== Trap attributes =========================

Timestamp: '16-Sep-2014 03:18:17 AM GMT'

Agent: '172.19.19.5'

Enterprise OID: '.1.3.6.1.4.1.8233.1.2.1'

Generic Type: '6'

Specific Type: '5'

Varbinds: [oid]->[varbind]

'.1.3.6.1.4.1.8233.1.2.2.5' --> 'MAJOR'

'.1.3.6.1.4.1.8233.1.2.2.7' --> 'omnams01.ivanet.net'

'.1.3.6.1.4.1.8233.1.2.2.8' --> 'iAgent'

'.1.3.6.1.4.1.8233.1.2.2.9' --> 'cluster'

'.1.3.6.1.4.1.8233.1.2.2.10' --> 'OS'

'.1.3.6.1.4.1.8233.1.2.2.11' --> '41 4C 41 52 4D 5F 52 41 49 53 45 44 3A 20 56 20

42 72 61 7A 69 6C 20 42 75 73 69 6E 65 73 73 20

4D 61 6E 61 67 65 6D 65 6E 74 20 4C 54 44 2E E2

80 93 20 33 30 36 38 38 34 37 30 30 31 20 6E 75

6D 62 65 72 20 6F 66 20 6F 75 74 62 6F 75 6E 64

20 54 72 61 6E 73 63 65 69 76 65 72 20 73 65 73

73 69 6F 6E 73 20 69 73 20 62 65 6C 6F 77 20 6D

69 6E 69 6D 75 6D 20 6F 66 20 31 '

'.1.3.6.1.4.1.8233.1.2.2.12' --> '6F 6D 6E 61 6D 73 30 31 2E 69 76 61 6E 65 74 2E

6E 65 74 20 56 20 42 72 61 7A 69 6C 20 42 75 73

69 6E 65 73 73 20 4D 61 6E 61 67 65 6D 65 6E 74

20 4C 54 44 2E E2 80 93 20 33 30 36 38 38 34 37

30 30 31 20 6F 75 74 62 6F 75 6E 64 5F 54 72 61

6E 73 63 65 69 76 65 72 5F 73 65 73 73 69 6F 6E

73 '

'.1.3.6.1.6.3.18.1.3.0' --> '172.19.19.5'

'.1.3.6.1.4.1.733.6.3.18.1.5.0' --> '1'

'.1.3.6.1.4.1.733.6.3.18.1.6.0' --> 'AC 13 13 05 '

Environment

VMware Smart Assurance - SMARTS

Cause

In Smarts SAM 7.2 and earlier versions, Smarts SAM "guesses" the display format for octet strings based on code logic. If the guess determines an octet string should be displayed as hexadecimal, the string is displayed as hexadecimal.

Resolution

In Smarts SAM 8.1.3 and later versions, there is an option to bypass the guess logic and force the octet string to be displayed as specified in the trapd.conf configuration file as follows:

Associating an OID with DISPLAY_HEX will force the varbind value (octet string only) to be passed as hexadecimal.
Associating an OID with DISPLAY_PRINT_STRING will force the octet string to be interpreted as a printable display (ASCII) string.

This is valid only for octet strings, not for other data types.

To configure the DISPLAY format to force octet strings for specified OIDs that relate directly to the Varbinds that have the issue to be parsed as printable ASCII display format, do the following:

Open the trapd.conf configuration file on the Smarts SAM server using sm_edit.
Find the following entry:

DISPLAY: <OID> <DISPLAY_HEX " DISPLAY_PRINT_STRING>
Uncomment the entry and specify the desired format. The following shows an example OID (from the above example) specified to display as a display (printable) string (ASCII):

DISPLAY: .1.3.6.1.4.1.8233.1.2.2.11 DISPLAY_PRINT_STRING DISPLAY: 1.3.6.1.4.1.733.6.3.18.1.6.0 DISPLAY_PRINT_STRING

An additional example below:

Customer presented an issue with Orion Network Monitoring Software that was configured to send a trap to Smarts Trap adapter. This software sends non- printable ASCII text to the trap adapter and we tested 8.1.4, 9.2 and 9.3 without the DISPLAY setting for the actual OIDS for the impacted varbinds the trap adapter displayed the varbinds in Hexadecimal format. In this example the varbinds 5 and 8 were impacted.

DISPLAY: .1.3.6.1.4.1.11307.10.5 DISPLAY_PRINT_STRING

DISPLAY: .1.3.6.1.4.1.11307.10.8 DISPLAY_PRINT_STRING

Explanation: OID .1.3.6.1.4.1.11307.10 Varbind 5 and 8.

The information can be easily found if the trap definition is using the "Logfile: <filename> line to create a log in the local/logs folder for the traps.

Additional Information

NOTE

The above solution may not work on its own. If it is found not to resolve the issue, then you need to add the following step:

1. In your trapd.conf file, set ASCII keyword needs to be set to TRUE as follows:

ASCII: TRUE

2. Restart the domain and see if that resolves the issue