SNMP inform configuration errors in syslog

Products

• VMware vSphere ESXi

Issue/Introduction

You can examine /var/log/syslog.log to identify SNMP inform configuration errors. This article lists some common syslog error entries that can occur while the SNMP agent is sending informs.

For more information about syslog messages that you can use to verify that the ESXi SNMP agent is configured correctly for sending informs, see ESXi SNMP agent log entries for informs (2033466)

For more information on using the esxcli to diagnose problems with SNMP configuration, see KB 2033528: Debugging with the esxcli system snmp test command.

Environment

VMware vSphere ESXi 6.0
VMware vSphere ESXi 5.1
VMware vSphere ESXi 5.5

Resolution

• If a remote user has been set using the –R option with wrong authorization or privacy hash:

2012-07-05T06:56:25Z snmpd: snmpd: Sr_init_inform: remote engine id is unknown for '10.112.170.205:2264', will attempt discovery
2012-07-05T06:56:25Z snmpd: snmpd: Sr_init_inform: notification queue now at 1 items
2012-07-05T06:56:25Z snmpd: snmpd: SendToIpTransport: sendto(fd=6, length=69) rc = 69
2012-07-05T06:56:25Z snmpd: snmpd: Sr_send_inform: discovery inform {secLevel: noAuthNoPriv, serial: 2, user: '', authSnmpEngineID: ''} pdu sent to 10.112.170.205:2264 size 69 retries left: 3

2012-07-05T06:57:26Z snmpd: snmpd: Sr_init_inform: engine id discovery already in progress, enqueue inform serial 3
2012-07-05T06:57:26Z snmpd: forward_notifications: processing notifications complete. 1 offered, 1 traps delivered, 0 traps failed to parse
2012-07-05T06:57:26Z snmpd: retrieve_report: no file (/tmp/cvtcimsnmp.xml) found to parse
2012-07-05T06:57:31Z snmpd: snmpd: SendToIpTransport: sendto(fd=6, length=179) rc = 179
2012-07-05T06:57:31Z snmpd: snmpd: Sr_send_inform: inform {secLevel: authPriv, serial: 3, user: 'user3', authSnmpEngineID: '80001f880430783031323334'} pdu sent to 10.112.170.205:2264 size 179 retries left: 2
2012-07-05T06:57:41Z snmpd: snmpd: SrInformTimeout: total informs lost so far 1 out of 0 delivered, last one 56 seconds ago
2012-07-05T06:57:46Z snmpd: snmpd: SrInformTimeout: inform not delivered. serial: 3 timed out, discarding.
2012-07-05T06:57:46Z snmpd: snmpd: SrInformTimeout: total informs lost so far 2 out of 0 delivered, last one 0 seconds ago

• If the receiving SNMP client is not configured and listening:

2012-07-05T05:57:08Z snmpd: snmpd: Sr_init_inform: Initializing to send InformRequest serial 3. timeout=500 retry=3
2012-07-05T05:57:08Z snmpd: snmpd: Sr_init_inform: remote engine id is unknown for '10.112.170.205:2264', will attempt discovery
2012-07-05T05:57:08Z snmpd: snmpd: Sr_init_inform: notification queue now at 2 items
2012-07-05T05:57:08Z snmpd: snmpd: Sr_init_inform: engine id discovery already in progress, enqueue inform serial 3
2012-07-05T05:57:08Z snmpd: forward_notifications: processing notifications complete. 1 offered, 1 traps delivered, 0 traps failed to parse
2012-07-05T05:57:18Z snmpd: snmpd: SendToIpTransport: sendto(fd=6, length=69) rc = 69
2012-07-05T05:57:18Z snmpd: snmpd: Sr_send_inform: discovery inform {secLevel: noAuthNoPriv, serial: 3, user: '', authSnmpEngineID: ''} pdu sent to 10.112.170.205:2264 size 69 retries left: 1
2012-07-05T05:57:18Z snmpd: snmpd: SrInformTimeout: inform not delivered. serial: 2 timed out, discarding.
2012-07-05T05:57:18Z snmpd: snmpd: SrInformTimeout: total informs lost so far 1 out of 0 delivered, last one 0 seconds ago

• The following errors appear in the syslog.log file in the following situations:

• If the authentication protocol or privacy protocol defined for the ESXi SNMP agent is different from that of the SNMP client application. For example, if the agent is configured for MD5 and the client is configured for SHA1.
• If the user name defined for the ESXi SNMP agent is different from that defined for the SNMP client application.
• If the authorization key or privacy key defined for the ESXi SNMP agent is different from that defined for the SNMP client application.
  

2012-07-05T06:03:58Z snmpd: snmpd: SrParseV3SnmpMessage: parsed message header:authSnmpEngineID: 80:00:1f:88:04:30:78:30:31:32:33:34, contextSnmpEngineID: 80:00:1f:88:04:30:78:30:31:32:33:34, contextName: -
2012-07-05T06:03:58Z snmpd: snmpd: SrInformProcessResponse: Error parsing response/report to InformRequest, error code 600 SR_USM_UNSUPPORTED_SEC_LEVELS
2012-07-05T06:04:03Z snmpd: snmpd: SendToIpTransport: sendto(fd=6, length=151) rc = 151
2012-07-05T06:04:03Z snmpd: snmpd: Sr_send_inform: inform {secLevel: authPriv, serial: 5, user: 'user3', authSnmpEngineID: '80001f880430783031323334'} pdu sent to 10.112.170.205:2264 size 151 retries left: 1
2012-07-05T06:04:03Z snmpd: snmpd: SrInformTimeout: total informs lost so far 3 out of 0 delivered, last one 94 seconds ago
2012-07-05T06:04:03Z snmpd: snmpd: SrInformResponse: Got response/report to InformRequest from 10.112.170.205:2264
2012-07-05T06:04:03Z snmpd: snmpd: ReceiveFromIpTransport: recvfrom(fd=6, length=2048) rc = 104
2012-07-05T06:04:03Z snmpd: snmpd: SrInformProcessResponse processing packet size 104
2012-07-05T06:04:03Z snmpd: snmpd: SrParseV3SnmpMessage: usmUserName = 'user3' pdu request is securityLevel noAuthNoPriv(1), usm entry was authPriv returning unsupported security level

• If the remote engine ID configured in the ESXi SNMP agent is wrong:

2012-07-05T07:03:15Z snmpd: snmpd: Sr_init_inform: engine id discovery already in progress, enqueue inform serial 3
2012-07-05T07:03:20Z snmpd: snmpd: SrBuildV3SnmpMessageUSM: no keys configured, usmUserName = user3, usmUserEngineID = 80:00:1f:88:04:30:78:30:31:32:33:34
2012-07-05T07:03:20Z snmpd: snmpd: SrBuildV3SnmpMessageUSM: no keys configured, usmUserName = user3, usmUserEngineID = 80:00:1f:88:04:30:78:30:31:32:33:34
2012-07-05T07:03:25Z snmpd: snmpd: SrInformTimeout: inform not delivered. serial: 2 timed out, discarding.
2012-07-05T07:03:25Z snmpd: snmpd: SrInformTimeout: total informs lost so far 1 out of 0 delivered, last one 0 seconds ago