Where can I find the Engine ID number that NPM has for a device?

I am looking for where the Device engine ID number is stored for NPM. I am having an issue where I am not receiving SNMPv3 traps from one of my devices. I need to look to see if NPM has the correct device engine id number of the device that is sending the traps. I see where the handshake is sent to NPM, but NPM does not send back to the NMS. I am thinking that the device may be sending from an different engine id than NPM knows about. I have looked at everything else...credentials, firewall rules, acls, IPs, different authentication types. I get no "unknown user and engine" or "engine already exists" message in the NPM events either.

Find more posts tagged with

network_monitoring

SNMP

solarwinds

network_management

npm

Accepted answers

sean.martinez

The device EngineID from the SNMP polling of the device is not stored.

This is a snippit from my SNMPv3 Configuration Document Setup SNMPv3 via CLI for Cisco Devices

SNMPv3 Traps (Orion Core 2011.2 and higher )

Note: This assumes that you have setup and configured SNMPv3 on the device already.

Add the following while in Configuration Terminal:
1. Command: snmp-server host 10.10.1.6 version 3 auth TestSNMPv3User version 3
  1. The authentication must match the same as the SNMPv3 configuration

You can add the following on the same command line to generate Traps:

config syslog aaa_server snmp ( these are basic Trap types sent.)

Troubleshooting SNMPv3 Traps.

Check the Log File:
1. Server 2008:
  1. C:\ProgramData\Solarwinds\Logs\Orion\TrapService.log
1. Server 2003
  1. C:\Documents and Settings\All Users\Application Data\Solarwinds\Logs\Orion\TrapService.log
If you see the following Error please see This KB

ERROR TrapService.TrapService - Bad trap packet received from Node with IP <IP of Device>. Error description : Security level is set to 2 but no encryption password was provided.

All comments

adatole

In the nodes table: Nodes.EngineID

You can see the NAME of the engine by running the query:

select Nodes.NodeID, Nodes.Caption, Nodes.IP_Address, Nodes.Machine_Type, Nodes.Vendor,

Engines.Servername

from Nodes

join Engines on Nodes.EngineID = Engines.EngineID

goodzhere

I know how to find the engine name of the SolarWinds server that the device is assigned to. I am looking for the engine id (and not name) of the device that SolarWinds is receiving traps from. SolarWinds reports in its events that is received a bad SNMPv3 trap from a device with a unknown engine or the (device, not SolarWinds server) engine already exists. Since it reports this, SolarWinds NPM must be getting the device engine ID from somewhere. I am looking for where that engine ID is stored.

bsciencefiction.tv

EngineID is also available in the Traps table. It is the second column of the table.

sean.martinez

The device EngineID from the SNMP polling of the device is not stored.

This is a snippit from my SNMPv3 Configuration Document Setup SNMPv3 via CLI for Cisco Devices

SNMPv3 Traps (Orion Core 2011.2 and higher )

Note: This assumes that you have setup and configured SNMPv3 on the device already.

Add the following while in Configuration Terminal:
1. Command: snmp-server host 10.10.1.6 version 3 auth TestSNMPv3User version 3
  1. The authentication must match the same as the SNMPv3 configuration

You can add the following on the same command line to generate Traps:

config syslog aaa_server snmp ( these are basic Trap types sent.)

Troubleshooting SNMPv3 Traps.

Check the Log File:
1. Server 2008:
  1. C:\ProgramData\Solarwinds\Logs\Orion\TrapService.log
1. Server 2003
  1. C:\Documents and Settings\All Users\Application Data\Solarwinds\Logs\Orion\TrapService.log
If you see the following Error please see This KB

ERROR TrapService.TrapService - Bad trap packet received from Node with IP <IP of Device>. Error description : Security level is set to 2 but no encryption password was provided.

goodzhere

hmmmm. I don't know how SolarWinds NPM knows the trap is coming from a device engine ID that already exists if it is not stored somewhere. The issue that I am having is with SNMPv3 traps from a McAfee firewall. I need to see if there is a way to see if the engine of the firewall (that is sent with the SNMPv3 trap handshake) is the engine id that SolarWinds NPM expects to be receiving SNMPv3 traps from. The engine ID in the traps table and the Nodes table is the Engine ID of the SolarWinds server (or poller) that the node is assigned to. This is NOT the same as the monitored device (or trap sender) engine ID. I don't understand how SolarWinds NPM can have events on the SolarWinds Events page that state "unknown user and engine" or "engine already exists" if the engine id of the device is not stored somewhere. These events occur when SNMP traps are sent from the same device from different IP addresses on the device. I see this when the SNMP trap source interface is not set or cannot be set. SolarWinds sees the traps coming from an engine id that has a different ip address assigned to it. The polling ip address is linked to a specific device engine ID and if traps come from a different ip (other than the polling ip), the "engine already exists" message is logged. If the "unknown user and engine" message is logged, it means that SolarWinds does not have that device added or the device SNMPv3 credentials for decrypting the trap are wrong. So if SolarWinds is doing this, the engine id for the device has to be known to SolarWinds NPM. My question is where is SolarWinds getting this engine ID from?

haripala

Thanks sean.martinez