3 Replies Latest reply on Mar 7, 2016 12:56 PM by nvyguardsman

    HOST-RESOURCES-MIB Flooding /var/log/messages

    nolladam89

      Quick question for the SolarWinds PROs out there....

       

      In all of my RHEL6 Machines, snmpd is flooding /var/log/messages with this,

      "snmpd[51263]:     -- HOST-RESOURCES-MIB::hrSWRunPath.814"

       

      There are roughly 40 or 50 of these every time Solarwinds Polls the machine. So parsing through the logs becomes a serious pain.

       

      I have tried changing the snmp options to = OPTIONS="-LS0-6d -Lf /dev/null -p /var/run/snmpd.pid"

      This does not work on those MIB messages.

       

      Any Ideas on how to stop these messages?

       

       

      Thanks,

       

      Adam

       

       

        • Re: HOST-RESOURCES-MIB Flooding /var/log/messages
          harsaran@yahoo.com

          I'm not sure if you're still looking for a solution, however I ran into the same issue. It was more of an annoyance than anything else. I had two options using rsyslogd:

           

          1. Log snmp messages to a separate file, taking all snmp messages out of /var/log/messages

          or

          2. Drop the snmp messages via the rsyslog daemon. If you're not using rsyslog v5.8 (ex: syslogd, syslog-ng, etc...) I can't  guarantee this will work, as I haven't tested this on anything else. Add this to your /etc/rsyslog.conf just before the entry which is logging snmp - for me it was '/var/log/messages':

           

          # Remove excessive SNMP logging when Sam queries

          # this node

          :msg, contains, "-- HOST-RESOURCES-MIB" ~

          :msg, contains, "send response: Too long" ~

           

           

          The first line will discard anything containing the string "-- HOST-RESOURCES-MIB", the 2nd line is optional. Also, note the tilde (~) at the end of the line. The only caveat, this may affect debugging in the future, you'll have to remember to comment those lines out if you're trying to debug any issues with your node and SAM....

          • Re: HOST-RESOURCES-MIB Flooding /var/log/messages
            harsaran@yahoo.com

            I should also note, there is another option which is to stop snmp from logging to syslog completely

             

            look at your /etc/init.d/snmpd

            remove the -LS directive

            /usr/sbin/snmpd -LS0-6d -Lf /dev/null -p /var/run/snmpd.pid

             

            This is would it would look like:

            /usr/sbin/snmpd -Lf /dev/null -p /var/run/snmpd.pid

             

            For whatever reason adjusting the log levels didn't seem to have any effect on my test system.

            • Re: HOST-RESOURCES-MIB Flooding /var/log/messages
              nvyguardsman

              I am also having this issue on a RHEL 7 box and tried both of these changes but the message still pops up in /var/log/messages which is filling our var partitions.  Not sure what is causing it or how to get it to stop.