System Management Guide: Communications and Networks

Troubleshooting SNMPv3

Following are some possible problems that may be encountered.

After upgrading from an earlier version of AIX to AIX 5.2, SNMP does not work the way it did before the migration.
You need to migrate the community and smux entries defined in the /etc/snmpd.conf file to the /etc/snmpdv3.conf file. For information on migrating this information, see Migrate from SNMPv1 to SNMPv3.
My requests are not generating any responses.
The most likely cause of this problem is a configuration error in either the /etc/snmpdv3.conf or /etc/clsnmp.conf files, or both. Carefully review these files to ensure that all information is entered correctly. For information on editing these files when creating new users, see Create Users in SNMPv3.
I have configured a new user using both authentication and privacy keys, but I get an error message when using this user.
The most likely cause is that you are not running the SNMPv3 encrypted version. Follow these steps to determine what version you are running:
1. Run ps -e|grep snmpd.
  - If you received no output, you probably need to start the snmpd daemon. Run startsrc -s snmpd.
  - If your output included snmpdv1, you are running SNMPv1. You will be able to make SNMPv1 requests when running this version.
  - If your output included snmpdv3ne, you are running the SNMPv3 non-encrypted version. After installing AIX 5.2, this version will be running. This version does not allow you to use privacy keys.
  - If your output included snmpdv3e you are running the SNMPv3 encrypted version, which is a separately-installable product. The SNMPv3 encrypted is available on the AIX Expansion Pack where allowed. The SNMPv3 encrypted version allows the use of privacy keys.
2. Determine if the version that you are running is the intended version. If it is not, use the snmpv3_ssw command to change the version as follows:
  - snmpv3_ssw -1 will switch to SNMPv1
  - snmpv3_ssw -n will switch to SNMPv3 non-encrypted
  - snmpv3_ssw -e will switch to SNMPv3 encrypted if it is installed
After making changes to the /etc/snmpdv3.conf file and refreshing the daemon, my changes are not taking effect.
After making changes to the /etc/snmpdv3.conf file, the SNMP daemon must be stopped and started. Refreshing the daemon will not work. Use the following procedure:
1. Stop the SNMP daemon by running stopsrc -s snmpd.
2. Start the SNMP daemon by running startsrc -s snmpd.
The DPI2 subagent is started, but I cannot query any MIB variables from it?
The most likely cause is that the public community is not configured in the /etc/snmpdv3.conf file. By default, and DPI2 subagent shipped with AIX uses the community name public to connect itself to the SNMP agent. The public community is configured in the /etc/snmpdv3.conf file by default. If you have removed the public community from the /etc/snmpd.conf file, add the following lines to the file:
```
VACM_GROUP group1 SNMPv1 public -
VACM_VIEW defaultView 1.3.6.1.4.1.2.2.1.1.1.0 - included -
VACM_ACCESS  group1 - - noAuthNoPriv SNMPv1  defaultView - defaultView -
COMMUNITY public    public     noAuthNoPriv 0.0.0.0     0.0.0.0         -
```
1.3.6.1.4.1.2.2.1.1.1.0 is the OID for dpiPortForTCP.0.
I cannot query MIB variables that are managed by the smux peer as I could before I migrated.
Ensure that your smux entry is present in the /etc/snmpdv3.conf and the /etc/snmpd.peers files. If you configure new smux peers, ensure that they are entered in both of these files as well.
I have implemented my own set of MIB variables, but I cannot include or exclude them from users' views.
In the VACM_VIEW entry in the /etc/snmpdv3.conf file, you must specify the OID of the MIB variable rather than the MIB variable name.
I'm not receiving traps.
Ensure that you have configured the trap entries correctly in the /etc/snmpdv3.conf file. In addition, if the trap is an SNMPv3 trap, the /etc/clsnmp.conf file must also be configured. For instructions on configuring traps, see Create Users in SNMPv3.

In addition, make sure that the machine specified to receive traps (in the /etc/snmpdv3.conf file) is listening for them. You can start this process by running clsnmp trap on the command line.
Why is the DPI2 server not running in the SNMPv3 environment?
In the SNMPv3 architecture, the SNMPv3 agent itself runs the DPI2 server. See SNMPv3 Architecture for more information.