O.k. I'm desperate.

Any NT 4.0 guru's out there know if the SNMP service runs a periodical test/check/execution of some sort.

Reason being, I'm trying to run an application that, only when the SNMP service is running, fails every 3 minutes.

I would be grateful for any clues.

Kind regards,

David.

 

David,

Obviously I don't know how much you know about SNMP, however a few things to look at:

1. What are you using SNMP for, what management applications do you use, ie. what is querying SNMP on your server?

2. Are there any entries in the event logs?

3. Have you watched memory usage on your machine in the 3 minutes before your application crashes?

4. Have you recently installed any service packs on this server what SP is it running?

5. Try increasing the logging level of SNMP on your server

 

As far as I know, it doesnt... but what do I know..

Make sure the box is SP'ed... there are known bugs with vanilla (un-SP'ed) SNMP on NT4

J.

 

Andrew,

Thanks for replying.

I know diddly-squat about SNMP for NT. In fact I know diddly-squat about NT. I'm a VMS SysAdmin. But I've got myself involved in this problem which I'm very close to resolving, but I need that last bit of proof.

In answer to your questions:

1. None (that I know of) The server doesn't get too upset if SNMP is shutdown for long periods of time (workaround for problem )
But in future, some sort of management/monitoring tools may run on here.

2. No, nothing obvious. Every now and then the failing application posts something but thats a red-herring. Nothing in 3 minutes intervals

3. Yep, tried that. Noticed nothing.

4. No recent service packs, however I have no idea which have been installed when the server was built.

5. I'll try. Looks out of my league, but I'll find some help.

If you have any other ideas/suggestions, please mail me offline (david.lewis@instinet.co.uk)
Many thanks again.

David.

 

Cheers J.

Will look into that also

 

As firefox said pre SP4 there are several SNMP probs, check the registry key:

HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersion

to see what SP you're running.

Andrew...

 

AFAIK The SNMP service on NT doesnt do anything itself.

Basically its a translation/transmission service, in that it will take an alert generated by the system, assign it a value from the MIB (Management Informatio Base) and then send that via TCP/IP to a management station.

What you are likely to have is another service that is running checks/polls every few minutes that is interacting with the snmp service to send the result. This other service may not even be running on this machine!

You might have a network management station somewhere running Openview or tivoli or unicenter or somesuch that is just regularly checking everythings ok with that box.

 

Lancat.

Now that makes sense!

 

Me make sense? Unheard of

Oh btw... What make is the server?

If it's a Compaq look out for Insight Agents. These are great tools that report the status of hardware and warn if its about to fail. These poll the system regularly and use snmp. I believe IBM use similar technology.

 

Following on..

Most "recognised" makes of Server/manufactuer use SNMP alerting.

Make sure there isnt any management software on there, like Unicentre/TNG..etc..

These include SNMP...

Just check the obvious.. but I agree..sounds like it is something other than the generic NT SNMP service.

J. *God.. I sound like a geek!*

 

Run netstat at the command prompt at the time the application crashes (or write a batch to log it).

This will show you all IP connections to your host (with ports; snmp is udp/161 & 162 by default) and highlight if it's something external doing a mib walk or similar. This is unlikely though - snmp tasks should be low priority, if something more important comes along snmp is dropped.

What's the application that's crashing? Does it try to use the snmp service, or implement it's own version (you could check by stopping MS snmp and checking if the box is still listening on udp's 161/162)?

If it relies on the MS SNMP service be careful with any vendor management poackages (ie; Compaq's Insight). As an example, you can't have HP Openview NM server on NT4 will full Insight installed - crashes all over the place due to both apps trying to use snmp service.

Best bet - de-install the snmp service 'til you need it. Certainly don't use default community strings (ie; passwords!) - big hole!

Richard