SNMP Service stops responding

joshm · Post by **joshm** » Fri Oct 07, 2005 3:13 pm

Sorry if this has been answered before but doing some searches I wasn't able to find any fixes for my problems. I have 3 windows xp boxes that keep having the SNMP service crash. They run fine for awhile until someone actually starts to use the box so I am pretty sure its just some program on these 3 boxes that is causing the service to stop responding. The problem is the service does not actually crash/create an event log so I am kind of stumped on troubleshooting the problem.

Anyone have any ideas where to start troubleshooting this? These 3 boxes all serve the same purpose for the company so they all have the same software loaded up. Although 1 other box actually has not had any problems. Or maybe just a suggestion for an alterative to the MS SNMP service to install in these boxes would be the easiest thing to do.

Thanks for any help
-Josh

FYI All of these computers run XP /SP2, but firewall should be disabled with Panda as the Antivirus program running.

BSOD2600 · Post by **BSOD2600** » Sat Oct 08, 2005 7:05 pm

When you mean it crashes, you mean it stops returning SNMP data, right? I haven't run into that problem with my xp/win2k3 machines. Are you sure it's not the firewall/av that might be blocking the snmp requests?

Post by **TheWitness** » Sat Oct 08, 2005 7:21 pm

If it's crashing, please post the event log entries. Thanks,

TheWitness

joshm · Post by **joshm** » Mon Oct 10, 2005 12:10 pm

Ok, well I was wrong about the service pack 2 only 1 of the 3 troubled computers had it installed. Now all these computers got updated and have service pack 2 and all available updates installed.

On these systems SNMP never crashes. If I goto the services manager it shows that the service is started. But it will not respond to SNMP requests. The machines all run Panda Corp antivirus that is controlled from a central server, but I have other machines with the same Panda config that have no SNMP problems nor should Panda be doing any firewall type actions anyway. The windows firewall has also been double checked and is disabled on all 3 of these systems. Plus restarting the service and SNMP responds it just then stops responding 5 mins. later. So if it was a firewall problem I would suspect that it would kill the SNMP right away. I just cleared even viewer & restarted service just to test and
other than the message about SNMP restarting nothing popped in it when it stopped responding to Cacti. I have tried Getif as well just to make sure it was not communication problem between Cacti server and this system.

-Josh

BSOD2600 · Post by **BSOD2600** » Mon Oct 10, 2005 12:34 pm

Odd. I suggest you post your SNMP problem to a forum specific to Microsoft problems like DSLreports.com.

In the mean time, the only other option you have is to use the Net-SNMP snmp agent.

joshm · Post by **joshm** » Mon Oct 10, 2005 1:57 pm

BSOD2600 wrote:Odd. I suggest you post your SNMP problem to a forum specific to Microsoft problems like DSLreports.com.

In the mean time, the only other option you have is to use the Net-SNMP snmp agent.

Ok, I'll give that a try as well. I just noticed that it only crashes once I start monitoring and graphing parts of the system. If I just leave the device listed a but not graphing it does not seem to cause an SNMP lockup. But the moment I told it to start graphing hard drive space it crashed after the next poll. Or more like stopped responding.

I use host up detection of SNMP & Ping FYI.

-Josh

Post by **TheWitness** » Mon Oct 10, 2005 2:53 pm

Many of the AV vendors are starting to intercept/control the IP stack. When this happens, some applications will just start to break. I suggest you perform testing with Panda and/or other firewalls disabled and see if it makes a difference. I suspect Panda since many thousands of people have no issues with Cacti (well relatively minor ones anyway).

TheWitness

BSOD2600 · Post by **BSOD2600** » Mon Oct 10, 2005 2:56 pm

Right, which is why I asked if he was sure if the AV/firewall was blocking it. I had a simular problem with VPN connections and Norton AV 2005. They've now included a damn firewall feature in in. Even with all of norton services disabled, I still had problems. Uninstalling the damn POS was the fix. Just an FYI...

Post by **TheWitness** » Mon Oct 10, 2005 3:19 pm

I'm note quite sure I understand what you mean, what is a POS???

TheWitness

p.s. Just kidding, I did see Men in Black. They drove a black one...

joshm · Post by **joshm** » Tue Oct 11, 2005 9:36 am

Ok well I installed Net SNMP on these boxes but now it only monitors the ethernet interface not the hard drive or CPU. Excuse my cacti ignorence, but what is involved in making cacti work with the net snmp agent vs. the default MS SNMP service. I was just using the default windows templates to do the graphing.....

-Josh

Post by **TheWitness** » Tue Oct 11, 2005 9:20 pm

I would have recommended some lab testing with the AV software removed rather than installing the Net-SNMP agent myself. Although, Net-SNMP is infinitely configurable.

TheWitness

joshm · Post by **joshm** » Wed Oct 12, 2005 8:08 am

Panda is installed on every system & server in the office and these are the only 3 with the problem. Panda gets its configuration from a central server within the office so any blocking would happen to all or none of the client systems. You can't manually change a client setting if you tried on an individual PC basis. So I am 99% sure it would not be a problem with Panda blocking/preventing access to the MS SNMP service.

-Josh

BSOD2600 · Post by **BSOD2600** » Wed Oct 12, 2005 12:54 pm

I'd still double check the Panda AV settings. When looking on the Panda AV site, I noticed that most of their software has some sort of firewall in it.

joshm · Post by **joshm** » Wed Oct 12, 2005 1:50 pm

Well I have seen programs do things it shouldn't before so I went ahead and took your suggestion. Uninstalled panda from 1 of the 3 and have Cacti monitoring it now. Now to just wait and see if snmp drops off or not. Also while uninstalling it I double checked the settings configured for it and it had no native Firewall features. But it does do antispam/email filtering so there is a chance it would still be doing something funky in order to monitor the traffic that could be causing the problems.

-Josh

joshm · Post by **joshm** » Fri Oct 14, 2005 8:03 am

Well all is seeming well now so thanks for you suggestions on checking on panda. I should have known better, but the one thing I wasn't taking into account is that although Panda was running on every other system I monitor, it was running the server version not the XP client version. Somehow 1/4 desktops managed to function ok with panda, but now with filtering options disabled the other 3 are functioning fine as well.

Thanks again,
Josh

SNMP Service stops responding

SNMP Service stops responding

Who is online