pentaho/pentaho-kettle · error · KettleException

Null Usm

Error message

Null Usm

What it means

In JobEntrySNMPTrap.execute for SNMPv3, after Snmp.snmpInstance/createUserEntry, snmp.getUSM() may return null; the code then throws KettleException 'Null Usm'. The SNMP4J User-based Security Model was not initialized in the SNMP session, so the v3 user cannot be registered.

Solutions

  1. Retry the trap send; ensure a fresh Snmp session is created per execute (the code path builds a replacement USM only when non-null path fails).
  2. Check the SNMP4J library version and align with the one bundled/tested with this Pentaho version.
  3. Ensure auth/priv passphrases and engine ID settings are valid lengths (MD5/DES require >=8 chars) so user creation succeeds before getUSM().
  4. Enable debug logging on the job entry to see how far SNMP session setup progressed before the null USM.
Defensive patterns

Strategy: retry

Validate before calling

// Pre-check SNMPv3 parameters before execute
if (userName == null || passPhrase == null || passPhrase.length() < 8) {
  throw new IllegalArgumentException("SNMPv3 user/passphrase invalid (min 8 chars)");
}

Try / catch

try {
  result = jobEntry.execute(prevResult, nr);
} catch (KettleException e) {
  if ("Null Usm".equals(e.getMessage())) {
    logError("SNMP USM not initialized; check SNMP4J version/engine ID, retrying");
    // rebuild session and retry once
  }
}

Prevention

When it happens

Trigger: execute() with targettype=SNMPv3 when the underlying Snmp session's USM is null - typically when MPv3 engine boot/index state is inconsistent or the session was created without the security model initialized.

Common situations: Multiple trap sends in one JVM reusing sessions oddly; SNMP4J version behavior differences around engine ID initialization; engine ID/boots configuration issues for the local engine.

Understand the failure class

Background: "This is a bug, please report it": internal invariant violations, unreachable panics, and SNH errors explained — this error's family across 47 libraries.

Related errors

AI-assisted analysis of pentaho/pentaho-kettle@f3058517a1 (2026-09-13). Data as JSON: /api/errors/b0c95d10cc51c9a8. Report an issue: GitHub.

Appendix: source

Thrown at engine/src/main/java/org/pentaho/di/job/entries/snmptrap/JobEntrySNMPTrap.java:469

        usertarget.setRetries( retry );
        usertarget.setTimeout( timeOut );
        usertarget.setVersion( SnmpConstants.version3 );
        usertarget.setSecurityLevel( SecurityLevel.AUTH_PRIV );
        usertarget.setSecurityName( new OctetString( "MD5DES" ) );

        // Since we are using SNMPv3 we use authenticated users
        // this is handled by the UsmUser and USM class

        UsmUser uu =
          new UsmUser(
            new OctetString( userName ), AuthMD5.ID, new OctetString( passPhrase ), PrivDES.ID,
            new OctetString( passPhrase ) );

        USM usm = snmp.getUSM();

        if ( usm == null ) {
          throw new KettleException( "Null Usm" );
        } else {
          usm = new USM( SecurityProtocols.getInstance(), new OctetString( MPv3.createLocalEngineID() ), 0 );
          usm.addUser( new OctetString( userName ), uu );
          if ( log.isDebug() ) {
            logDebug( "Valid Usm" );
          }
        }

        // create the PDU
        ScopedPDU pdu = new ScopedPDU();
        pdu.add( new VariableBinding( new OID( Oid ), new OctetString( messageString ) ) );
        pdu.setType( PDU.TRAP );
        if ( !Utils.isEmpty( engineID ) ) {
          pdu.setContextEngineID( new OctetString( engineID ) );
        }

        // send the PDU
        response = snmp.send( pdu, usertarget );

View on GitHub (pinned to f3058517a1)