SNMPTT did not translate traps for Nagios XI

[yholderby]

I did also checked the unconfigured objects list in Admin page, but nothing there...the current situation simply is seeing new log in /var/log/snmptt/snmpttunknown.log after snmp traps were sent from remote server and I have attached them in my first post.

I don't have snmptt.log though, I suppose that's because nagios have not successfully receive any recognizable snmp traps yet

[scottwilkerson]

Did you run the addmib command for these mibs?

[yholderby]

yes, I did. I answered it at my second post as well since I don't recall I see any error after running the command, and snmptt.conf has new mibs listing after that. Is there any files/log that you need to confirm addmib was run successfully?

[sreinhardt]

No, I trust you on the addmib, and it doesn't create a log, I just missed it from above. Lets enable debugging and let a few traps come in. In snmptt.ini change:

Code: Select all

[Debugging]
# 0 - do not output messages
# 1 - output some basic messages
# 2 - out all messages
DEBUGGING = 0

# Debugging file - SNMPTT
# Location of debugging output file.  Leave blank to default to STDOUT (good for
# standalone mode, or daemon mode without forking)
DEBUGGING_FILE =
# DEBUGGING_FILE = /var/log/snmptt/snmptt.debug

# Debugging file - SNMPTTHANDLER
# Location of debugging output file.  Leave blank to default to STDOUT
DEBUGGING_FILE_HANDLER =
# DEBUGGING_FILE_HANDLER = /var/log/snmptt/snmptthandler.debug

to:

Code: Select all

[Debugging]
# 0 - do not output messages
# 1 - output some basic messages
# 2 - out all messages
DEBUGGING = 2

# Debugging file - SNMPTT
# Location of debugging output file.  Leave blank to default to STDOUT (good for
# standalone mode, or daemon mode without forking)
#DEBUGGING_FILE =
 DEBUGGING_FILE = /var/log/snmptt/snmptt.debug

# Debugging file - SNMPTTHANDLER
# Location of debugging output file.  Leave blank to default to STDOUT
#DEBUGGING_FILE_HANDLER =
 DEBUGGING_FILE_HANDLER = /var/log/snmptt/snmptthandler.debug

Then restart snmptt and give it a bit. Once at least a few traps have come through, either tar and attach those debug files or run the following two commands and send back the output.

Code: Select all

tail -n 50 /var/log/snmptt/snmptthandler.debug
tail -n 50 /var/log/snmptt/snmptt.debug

[yholderby]

snmphandler.debug seems normal, I attached it here...

Code: Select all

[root@rhcs-node01 ~]# tail -n 50 /var/log/snmptt/snmptthandler.debug

SNMPTTHANDLER started: Wed Jan  8 19:25:17 2014

s = 1389237917, usec = 335629
s_pad = 1389237917, usec_pad = 335629

Data received:

<UNKNOWN>

UDP: [192.168.14.96]:53500->[192.168.14.13]

DISMAN-EVENT-MIB::sysUpTimeInstance 0:0:00:00.00

SNMPv2-MIB::snmpTrapOID.0 SNMPv2-SMI::enterprises.8756.100.1.2.10.2.0.100

SNMPv2-SMI::enterprises.8756.100.1.1.10.0 ""

SNMPv2-SMI::enterprises.8756.100.1.1.20.0 ""

SNMPv2-SMI::enterprises.8756.100.1.1.30.0 ""

SNMPv2-SMI::enterprises.8756.100.1.1.40.0 ""

SNMPv2-SMI::enterprises.8756.100.1.1.50.0 ""

SNMPv2-SMI::enterprises.8756.100.1.1.60.0 0

SNMPv2-SMI::enterprises.8756.100.1.1.70.0 ""

SNMPv2-SMI::enterprises.8756.100.1.1.80.0 ""

SNMPv2-SMI::enterprises.8756.100.1.1.90.0 ""

SNMPv2-SMI::enterprises.8756.100.1.1.100.0 ""

SNMPv2-SMI::enterprises.8756.100.1.1.110.0 ""

SNMPv2-SMI::enterprises.8756.100.1.1.130.0 ""

SNMPv2-SMI::enterprises.8756.100.1.1.140.0 ""

SNMPv2-SMI::enterprises.8756.100.1.1.150.0 ""

SNMPv2-SMI::enterprises.8756.100.1.1.160.0 ""

SNMPv2-SMI::enterprises.8756.100.1.1.170.0 ""

SNMPv2-SMI::enterprises.8756.100.1.1.120.0 ""

But something interest in the snmptt.debug as below as it complain about unable to translate due to the fact that net-snmp perl module are not enabled...

Code: Select all

Processing file: #snmptt-trap-1389237913960959
Reading trap.  Current time: Wed Jan  8 19:25:16 2014
Symbolic trap variable name detected (DISMAN-EVENT-MIB::sysUpTimeInstance).  Will attempt to translate to a numerical OID
  Could not translate - Net-SNMP Perl module not enabled - will leave as-is

I recall there is one line net_snmp_perl_enable in snmptt.ini to enable net-snmp perl module, so I enable it and then restart snmptt as below...snmptt will not start anymore..

Code: Select all

[root@rhcs-node01 ~]# service snmptt restart
Stopping snmptt:                                           [  OK  ]
Starting snmptt: Can't locate SNMP.pm in @INC (@INC contains: /usr/local/lib64/perl5 /usr/local/share/perl5 /usr/lib64/perl5/vendor_perl /usr/share/perl5/vendor_perl /usr/lib64/perl5 /usr/share/perl5 .) at (eval 12) line 1.
died at /usr/sbin/snmptt line 426.

Not sure if I am going toward the right direction, does this error make sense to anyone?

[yholderby]

Just want to provide more information to speed thing up...here is my installed package about net-snmp

Code: Select all

[root@rhcs-node01 ~]# rpm -qa | grep snmp
net-snmp-devel-5.5-49.el6.x86_64
php-snmp-5.3.3-27.el6_5.x86_64
net-snmp-utils-5.5-49.el6.x86_64
snmptt-1.4-0.6.beta2.el6.noarch
net-snmp-libs-5.5-49.el6.x86_64
net-snmp-5.5-49.el6.x86_64

And, yes there is no net-snmp-perl-XXX, so if it is in fact what I need, why it is not in the package and how do I get it now?

[sreinhardt]

Your error above about unable to translate OIDs, is exactly what I thought would be going on. Unfortunately I have yet to find a good answer. It seems that the snmptt daemon might have been written to look for very specific directories that do not exist on a standard cent yum install of the net-snmp, even though the files do exist and from my understanding are within the perl @INC pathing. The only thought I have at the moment, that I have seen floating around is to enable/disable oid translation from snmptt.ini. I have noticed this on a few forums when researching the issue, but have not altered it on my own setup yet. The lines specifically that you might try changing between 0 and 1:

Code: Select all

(your current values as of first post)
net_snmp_perl_enable = 0
translate_log_trap_oid = 0

From my understanding, because you have net_snmp_perl_enable set to 0, it should not even attempt to translate to these shortnames, so I am not sure if this is happening due to snmptrapd or when placed in the spool directory. ... Which gives me another idea (sorry to write out loud). Let's try cat-ing one or more of the files in /var/spool/snmptt/ as those would be straight from snmptrapd, and if they are being translated when in there it is an issue there and not with snmptt.

Code: Select all

for file in $(ls /var/spool/snmptt/ | tail -n 5); do cat /var/spool/snmptt/$file; done

[sreinhardt]

lmiltchev figured it out today, at least on our systems. You need to install net-snmp-perl not just the perl-net-snmp package. you may also need to enable net_snmp_perl_enable = 0 in snmptt.ini and restart snmptt. This is what we did and it worked great again!

[yholderby]

Great!! it works here as well after net-snmp-perl is installed and net_snmp_perl_enabled =1. Now I can start my setup for a HA nagios. Excellent Jobs!!

[tmcdonald]

Glad to see it's working! Going to lock this up now, feel free to open a new thread for any other issues you may have.