Regarding Snmp Trap forwardingfrom NAgios core to other host

[shubham]

Hello team,
i need to configure to nagios core to send receive snmp traps from network devices to other monitoring host for some test purpose.
Earlier i achieved this but due to some reason when i changed the receiving host ip it stopped working. i tried every possible solution for this but can't get it fix. the error which i am getting is in snmptrapd.log file which is :-


couldn't open udp:162 -- errno 98 ("Address already in use")


i tried every solution to kill the pid process of snmptrap and then restarting,if centos firewalld is blocking i have disabled it ,same done with disabling the selinux as well.
Kindly help !!!

[tgriep]

Can you post the snmptrapd.conf file so we can view it?
Then run these commands as root and post the output so we can see what is listening on port 162.

Code: Select all

netstat -anp |grep 162
ps -ef --cols=300 |grep snmp

[shubham]

Hello,
thank you for responding . As per your requirement i have shared the desired logs with you .
for the reference i am sharing with you the link through which i am trying to do the necessary configuration in nagios core.
http://askaralikhan.blogspot.com/2010/0 ... agios.html

refer below logs:

[root@in2-noisr-nms1 log]# cat snmptrapd.log
/etc/snmp/snmptrapd.conf: line 3: Warning: Unknown token: logOption.
couldn't open udp:162 -- errno 98 ("Address already in use")

[root@in2-noisr-nms1 log]# netstat -anp | grep 162
udp 0 0 0.0.0.0:162 0.0.0.0:* 27856/snmptrapd
unix 2 [ ACC ] STREAM LISTENING 27688 1620/gnome-session- @/tmp/.ICE-unix/1620
unix 2 [ ACC ] STREAM LISTENING 27689 1620/gnome-session- /tmp/.ICE-unix/1620
unix 2 [ ] DGRAM 33448 1620/gnome-session-
unix 3 [ ] STREAM CONNECTED 27451 1620/gnome-session-
unix 3 [ ] STREAM CONNECTED 27686 1620/gnome-session-
unix 3 [ ] STREAM CONNECTED 27683 1620/gnome-session-
unix 2 [ ] DGRAM 4242162 27634/error
unix 2 [ ] DGRAM 33618 1620/gnome-session-
unix 3 [ ] STREAM CONNECTED 32185 1620/gnome-session- @/tmp/.ICE-unix/1620

[root@in2-noisr-nms1 log]# ps -ef --cols=300 |grep snmp
root 12911 1 0 Sep26 ? 00:00:01 /usr/bin/perl /usr/sbin/snmptt --daemon
snmptt 12912 12911 0 Sep26 ? 00:00:02 /usr/bin/perl /usr/sbin/snmptt --daemon
root 27855 1 0 00:00 ? 00:00:00 /usr/sbin/snmpd -LS0-6d -f
root 27856 1 0 00:00 ? 00:00:00 /usr/sbin/snmptrapd -On -Lsd -f
nagios 28288 27863 0 00:01 ? 00:00:00 /usr/local/nagios/libexec/check_snmp -H 172.16.51.1 -C WEx2q342 -o 1.3.6.1.4.1.12356.101.4.4.2.1.8.1 -m all
nagios 28290 28288 0 00:01 ? 00:00:00 /usr/bin/snmpget -Le -t 3 -r 5 -m all -v 1 -c 172.16.51.1:161 1.3.6.1.4.1.12356.101.4.4.2.1.8.1
root 28328 12765 0 00:01 pts/0 00:00:00 grep --color=auto snmp
[root@in2-noisr-nms1 log]#

[tgriep]

Does your /etc/snmp/snmptrapd.conf file look similar to this

Code: Select all

disableAuthorization yes
traphandle default /usr/sbin/snmptthandler
authCommunity log,net public
forward default xxx.xxx.xxx.xxx public

This is what I use to forward traps from one server to the other and it seems to work fine.

[shubham]

Hello ,
thnx for reply .

i have made the changes in snmptrapd.conf file aacordingly but still the same error.

[root@in2-noisr-nms1 log]# tail -f /var/log/snmptrapd.log!
couldn't open udp:162 -- errno 98 ("Address already in use")

below is the changes that i have made ,Please refer: in place of public i have defined my community string and managment ip address to which i have to forward the trap.

[root@in2-noisr-nms1 ~]# cat /etc/snmp/snmptrapd.conf
disableAuthorization yes
traphandle default /usr/sbin/snmptthandler
authCommunity log,net WEx2q342
forward default 172.16.11.101 WEx2q342

[tgriep]

I want to verify which server you changed the IP address of. The system that first received the trap or the system you are forwarding the trap to?
Have you rebooted the server in case something is stuck holding that port?

You can try this, stop the snmptrapd daemon and verify that is is stopped.
Then run this command to run the snmptrapd daemon in debug more. It should show you more details on why it is not starting.

Code: Select all

snmptrapd -f -C -c /etc/snmp/snmptrapd.conf -Le -D

[shubham]

Hello,
Well i have changed the IP address of that server to which i have to forward the traps.
that is why in the previous mail i have defined the there ip address of the server (172.16.11.101) with community string WEx2q342.
i have rebooted the server few times but that did no good.
as you advised i did stop the snmptrapd service and execute the above command u mention .

below are the logs of that command related to that.

trace: netsnmp_tdomain_transport_full(): snmp_transport.c, 507:
tdomain: tdomain_transport_full("snmptrap", "udp:162", 1, "[NIL]", "[NIL]")
trace: find_tdomain(): snmp_transport.c, 462:
tdomain: Found domain "udp" from specifier "udp"
trace: netsnmp_lookup_default_target(): snmp_service.c, 417:
defaults: netsnmp_lookup_default_target("snmptrap", "udp") -> ":162"
trace: netsnmp_tdomain_transport_full(): snmp_transport.c, 644:
tdomain: trying domain "udp" address "162" default address ":162"
trace: netsnmp_sockaddr_in2(): transports/snmpIPv4BaseDomain.c, 66:
netsnmp_sockaddr_in: addr 0x7ffe6a3339d0, inpeername "162", default_target ":162"
trace: netsnmp_sockaddr_in2(): transports/snmpIPv4BaseDomain.c, 66:
netsnmp_sockaddr_in: addr 0x7ffe6a3339d0, inpeername ":162", default_target "[NIL]"
trace: netsnmp_sockaddr_in2(): transports/snmpIPv4BaseDomain.c, 121:
netsnmp_sockaddr_in: check user service 162
trace: netsnmp_sockaddr_in2(): transports/snmpIPv4BaseDomain.c, 180:
netsnmp_sockaddr_in: return { AF_INET, 0.0.0.0:162 }
trace: netsnmp_sockaddr_in2(): transports/snmpIPv4BaseDomain.c, 121:
netsnmp_sockaddr_in: check user service 162
trace: netsnmp_sockaddr_in2(): transports/snmpIPv4BaseDomain.c, 180:
netsnmp_sockaddr_in: return { AF_INET, 0.0.0.0:162 }
trace: netsnmp_udpipv4base_transport(): transports/snmpUDPIPv4BaseDomain.c, 87:
netsnmp_udpbase: open local UDP: [0.0.0.0]:162->[0.0.0.0]:0



Still no good

[tgriep]

The server that is running the snmptrapd daemon, what is it's IP address?

[shubham]

172.16.10.95

[tgriep]

From your previous output, it looks like the snmptrapd daemon is running.
Is the server receiving the traps?
Is it forwarding it on to the other server?

You nay want to go to the Net-SNMP site to see if there are any other things to look for that is causing the issue.
http://www.net-snmp.org/