No files found under /var/spool/snmptt

[scottwilkerson]

Apologies, attaching the file.

Meanwhile will check nagios.cfg

Ok, this looks simple enough.

One thing to note, in your EXEC line you have the service called TRAP but you sent some service definitions earlier that had the service name SNMP_Traps

these need to match exactly

[shineyroman]

I found the errors in nagios.log file-

Warning: Passive check result was received for service 'TRAP' on host 'x.x.x.x', but the host could not be found!
[1548957612] Error: External command failed -> PROCESS_SERVICE_CHECK_RESULT;x.x.x.x;TRAP;2;FGT60D4Q16099B67

External command error: Command failed
[1548957804] EXTERNAL COMMAND: PROCESS_SERVICE_CHECK_RESULT;TRAP;2;;
[1548957804] Warning: Passive check result was received for service '2' on host 'TRAP', but the host could not be found!
[1548957804] Error: External command failed -> PROCESS_SERVICE_CHECK_RESULT;TRAP;2;;
[1548957804] External command error: Command failed
[1548958350] EXTERNAL COMMAND: PROCESS_SERVICE_CHECK_RESULT;10.15.1.1;TRAP;2;TESTING
[1548958350] Warning: Passive check result was received for service 'TRAP' on host 'x.x.x.x', but the service could not be found!
[1548958350] Error: External command failed -> PROCESS_SERVICE_CHECK_RESULT;x.x.x.x;TRAP;2;TESTING
[1548958350] External command error: Command failed


Kindly could you help me understand.

[scottwilkerson]

your EXEC lines should be changed to

Code: Select all

EXEC /usr/src/nagios-4.3.2/contrib/eventhandlers/submit_check_result "$r" "SNMP_Traps" 2 "$*"

and then you need to make sure you have a host named x.x.x.x (which is being passed in the $r field above) with a service named SNMP_Traps configured in Nagios

[shineyroman]

Thank you scott,

I made the changes to the service definition - renamed it to be TRAP. I no longer see the service errors.

Though I edited the host to match the name as seen in the log it still gives me the error. I believe it is because the IP used for the SNMP trap is the VPN tunnel address and not the FGT address and hence it fails to find a host by that address. Is there any way to overcome this issue?


Passive check result was received for service 'TRAP' on host '172.16.1.14', but the host could not be found!
[1548969284] Error: External command failed -> PROCESS_SERVICE_CHECK_RESULT;172.16.1.14;TRAP;2;FGT60D4Q16099B67

172.6.1.14 is the tunnel ip and not the ip of the host definition created.

Can i just make an entry for the Tunnel ip in /etc/hosts file?

[shineyroman]

Hi Scott,

I got it to work by adding the ip in /etc/hosts file. Thank you for all your help

Now i have to figure out a way to customize the alert.

Right now there is no info related to Vpn Up or Down

All it says is - PROBLEM Service Alert: Hostname/TRAP is CRITICAL **

Also, It stays as Critical though the Tunnel has come up .. Any advice ?

Once again thank you sooo much..

[scottwilkerson]

This is the last part the the EXEC line for each trap, you could change it to something like this

Code: Select all

EXEC /usr/src/nagios-4.3.2/contrib/eventhandlers/submit_check_result "$r" "SNMP_Traps" 2 "Vpn Down $*"

or for the Up you would change the 2 to a 0 and then change the last part to say Up

Code: Select all

EXEC /usr/src/nagios-4.3.2/contrib/eventhandlers/submit_check_result "$r" "SNMP_Traps" 0 "Vpn Up $*"

[shineyroman]

Oh,, thank you

I will test it . Could you guide me to a link where i could understand this script better.

[scottwilkerson]

SNMPTT docs are here
http://snmptt.sourceforge.net/docs/snmp ... .CONF-EXEC

The exec line calls your your submit_check_results command, and the description of the arguments are shown in the comments

Code: Select all

# Arguments:
#  $1 = host_name (Short name of host that the service is
#       associated with)
#  $2 = svc_description (Description of the service)
#  $3 = return_code (An integer that determines the state
#       of the service check, 0=OK, 1=WARNING, 2=CRITICAL,
#       3=UNKNOWN).
#  $4 = plugin_output (A text string that should be used
#       as the plugin output for the service check)
#

[shineyroman]

Thank you Scott.

I was able to edit the alert to include the Tunnel Info.

[scottwilkerson]

Thank you Scott.

I was able to edit the alert to include the Tunnel Info.

Great! I am going to close this thread