SNMPTT not processing snmp V2 Traps

[ksric]

Hi,

I have configured snmptt to receive traps from Cisco Network device which is sendong snmp V2 traps. SNMPTT is not processing v2 traps and only processing V1 traps.

Could somebody please help with the configuration if anything has to be changed for snmp V2 traps?

You help is much appreciated.

Regards,
Sricharan

[Box293]

Do you see the traps hitting the nagios core server?

Code: Select all

tcpdump port 162

Is there a firewall rule blocking the traffic?

Code: Select all

iptables -L INPUT -v -n | grep 162

What is being logged in /var/log/snmptt/snmpttunknown.log

[ksric]

Hi,

Yes , I am receiving the traps in the server but snmptt is not processing them since its SNMP V2 traps.

10.166.132.16.39990 > 10.23.212.96.snmptrap: [udp sum ok] { SNMPv2c { V2Trap(1297) R=1883431646 .1.3.6.1.2.1.1.3.0=42749709 .1.3.6.1.6.3.1.1.4.1.0=.1.3.6.1.4.1.9.9.712.0.1 .1.3.6.1.4.1.9.9.712.1.1.2.1.2=07_de_0b_04_01_01_00_04_2b_0b_00 .1.3.6.1.4.1.9.9.712.1.1.2.1.3=07_de_0b_04_0e_3b_1f_01_2b_0b_00 .1.3.6.1.4.1.9.9.712.1.1.2.1.4="InterferenceProfile_LradIf!c0:25:5c:df:be:b0!0" .1.3.6.1.4.1.9.9.712.1.1.2.1.5=2 .1.3.6.1.4.1.9.9.712.1.1.2.1.6="Radio load threshold violation" .1.3.6.1.4.1.9.9.712.1.1.2.1.7=1 .1.3.6.1.4.1.9.9.712.1.1.2.1.8=10.134.63.69 .1.3.6.1.4.1.9.9.712.1.1.2.1.9="AP wwmnsuhw24c26, Interface 802.11b/g/n" .1.3.6.1.4.1.9.9.712.1.1.2.1.10="Interference threshold violation reported by '802.11b/g/n' interface of AP 'wwmnsuhw24c26', connected to Controller '10.134.63.69'.".1.3.6.1.4.1.9.9.712.1.1.2.1.11=5.1.3.6.1.4.1.9.9.712.1.1.2.1.12=",applicationSpecificAlarmID=InterferenceProfile_LradIf!c0:25:5c:df:be:b0!0,reportingEntityAddress=10.134.63.69,lastModifiedTimestamp=Tue Nov 04 14:59:31 EST 2014,alarmCreationTime=2014-11-04 01:01:00.448,eventCount=1,mayBeAutoCleared=false,instanceId=2027958200,severity=5,eventType=RADIO_LOAD_PROFILE_FAILED(63),authEntityId=17499573,previousSeverity=CLEARED,category=AP(1),source=LradIf!c0:25:5c:df:be:b0!0,notificationDeliveryMechanism=NMS_POLLING,instanceVersion=0,description=Interference threshold violation reported by '802.11b/g/n' interface of AP 'wwmnsuhw24c26', connected to Controller '10.134.63.69'. ,isAcknowledged=false,authEntityClass=-1906840627,displayName=AP wwmnsuhw24c26, Interface 802.11b/g/n" .1.3.6.1.4.1.9.9.712.1.1.2.1.14="" } }

I am seeing snmp V1 traps in /var/log/snmptt/snmpttunknown.log

Fri Oct 3 11:22:00 2014: Unknown trap (.1.3.6.1.4.1.1783.1.1.0.1025) received from nnorsovmws333.woolworths.com.au at:
Value 0: nnorsovmws333.woolworths.com.au
Value 1: 10.23.212.63
Value 2: 438:18:29:43.28
Value 3: .1.3.6.1.4.1.1783.1.1.0.1025
Value 4: 10.23.212.63
Value 5: public
Value 6: .1.3.6.1.4.1.1783.1.1
Value 7:
Value 8:
Value 9:
Value 10:
Ent Value 0: .1.3.6.1.4.1.1783.1.1.1=#1025 Broker Server Monitor ready, process id 316

Is there something we can do to receive snmp V2 traps or could be any configuration error from snmptt config?

Regards,
Sricharan

[Box293]

From what I understand, the snmptrapd is what implements a layer of security in relation to where traps are allowed to come from.

For example, here is a very relaxed/open snmptrapd.conf file:

Code: Select all

disableAuthorization yes
traphandle default /usr/sbin/snmptthandler

This is located in /etc/snmp/snmptrapd.conf

[ksric]

Hi,

Thanks for reply.

Its configured the same. But not sure how its not processing V2 traps.

Its working fine with V1 Traps. Any idea how to receive snmp V2 traps through snmptrapd?

Regards,
Sricharan

[Box293]

Is anything being recorded in /var/log/messages ?

[rhassing]

Make sure your snmptrapd is started with the following options:

Code: Select all

OPTIONS="-Lsd -p /var/run/snmptrapd.pid -m ALL -On"

[abrist]

Make sure your snmptrapd is started with the following options:

Code: Select all

    OPTIONS="-Lsd -p /var/run/snmptrapd.pid -m ALL -On"

Is anything being recorded in /var/log/messages ?

Code: Select all

tail -100 /var/log/messages

Did either of these above suggestions work for you OP?

[ksric]

Oh God , The snmptrapd service was not running. I started that now and an alert popped in snmptt.log

Thanks a lot for your help. Really appreciate it.

Regards,
Sricharan

[Box293]

Hey at least it was something simple lol