Router warning traps seen on NSTI but not in Nagios

[vijilants]

System:
Nagios XI Version : 2014R2.0
somnms1 2.6.32-358.14.1.el6.i686 i686
CentOS release 6.5 (Final)


Hi,

Can you please help with the following:

I can see environmental warning traps coming from a router in SNMPTT and also under NSTI but do not see these traps in the Nagios GUI under SNMP traps against the device.

Can you please advise as to why the traps are not appearing in Nagios ?

Many Thanks

[tmcdonald]

Do you have NSTI installed on the same server as Nagios XI? If this is the case then NSTI is probably handling the traps and XI will not see them. It is not advised to install NSTI on the XI server.

[vijilants]

Yes, both are installed on the same server.

Is there any way I can get this issue resolved apart from installing NSTI on a separate server ?

It seems to be overkill to install NSTI on a separate server and I was under the impression that XI would process the traps regardless ? Also XI is seeing other traps but not the Warning Traps

Many Thanks

[lgroschen]

I think since snmptt is configured to handle the traps for NSTI it's assuming they have been handled properly and will not take any more actions on a given trap. So all you would need to do is configure snmptt.ini to handle each trap by writing to the snmptt db for NSTI to read (which is done when you install NSTI) and then allowing snmptt to also handle the trap for Nagios XI.

The issue with installing on a separate server is because NSTI was created to be a standalone program, but it doesn't mean it won't work as well. You just have to know that there are going to be conflicts when running XI and NSTI side by side since they are using a lot of dependencies and system resources that they both need to use. Snmptt is a good example of this.

The next step is to dig into your snmp config files and find a way include trap processing for XI alongside NSTI's current processing config.

[vijilants]

I think since snmptt is configured to handle the traps for NSTI it's assuming they have been handled properly and will not take any more actions on a given trap. So all you would need to do is configure snmptt.ini to handle each trap by writing to the snmptt db for NSTI to read (which is done when you install NSTI) and then allowing snmptt to also handle the trap for Nagios XI.

The issue with installing on a separate server is because NSTI was created to be a standalone program, but it doesn't mean it won't work as well. You just have to know that there are going to be conflicts when running XI and NSTI side by side since they are using a lot of dependencies and system resources that they both need to use. Snmptt is a good example of this.

The next step is to dig into your snmp config files and find a way include trap processing for XI alongside NSTI's current processing config.

I'm not sure as to how to get any of this done ?

Also if NSTI is handling the traps, why are the major and critical traps appearing on both XI and NSTI but not the warning traps ?

[sreinhardt]

Can you post your /etc/snmp/snmptt.conf file? Let's take a look at how you have traps configured. It sounds to me like some might have incorrect severity set within your configs and might be showing incorrectly. If the traps you are seeing are not shown in that config, please identify which trap config has it in the /usr/share/snmp/mibs/processed_mibs/ folder.

[vijilants]

Can you post your /etc/snmp/snmptt.conf file? Let's take a look at how you have traps configured. It sounds to me like some might have incorrect severity set within your configs and might be showing incorrectly. If the traps you are seeing are not shown in that config, please identify which trap config has it in the /usr/share/snmp/mibs/processed_mibs/ folder.

I dno't think that it has anything to do with the way the trap is configured as the trap is showing up in NSTI as a warning trap (Yellow) but the said trap is not present in XI Traps.

Anyway, attached is the snmptt file

[lgroschen]

OK,

So go ahead and back up that existing snmptt.conf file that you posted somewhere. Then delete the file and make a new snmptt.conf.

You will have to delete the MIBS you are using in the UI first, there should be a table with a list of them, just click the X to delete them. Now, go into the Nagios XI user interface and click the "process MIB" checkbox and import the MIBS again.

When you check your snmptt.conf file you should see EXEC lines in there now. Now send some test traps and see if this solved the issue.

Also, it is good to note here that our own trap converter called add_mib() will be used when using the "Process MIB" option. If that is not on your XI system or is not executable then you might not see the EXEC lines because it will use snmpttconvertmib as a secondary.

[vijilants]

OK,

Then delete the file and make a new snmptt.conf.

How do I create a new file ?....I thought it came with the system ?

You will have to delete the MIBS you are using in the UI first, there should be a table with a list of them, just click the X to delete them.

There are about 80 mibs under the SNMP MIBS menu.....delete them all ?

Now, go into the Nagios XI user interface and click the "process MIB" checkbox and import the MIBS again.

There is no process mib checkbox.

Also previously when I installed and converted the mibs I had to go through the time consuming task of going through all the trap values and changing the trlavant traps to Warning, Critical etc.......does it mean that I have to do that all over again ?

[lgroschen]

We can go through this it shouldn't be too difficult. First, You should have all the MIBs that you want to use in this case backed up somewhere so just make a copy in case something goes wrong and you will need these to upload the MIBs back in anyways.

Do you know how to delete, create, move a file and navigate through folders in the Linux command line? You just need to go into the /etc/snmp/ folder copy and move your current snmptt.conf file and replace it with an empty snmptt.conf file that Nagios XI will write to.

One thing I want to point out is that you should never really have to manually go through each trap and add the trap action lines. You should be able to accomplish that automatically by using a system to write the files how you want them and this is accomplished two ways with Nagios XI: snmpttconvertmib.py and the add_mib() function which is the "process MIBs" checkbox I was referring to.

Let's navigate there.

On the Nagios XI User Interface on the top navigation bar go to Admin > Manage MIBs on the left side. Now you will see a list of the MIBs folder on your Nagios XI system. Now delete only the MIBs that are not responding with a proper Warning, click the X to delete them. Some of these MIBs are default MIBs that are in Nagios XI on install so you should only delete MIBs that you have files for. Go to the websites on the top of the MIB management XI page if you are missing some. It is also a good idea to try this once and maybe test to see if it is working for all types of statuses. Once you get that one working and know which ones are not working you will be able to delete them and process them in Nagios XI until all your MIBs are in a new snmptt.conf file.

Then you can upload each MIB file, but check the Process trap checkbox, then upload the MIB file. If the upload failed there will be a warning and this will tell you if the MIB is good and readable, if it isn't just download a new copy. If it succeeded you'll see a blue box saying as much. When you upload a MIB this way they are written to snmptt.conf and will include an EXEC line and proper OK, Warning, and Critical lines. It's more than possible that a few typos from manually editing this file could be the reason you are only receiving parts of the picture.

Here is a few resources about setting up snmp and using Net-SNMP and snmptt which makes up a lot of the tools that are used: http://www.net-snmp.org/, http://snmptt.sourceforge.net/docs/snmptt.shtml. Getting to know this will help you understand the quirky issues that come up with using SNMP.