classifying Traps

[hanya.radwan]

hi,

I have a problem that Nagios didn't classify traps alarm correct, since some system send error alarms but Nagios classify that as normal.


example of these traps:


Sun Jan 18 12:05:30 2015 ERICSSON-SNF-ALARM-MIB::snfAlarmActiveState Normal "Status Events" 10.200.35.54 - This notification reports an active state of an alarm. It mirrors the notification Failed to decode received data. .iso Failed to decode received data. A block of 'TTFILE05-7416.20150111', originating from Mediator, was corrupt (this would have been record #0). The type: CME20R14MSCber.CallDataRecord was probably not set and is not optional The corrupt part of the block is stored as '/var/opt/mediation/MMStorage/NRTDE/CXC1734739_R8B/storage/corrupt/TTFILE05-7416.20150111:0' and will not be re-decoded. processingErrorAlarm corruptData PROCESSING 303 3 07 DF 01 12 0C 05 10 03 2B 02 00 1 10.200.35.13 8
Sun Jan 18 12:05:30 2015 ERICSSON-SNF-ALARM-MIB::snfAlarmActiveState Normal "Status Events" 10.200.35.54 - This notification reports an active state of an alarm. It mirrors the notification Failed to decode received data. .iso Failed to decode received data. A block of 'TTFILE05-7416.20150111', originating from Mediator, was corrupt (this would have been record #0). The type: CME20R14MSCber.CallDataRecord was probably not set and is not optional The corrupt part of the block is stored as '/var/opt/mediation/MMStorage/NRTDE/CXC1734739_R8B/storage/corrupt/TTFILE05-7416.20150111:0' and will not be re-decoded. processingErrorAlarm corruptData PROCESSING 303 3 07 DF 01 12 0C 05 10 03 2B 02 00 1 10.200.35.13 8

thanks,

[abrist]

Lets take a look at the snmptt.conf rules and the mib. Can you attach the two following files to your next post:

Code: Select all

/etc/snmp/snmptt.conf
mib file associated with ERICSSON-SNF-ALARM-MIB

[Box293]

Can I suggest you read this post as it might be relevant to your problem:

http://support.nagios.com/forum/viewtop ... 81#p123119

[hanya.radwan]

please find the attached

[lmiltchev]

I have a problem that Nagios didn't classify traps alarm correct, since some system send error alarms but Nagios classify that as normal.

You will need to edit the snmptt.conf file and alter the severity of these events to match your personal needs. For example, if you wanted to change this trap to be "Critical", you would change this:

Code: Select all

EVENT snfAlarmActiveState .1.3.6.1.4.1.193.110.2.10.2.0.1 "Status Events" Normal

to this:

Code: Select all

EVENT snfAlarmActiveState .1.3.6.1.4.1.193.110.2.10.2.0.1 "Status Events" Critical

Read more on adjusting trap severity here:
http://assets.nagios.com/downloads/nagi ... ios_XI.pdf

[Box293]

To expand on lmiltchev's answer, this post talks about using a MATCH statement:

http://support.nagios.com/forum/viewtop ... 81#p123119

[hanya.radwan]

hi

I faced problem like this , suddenly , trap was classified as warning , today is classified as critical:


warning
TrapName smscSiwplmnWarningTrap / trapData (OCTETSTR):%SPL-I-INFO, Number of Rejected Duplicates in past (60 min) interval: 0, Log filename: DUPLOG_SIWPLMN_12_1425263673.LOG, smscSiwplmnName (OCTETSTR):SIWPLMN_12, trapTimeStamp (OCTETSTR): 2-MAR-2015 08:3

critical
TrapName smscSiwplmnWarningTrap / trapData (OCTETSTR):%SPL-I-INFO, Number of Rejected Duplicates in past (60 min) interval: 0, Log filename: DUPLOG_SIWPLMN_11_1425483086.LOG, smscSiwplmnName (OCTETSTR):SIWPLMN_11, trapTimeStamp (OCTETSTR): 4-MAR-2015 16:5

[tmcdonald]

Are you making sure to restart snmptt after making changes? Also, looking over the snmptt.conf it looks like some of your traps that should be critical are still listed as normal.

[hanya.radwan]

when I restart snmp, the classification become waring as before, but in snmptt.conf , the traps not classified correct, they are normal for all of them

[ssax]

Please open up the file below:

Code: Select all

/etc/snmp/snmptt.ini

Check at the bottom for the order in which it will look for the trap definitions, after adding the mibs through the XI interface and selecting process traps, mine shows as:

Code: Select all

/usr/share/snmp/mibs/processed_mibs/smscagent.mib.txt
/usr/share/snmp/mibs/processed_mibs/smscagentb.mib.txt
/etc/snmp/snmptt.conf

It may be picking up the processed_mibs one first, did you change it in there as well?

Then execute:

Code: Select all

service snmptt restart