SNMP_Traps

[cusvenus]

I wanted to setup traps from one of the networking devices. I have installed MIB (imported) and I have also verified that the traps are being captured on the local system for the same OID however when using the same snmptt.conf file I see the traps are not being captured for the network device. I see the traffic is coming through N/W device using tcpdump and also in /var/log/messages.

[ssax]

Did you restart the snmptt service?

Code: Select all

service snmptt restart

Are the entries for that OID in the /etc/snmp/snmptt.conf file? If so, please post that specific one.

[cusvenus]

Yes I did and still the status shows "Waiting for trap..."

SNMP TrapsPassive Only Check Ok 3d 17h 45m 23s 1/1 2015-09-11 22:18:55 Waiting for trap...

[Box293]

Can you please post the EVENT from your /etc/snmp/snmptt.conf file that relates to this trap.

Is the trap logged in /var/log/snmptt/snmptt.log or /var/log/snmptt/snmpttunknown.log?
Please post what is logged in these files for this trap.

Please post your object definition for the "SNMP Traps" service and the host object this service is assigned to:
Core Configuration Manager
Monitoring > Services
Monitoring > Hosts
Click the floppy disk icon to get the object definition.

Is the trap appearing under Admin > Monitoring Config > Unconfigured Objects?

[cusvenus]

FYI - /etc/snmp/snmptt.conf

EVENT linkDown .1.3.6.1.6.3.1.1.5.3 "Status Events" Critical
FORMAT A linkDown trap signifies that the SNMP entity, acting in $*
EXEC /usr/local/bin/snmptraphandling.py "$r" "SNMP Traps" "$s" "$@" "$-*" "A linkDown trap signifies that the SNMP entity, acting in $*"
SDESC
A linkDown trap signifies that the SNMP entity, acting in
an agent role, has detected that the ifOperStatus object for
one of its communication links is about to enter the down
state from some other state (but not from the notPresent
state). This other state is indicated by the included value
of ifOperStatus.
Variables:
1: ifIndex
2: ifAdminStatus
3: ifOperStatus
EDESC

/var/log/snmptt/snmptt.log

Thu Sep 17 04:01:24 2015 .1.3.6.1.6.3.1.1.5.3 Critical "Status Events" <ServerNAme> - A linkDown trap signifies that the SNMP entity, acting in 15 Virtual-Access1 tunnel Tunnel Down
Thu Sep 17 10:08:21 2015 .1.3.6.1.4.1.9.9.41.2.0.1 Normal "Status Events" <ServerNAme> - When a syslog message is generated by the device a LINK 4 UPDOWN Interface Virtual-Access2, changed state to down 2:23:08:14.00

/var/log/snmptt/snmpttunknown.log

Thu Sep 17 10:08:48 2015 .1.3.6.1.6.3.1.1.5.4 Normal "Status Events" <server name> - A linkUp trap signifies that the SNMP entity, acting in an 17 Virtual-Access3 tunnel Tunnel Up
[root@Nagios ~]# tail /var/log/snmptt/snmpttunknown.log
Ent Value 2: .1.3.6.1.4.1.9.9.171.1.3.3.1.3.278.1=3
Ent Value 3: .1.3.6.1.4.1.9.9.171.1.3.3.1.4.278.1=C7 57 4F 00
Ent Value 4: .1.3.6.1.4.1.9.9.171.1.3.3.1.5.278.1=FF FF FF 00
Ent Value 5: .1.3.6.1.4.1.9.9.171.1.3.3.1.9.278.1=1
Ent Value 6: .1.3.6.1.4.1.9.9.171.1.3.3.1.10.278.1=C0 A8 F9 FC
Ent Value 7: .1.3.6.1.4.1.9.9.171.1.3.3.1.11.278.1=C0 A8 F9 FC
Ent Value 8: .1.3.6.1.4.1.9.9.171.1.3.3.1.6.278.1=256
Ent Value 9: .1.3.6.1.4.1.9.9.171.1.3.3.1.7.278.1=0

Hosts.JPG

SNMPTraps_Service.JPG

[cusvenus]

Trap is coming under unConfigured and I restarted snmptt and also also selected the unconfigured and then it is gone.

CCM Config

###############################################################################
#
# Service configuration file
#
# Created by: Nagios Core Config Manager 2.3.3
# Date: 2015-09-17 10:51:41
# Version: Nagios 3.x config file
#
# --- DO NOT EDIT THIS FILE BY HAND ---
# Nagios CCM will overwrite all manual settings during the next update if you
# would like to edit files manually, place them in the 'static' directory or
# import your configs into the CCM by placing them in the 'import' directory.
#
###############################################################################


define service {
host_name <hostname>
service_description SNMP Traps
use xiwizard_snmptrap_service
max_check_attempts 1
check_interval 1
retry_interval 1
check_period xi_timeperiod_24x7
notification_interval 1
notification_period xi_timeperiod_24x7
contacts nagiosadmin,xi_default_contact
contact_groups xi_contactgroup_all
icon_image snmptrap.png
_xiwizard snmp_trap
register 1
}

###############################################################################
#
# Service configuration file
#
# END OF FILE
#
###############################################################################

[ssax]

One thing to make sure is that the servername in /var/log/snmptt/snmptt.log needs to be exactly the same (case sensitive / name or IP / with or without domain), are they? If they are not then it will show up in unconfigured objects.

[cusvenus]

Thanks ssax I will check and let you know

[cusvenus]

This issue is fixed. Thanks ssax. It is the hostname mismatch

[hsmith]

Thanks for letting us know. I'll close this one and mark it resolved.