snmp traps appear in snmptt.log, not Nagios

[ryanb]

Hello,

I configured one of my servers to receive SNMP traps using the SNMP Trap wizard in Nagios XI. I converted the MIB to snmptt's format and added it to snmptt's config, and can see the traps appearing in snmptt.log. However, they do not make it into Nagios. Can you please advise how I can troubleshoot this?

Thanks,
Ryan

[tgriep]

In the XI GUI, can you go to Admin > Unconfigured Objects, does it show up there?
The first time a trap is received, it will go in to the Unconfigured Objects and then it can be configured to be received by XI.
Let us know what you find.

[ryanb]

yes, I did check there, but nothing has appeared. I have sent several test traps that all show up in the snmptt.log file though.

[tgriep]

Can you post your /etc/snmp/snmptt.conf file and the traps that show up in the snmptt.log file so we can review them?

[ryanb]

The entry in snmptt.log is:

Code: Select all

Thu Oct 22 16:20:58 2015 .1.3.6.1.4.1.674.10893.2.30.0.1 Critical "Status Events" vdi1 - Storage Array Critical: User-interaction is required immediately for IP Address= 1, HostName= 10.10.200.10, UserLabel= VDI1, ErrorCode= md3420-for-vdi-ss, TimeStamp= , ErrorMessage= Thu, 22 Oct 2015 16:20:58 -0400, ComponentType= Alert Test Message, ComponentLocation=

I did not append these definitions to the /etc/snmp/snmptt.conf file, but to its own file, which is included in the snmptt.ini:

Code: Select all

cat /usr/share/snmp/mibs/processed_mibs/DellMDStorageArray.mib

#
#
#
#
MIB: DellMDStorageArray (file:/usr/share/snmp/mibs/DellMDStorageArray.mib) converted on Thu Oct 22 16:23:26 2015 using snmpttconvertmib v1.3
#
#
#
EVENT storageArrayCritical .1.3.6.1.4.1.674.10893.2.30.0.1 "Status Events" Critical
FORMAT Storage Array Critical: User-interaction is required immediately for IP Address= $1, HostName= $2, UserLabel= $3, ErrorCode= $4, TimeStamp= $5, ErrorMessage= $6, ComponentType= $7, ComponentLocation= $8
SDESC
This trap indicates an event where user-interaction is required immediately.
Some example events are component failures or critical errors.
Variables:
  1: deviceHostIP
  2: deviceHostName
  3: deviceUserLabel
  4: deviceErrorCode
  5: eventTime
  6: trapDescription
  7: componentType
  8: componentLocation
EDESC
#
#
#
EVENT storageArrayWarning .1.3.6.1.4.1.674.10893.2.30.0.2 "Status Events" Warning
FORMAT Storage Array Warning: User-interaction is required for IP Address= $1, HostName= $2, UserLabel= $3, ErrorCode= $4, TimeStamp= $5, ErrorMessage= $6, ComponentType= $7, ComponentLocation= $8
SDESC
This trap indicates an event where user-interaction may be required. Example are events that put the array in a non-optimal state.
Variables:
  1: deviceHostIP
  2: deviceHostName
  3: deviceUserLabel
  4: deviceErrorCode
  5: eventTime
  6: trapDescription
  7: componentType
  8: componentLocation
EDESC
#
#
#
EVENT storageArrayInformational .1.3.6.1.4.1.674.10893.2.30.0.3 "Status Events" Informational
FORMAT Storage Array Informational: Non-failure event of interest for IP Address= $1, HostName= $2, UserLabel= $3, ErrorCode= $4, TimeStamp= $5, ErrorMessage= $6, ComponentType= $7, ComponentLocation= $8
SDESC
This trap indicates a non-failure event of interest where user interaction is generally not required.
Variables:
  1: deviceHostIP
  2: deviceHostName
  3: deviceUserLabel
  4: deviceErrorCode
  5: eventTime
  6: trapDescription
  7: componentType
  8: componentLocation
EDESC
#
#
#
EVENT storageArrayDebug .1.3.6.1.4.1.674.10893.2.30.0.4 "Status Events" Debug
FORMAT Storage Array Debug: Internal debug event for IP Address= $1, HostName= $2, UserLabel= $3, ErrorCode= $4, TimeStamp= $5, ErrorMessage= $6, ComponentType= $7, ComponentLocation= $8
SDESC
This trap indicates an interal system debug event of interest.
Variables:
  1: deviceHostIP
  2: deviceHostName
  3: deviceUserLabel
  4: deviceErrorCode
  5: eventTime
  6: trapDescription
  7: componentType
  8: componentLocation
EDESC

[tgriep]

For the traps to be brought in to XI, there has to be an EXEC line defined for each trap and none of the ones you posted have them.
Here is an example of one from my system. Normally is will be below the FORMAT line.

Code: Select all

EXEC /usr/local/bin/snmptraphandling.py "$r" "SNMP Traps" "$s" "$@" "$-*" "An example of an SMIv1 trap $*"

When a trap come in, the snmptraphandling.py script will put it in to XI so without that line, it will not.

Below is a link to our guide on enabling XI to receive TRAPS, you may want to go through this as this will setup the system to create the EXEC line when an MIB file is added to the system.
https://assets.nagios.com/downloads/nag ... ios_XI.pdf

After going through the guide, you likely will have to delete the settings from the snmptt.conf files and re-add the MIBS and then the entries will be generated for you to work with XI.

[ryanb]

Ah, I see. OK, thanks for the help.

[hsmith]

Is there anything else we can do for you in this thread, or would you like us to lock it up?

[ryanb]

Yes- that seems to have been the issue. Please close out the ticket. Thanks for the quick resolution.

[rkennedy]

I'm glad this worked out for you, I will close this thread now. Feel free to open another thread if you need more assistance.