SNMP Waiting for traps

[gwijnant]

Hi All,

I followed the https://assets.nagios.com/downloads/nag ... ios_XI.pdf guideline and I dont see any traps comming in nagios. I see some of them in the snmptt.log file

Code: Select all

Fri Feb 19 15:44:27 2016 .1.3.6.1.6.3.1.1.5.3 Normal "Status Events" vcn-ant-cs01 - Link down on interface 79.  Admin state: TenGigabitEthernet1/1/3.  Operational state: ethernetCsmacd
Fri Feb 19 15:44:29 2016 .1.3.6.1.6.3.1.1.5.3 Normal "Status Events" vcn-ant-cs01 - Link down on interface 128.  Admin state: Vlan4050.  Operational state: propVirtual
Fri Feb 19 15:44:51 2016 .1.3.6.1.6.3.1.1.5.4 Normal "Status Events" vcn-ant-cs01 - Link up on interface 79.  Admin state: TenGigabitEthernet1/1/3.  Operational state: ethernetCsmacd
Fri Feb 19 15:45:23 2016 .1.3.6.1.6.3.1.1.5.4 Normal "Status Events" vcn-ant-cs01 - Link up on interface 128.  Admin state: Vlan4050.  Operational state: propVirtual

I have checked with the unconfigured object list but its empty.

Any ideas?

Thanks!

[tgriep]

Can you post all of the files in the /etc/snmp folder so we can review them?

[gormank]

The description of the service for traps for some reason has to be SNMP Traps. I changed mine to SNMP_Traps and it stopped working...
Try running:

service snmptt status
service snmptt restart

I found that it would sometimes be locked up but it looked ok.

[Box293]

The description of the service for traps for some reason has to be SNMP Traps.

This is partially correct, whatever is defined in the EXEC line of each EVENT is the name of the service being targetted.

If you are new to SNMP Traps in Nagios XI, I suggest taking some time to go through this KB article. It is very detailed and explains how SNMP Traps work from when they leave the sending device all the way through to XI and customising it to your needs.

https://support.nagios.com/kb/article.php?id=77

[gwijnant]

Hi all,

Thanks for the responses. I tried to follow the tutorial with a similar setup. I see the traps in the smptt.log file but when I then go and look at the unconfigured object list, its empty.
In attachmen the files from /etc/snmp folder.

Best Regards,

Guy

[tgriep]

The EXEC lines for those OID's that puts the received traps into Nagios XI are missing from the /etc/snmp/snmptt.conf file. If you edit that file and add the following line at line 42

Code: Select all

EXEC /usr/local/bin/snmptraphandling.py "$r" "SNMP Traps" "$s" "$@" "$-*" "A linkUp trap signifies that the SNMP entity, acting in an $*"

and the following line at line 28

Code: Select all

EXEC /usr/local/bin/snmptraphandling.py "$r" "SNMP Traps" "$s" "$@" "$-*" "A linkDown trap signifies that the SNMP entity, acting in $*"

Save the file out and restart the SNMP Trap daemon

Code: Select all

service snmptt restart

The next time a Trap is sent to the XI server, it should show up in the Unconfigured Objects menu. At this point, you can configure it and then the system will receive traps to that service.

[gwijnant]

Hi tgriep,

This solved my issue but one of the snmptraps still goes into the snmpttunknown.log

Tue Feb 23 12:17:47 2016: Unknown trap (Dying Gasp - Shutdown due to power loss) received from 10.1.254.253 at:
Value 0: 10.1.254.253
Value 1: 10.1.254.253
Value 2: SNMPv2-SMI::enterprises.9.9.305.1.3.5.0.2
Value 3: Dying Gasp - Shutdown due to power loss
Value 4: 10.1.254.253
Value 5:
Value 6:
Value 7:
Value 8:
Value 9:
Value 10:

My snmptt.conf file does contain the event. (it was added using the manage mibs function)

EVENT cseShutDownNotify .1.3.6.1.4.1.9.9.305.1.3.5.0.2 "Status Events" Normal
FORMAT A system shutdown notification is generated $*
EXEC /usr/local/bin/snmptraphandling.py "$r" "SNMP Traps" "$s" "$@" "$-*" "A system shutdown notification is generated $*"
SDESC
A system shutdown notification is generated
whenever a system is going to shut down. The
cseHaShutDownReason, describes the reason as to
why the system is going to go down.
Variables:
1: cseHaShutDownReason
EDESC

I also tried with these events:

EVENT cseShutDownNotify SNMPv2-SMI::enterprises.9.9.305.1.3.5.0.2 "Status Events" Normal
and
EVENT cseShutDownNotify Dying Gasp - Shutdown due to power loss "Status Events" Normal

I will reattach all the config files just in case.

[tgriep]

The config looks good for that OID. Try restarting the snmptt daemon to see if that resolves it for you.

Code: Select all

service snmptt restart

[gwijnant]

Hi tgriep,

Restarted service still the same issue.
Restarted server and still the same issue.

Best Regards,

Guy

[gwijnant]

I did some more debugging and found this:

Processing file: #snmptt-trap-1456310953425115
Host IP address (10.1.254.253) could not be resolved by DNS. Variable $r / $R etc will use the IP address

Agent IP address was blank, so setting to the same as the host IP address of 10.1.254.253

Agent IP address (10.1.254.253) is the same as the host IP, so copying the host name: 10.1.254.253

Trap received from 10.1.254.253: Dying Gasp - Shutdown due to power loss
Exact match of trap NOT found in EVENT hash table

Looking for wildcards in the EVENT hash table


Trap not defined...

I have lookuped up on the Cisco website for the necessary MIBS

1. SNMPv2-SMI
2. SNMPv2-TC
3. CISCO-SMI --> Uploaded this mib
4. IANAifType-MIB
5. SNMPv2-CONF
6. RFC1155-SMI
7. RFC-1212 --> Uploaded this mib
8. RFC1213-MIB
9. CISCO-TC --> Uploaded this mib
10. INET-ADDRESS-MIB
11. SNMP-FRAMEWORK-MIB
12. RFC-1215
13. SNMPv2-TC-v1 --> Uploaded this mib
14. CISCO-SYSTEM-EXT-MIB --> Uploaded this mib

I have uploaded the mibs that were not yet present and I have verified that all are in the folder
/usr/share/snmp/mibs/

Only with the last one (CISCO-SYSTEM-EXT-MIB) I selected Process trap.
the /usr/share/snmp/mibs/processed_mibs/ folder is empty.

Best Regards,

Guy