How to create an snmp trap service?

[Markq]

Hi,
I am having hard time to create a working trap service in Nagios XI and even in understanding how it should work.

I have downloaded and installed the Nagios XI ca. one month ago, so I believe it is quite a new version. (where to check the version?)

I have also tried to follow some instructions found on the new, for example these:

1) http://assets.nagios.com/downloads/nagi ... ith_XI.pdf
2) http://nagios.frank4dd.com/howto/window ... nagios.htm

with 1) I have not been able to proceed because the server is not connected to internet and the script seems to rely on downloading external packages from the net. I also tried on another server and received a lot of errors, probably because some links are not up-to-date anymore. Is this instructions from 2009??

with 2) I had better luck and I was able to get succesfull results with the tests. So SNMP trap daemon is up and receiving.

So, here is the problem:
I have created a snmp trap service using the monitor wizard, and chosen the snmp trap service for an existing host. Here is the first question:
q1: Do I really need to create another host and service ( I have made the simple ping service) before I can add the snmp trap service to that host? Because the wizard just shows a list of existing hosts, there's no option to add a new? Or have I misunderstood something?

I have verified that the service is sending snmp traps to nagios server's IP. I have used network sniffer to verify this. So it shouldn't be a firewall issue. However, Nagios only displays the trap service as green, saying "waiting for trap..".
I can't see anything coming to either Nagios or snmp logs.

q2: so have I missed something when creating the service?

q3: The mibs of the monitored device are not in place yet. (We are still waiting for them from a 3rd party provider). But afaik this shouldn't prevent seeing the arriving snmp traps in the snmp and nagios logs, or should it?

q4: At the moment I can see only two services for the monitored host: ping and snmp traps.
I suppose when the first trap arrives, all the monitored parameters will appear on the home dashboard in addition to these two ones, or.. ?

q5: Nagios will look for the mibs of monitored hosts in the defined directory on the nagios server ( /usr/share/snmp/mibs ) and when the trap arrives Nagios can connect the trap to the right service by verifying the mib file names agains the content of the trap.. or have I got it wrong?

If you have any ideas how I could proceed, I'd greatly appreciate!

MArk

[Markq]

I forgot to mention that the nagios is running as a virtual machine on top of Windows 7 server.

Also, regarding the instructions at http://assets.nagios.com/downloads/nagi ... ith_XI.pdf
- it seemst that these settings are already in place in the latest version of Nagios XI. Or is it crucial still to get this script done, and is there perhaps a version which doesn't require internet connection?

thanks!
Mark

[scottwilkerson]

q1. To use the wizard you do need to add a host first

q2. They will not show in XI for sure, because when you run the install script it creates the config file based on the MIB's that are on the system. If you don't have the MIB's on the system they wouldn't have been added to the snmptt.conf. You should however see them in the snmpttunknown.log in /var/log/snmptt/

q3. see q2.

q4. The last trap received will show up in in the snmp traps service. If you want a detailed log of the SNMP traps received I think NSTI is the addon for you

q4. Your close, when you ran the installer it added the MIB's in /usr/share/snmp/mibs to the snmptt.conf and assigned an EXEC statement to send the info to XI. When you add the new MIBS, I would recommend re-running the install script.

[Markq]

Thanks for clarifying this!

So, it looks like running the installation script is what I need to get done..

[scottwilkerson]

Yep, it is best to run the script AFTER adding the MIB's for all your devices if possible.

[Markq]

Hi,
I got the traps coming thru today. It was the Linux firewall blocking, and after stopping iptables it started working.
The NSTI looks good, we're definitely going to use it.

[scottwilkerson]

Hi,
I got the traps coming thru today. It was the Linux firewall blocking, and after stopping iptables it started working.
The NSTI looks good, we're definitely going to use it.

Yep, NSTI is pretty sweet. and it's still a growing baby in it's infancy....

[Markq]

Hi again,

Still having problems with snmp traps received by Nagios. It seems that Nagios XI can't interpret them even when the MIBs have been added. They appear as unknown on the Nagios NSTI interface.

I will attach here what i believe are the most crucial configurations and also the mibs. It would be great if you can have a look at this..

I am also confused about the following issue:

When creating an snmp trap receiver service in Nagios XI, there is no need to give any parameters, only to select an existing host. Or have I got something wrong here?. So there is no way to enter e.g. the community strings. I guess this should be done when creating the host. However, the host can be created from many different templates ( linux, windows, network device etc) and only some of the templates are asking for community string. So should I choose always one specific template to enter the community string? (or is it actually ignored by the trap service?). Should these configurations be done in the snmp conf files directly only?
the monitored device is not any known platform, it is a video frame device which has it's own OS. A stripped version of Linux, though..

Thanks again!
Mark

[scottwilkerson]

When you ran the install script you found in
http://assets.nagios.com/downloads/nagi ... ith_XI.pdf

it added all the current mibs you had on the system to the /etc/snmp/snmptt.conf

In the middle of that document there is a section that states:

Installing MIBs
You may need to configure SNMPTT on the Nagios XI server to use the MIBs your remote devices are using. This may mean having to
load extra MIBs into the /usr/share/snmp/mibs/ directory on the Nagios XI server. You will then also have to run the following command
to import each new MIB (replace <PathToNewMIB> with the path to the MIB you want to import):

Code: Select all

# addmib <PathToNewMIB>

Adjusting Trap Severity
Edit the Trap Translator configuration file located at /etc/snmp/snmptt.conf and alter the severity of each EVENT to match your personal
needs. The default severity level is “Normal” (equivalent to an “Ok” state in Nagios). You may want to change some events to have a
“Warning” or “Critical” severity level (equivalent to “Warning” and “Critical” states in Nagios, respectively). A “<NA>” severity level maps
to an “Unknown” state in Nagios.

You'll probably have to modify the snmptt.conf file to get things working the way you want. In our example that follows later in this
document, the line in snmptt.cfg reading:

EVENT linkDown .1.3.6.1.6.3.1.1.5.3 "Status Events" Normal
was changed to:
EVENT linkDown .1.3.6.1.6.3.1.1.5.3 "Status Events" Critical
In these lines:
• EVENT describes which attribute is being set
• linkDown is the name of the event
• .1.3.6.1.6.3.1.1.5.3 is the OID (Object Identifier) for that type of event
• Normal or Critical is the severity level.

[Markq]

Thanks! This was very useful.