Cisco RTT / IPSLA showing SNMP Traps in hex on Nagios

[vijilants]

System:
Nagios XI Version : 5.4.11
londnms1 2.6.32-431.29.2.el6.i686 i686
CentOS release 6.5 (Final)
Gnome Installed

Hi ,

Can somebody please advise on the following.

I am trying to use Nagios to monitor IPSLA / RTT SNMP traps from Cisco devices.

However these are the sort of messages I am getting in nagios....

A rttMonThresholdNotification indicates the 0A 01 01 56 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2 / enterprises.9.9.42.1.2.1.1.3.1 (): enterprises.9.9.42.1.4.1.1.5.1 ():0A 01 01 56 00 00 00 00 00 00 00 00 00 00 00 00 00

A rttMonNotification indicates the occurrence of a 0A 01 01 56 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 7 2 0 0 0 00 00 00 00 13 BA 67 10 00 00 00 04 44 00 00 24 00 00 00 00 00 00 00 00 00 00 00 00 / enterprises.9.9.42.

The first one is when a problem occurs (Warning) and the second one is when a problem clears (Normal).

As you can see, this gives next to no useful info.

Can you please advise on how to get this reporting correctly ?

Thanks

[tgriep]

When you uploaded the CISCO-RTTMON-MIB mib file to the Nagios XI server, did you also upload the CISCO-SMI Mib file as well?
The RTTMON file needs the other MIB file loaded on the server to translate certain OID's and that could be one cause if the issue.

Some trap strings may be received in hexadecimal format. You can add option -Oa to snmptrapd daemon to force the received information to ASCII.
To do this, edit the /etc/sysconfig/snmptrapd file and on the OPTIONS= line, add the following to it.

Code: Select all

-Oa

If it is commented out, uncomment it and set it to the following.

Code: Select all

OPTIONS="-Oa -Lsd -p /var/run/snmptrapd.pid"

Then restart the daemon by running

Code: Select all

service snmptrapd restart

Generate a Trap and see if it is decoded to ASCII for you.

[vijilants]

When you uploaded the CISCO-RTTMON-MIB mib file to the Nagios XI server, did you also upload the CISCO-SMI Mib file as well?
The RTTMON file needs the other MIB file loaded on the server to translate certain OID's and that could be one cause if the issue.

Some trap strings may be received in hexadecimal format. You can add option -Oa to snmptrapd daemon to force the received information to ASCII.
To do this, edit the /etc/sysconfig/snmptrapd file and on the OPTIONS= line, add the following to it.

Code: Select all

-Oa

If it is commented out, uncomment it and set it to the following.

Code: Select all

OPTIONS="-Oa -Lsd -p /var/run/snmptrapd.pid"

Then restart the daemon by running

Code: Select all

service snmptrapd restart

Generate a Trap and see if it is decoded to ASCII for you.

Cisco-SMI is already installed.

Here is the output of my existing snmptrapd file below. Can you please show me exactly where I need to add the code above ?

Thanks

Code: Select all

OPTIONS="-Lsd -On -p /var/run/snmptrapd.pid"

[tgriep]

Change that line from

Code: Select all

OPTIONS="-Lsd -On -p /var/run/snmptrapd.pid"

to

Code: Select all

OPTIONS="-Lsd -Oa -p /var/run/snmptrapd.pid"

Save the file and restart the snmptrapd daemon by running

Code: Select all

service snmptrapd restart

[vijilants]

OK, after the changes made above now I am getting this in the information box for the trap(see below) . Not much better.

Code: Select all

A rttMonNotification indicates the occurrence of a ..V........................ 7 2 0 0 0 ......g.....D..$............ / enterprises.9.9.42.1.2.1.1.3.1 (): enterprises.9.9.42.1.4.1.1.5.1 (): ..V........................ enterprises.9.9.42.1.2.19.1.2.1 ():

[dwhitfield]

At this point, I would suggest submitting a ticket at https://support.nagios.com/tickets/ to speed this along.

[tgriep]

I was hoping that there may of been some useful information that can be used when it was converted to ASCII.
You can put back the setting back to -On.

If could be that the system is sending HEX as the data so there may be nothing to do to fix it.
I couldn't find much information on what the data should look like but I did find a description of the OID's meaning at the link below.
https://www.cisco.com/c/en/us/td/docs/r ... 1mib4.html

[vijilants]

On the same subject, I have noticed that the following traps for IP SLA timeouts are in router logs and the snmptt.log but do not appear in the GUI when you search in the GUI under SNMP state history for the host

One is for a condition occuring and the other is for the condition clearing.

This is what is in the router log:

Code: Select all

Jan 17 09:03:45: %RTT-4-OPER_TIMEOUT: condition occurred, entry number = 1
Jan 17 09:03:45: %RTT-3-IPSLATHRESHOLD: IP SLAs(1): Threshold Occurred for timeout
Jan 17 09:03:46: %RTT-4-OPER_TIMEOUT: condition cleared, entry number = 1
Jan 17 09:03:46: %RTT-3-IPSLATHRESHOLD: IP SLAs(1): Threshold Cleared for timeout

This is what is in the snmptt.log for the event:

Code: Select all

Wed Jan 17 09:03:46 2018 .1.3.6.1.4.1.9.9.41.2.0.1 Warning "Status Events" SomSW02 - When a syslog message is generated by the device a clogMessageGenerated notification is sent. The sending of these notifications can be enabled/disabled via the clogNotificationsEnabled object. RTT 5 OPER_TIMEOUT condition occurred, entry number = 1 32:2:44:33.57
Wed Jan 17 09:03:47 2018 .1.3.6.1.4.1.9.9.41.2.0.1 Normal "Status Events" SomSW02 - When a syslog message is generated by the device a RTT 5 OPER_TIMEOUT condition cleared, entry number = 1 32:2:44:34.58

The above does not appear in the GUI for SNMP traps.


However searching for the actual mib variable, this is what I found in the snmptt.conf file:

Code: Select all

#
MIB: CISCO-SYSLOG-MIB (file:/usr/share/snmp/mibs/CISCO-SYSLOG-MIB.txt) converted on Fri Dec  8 08:55:51 2017 using snmpttconvertmib v1.3
#
#
#
EVENT clogMessageGenerated .1.3.6.1.4.1.9.9.41.2.0.1 "Status Events" Normal
FORMAT When a syslog message is generated by the device a $*
EXEC /usr/local/bin/snmptraphandling.py "$r" "SNMP Traps" "$s" "$@" "$-*" "When a syslog message is generated by the device a $*"
SDESC
When a syslog message is generated by the device a
clogMessageGenerated notification is sent.  The
sending of these notifications can be enabled/disabled
via the clogNotificationsEnabled object.
Variables:
  1: clogHistFacility
  2: clogHistSeverity
  3: clogHistMsgName
  4: clogHistMsgText
  5: clogHistTimestamp
EDESC

Both traps appear to have the same OID but for two different scenarios...one being the for condition occuring , one being for clearing.

So how do I get these to show up in the GUI under SNMP traps, with Warning when the condition occurs and Normal when the codition clears ?

Thanks

[tgriep]

The default state setting in the snmptt.conf file for traps is set to the OK state so when multiple traps come in to the same OID, they will overwrite the existing trap info in the gui so that is why they to not show up in the state history.

Since the state is always OK, it will not log the details for the trap.

What you would have to do it to create a new entry in the snmptt.conf file with settings to create a warning or critical state and then when they get sent to Nagios, that will show up in the State History.

In the link below, is a KB article with a lot of details on how traps work with XI and there are some examples on how to create Warning and Critical Traps.
https://support.nagios.com/kb/article/n ... al-77.html

Look under this section "Create Custom Events In SNMPTT" in the article.

[vijilants]

Thank you for the link.

However, due to an urgent operational issue on our network that require this IP SLA monitoring service, I'm afraid I don't have time to read through all of this or experiment with it.

Can you kindly guide me as to what I need to do to get this going as quickly as possible per my post and I will read the document after ?

Many Thanks