Traps are not processing

[sandeep.endla]

Hi ,

I have configured the snmp trap monitoring on the nagios core. I am receiving the traps on /valog/snmptt/snmptt.log, but the traps are not processing it is showing empty for the TRAPS for the server (ep-app-ana-06.woodgroup.com) in nagios.log. Could you, Please help with it.
Attaching the snmptt.ini, snmptt.conf and snmptt.log

[root@ep-app-nag-02 var]# cat nagios.log | grep -i ep-app-ana-06.woodgroup.com | grep -i trap
[1528066800] CURRENT SERVICE STATE: ep-app-ana-06.woodgroup.com;TRAP;OK;HARD;1;
[root@ep-app-nag-02 var]#

[tgriep]

This entry in the snmptt.conf file

Code: Select all

EVENT authenticationFailure .1.3.6.1.6.3.1.1.5.5 "Status Events" Normal

Has an empty EXEC command which is used to send the received trap to the Nagios process.
You need to put an EXEC line in that OID like the example below.

Code: Select all

EXEC /nagiosfs/libexec/eventhandlers/submit_check_result $r TRAP 1 "SNMP authentication failure"

Another thing I see if that there are 2 different paths for the submit_check_result script.

Code: Select all

/nagiosfs/libexec/eventhandlers/submit_check_result
/usr/lib64/nagios/plugins/submit_check_result

Make sure that they are both valid or change the invalid one to the correct one.

[sandeep.endla]

Hi tgriep,

Ihave given the EXEC entry for the the below mentioned OIDs.
Also we have changed the submit_check_result for all the EVENTS with /nagiosfs/libexec/eventhandlers/submit_check_result.
Now also the TRAPs are not working.

[tgriep]

Let's enable logging for the snmptt daemon by editing the snmptt.ini file and changing the following from

Code: Select all

log_system_enable = 0
unknown_trap_log_enable = 0

to

Code: Select all

log_system_enable = 1
unknown_trap_log_enable = 1

Save the change and restart the daemon by running
service snmptt restart

Wait for the system to receive some traps or force them to run and then post the following files here so we can view them.

Code: Select all

/var/log/snmptt/snmptt.log
/var/log/snmptt/snmpttsystem.log
/var/log/snmptt/snmpttunknown.log

[sandeep.endla]

Hi Tgriep,

We have made the changes in snmptt.ini file as mentioned. Please find the attached log files

[tgriep]

Code: Select all

su - nagios
/nagiosfs/libexec/eventhandlers/submit_check_result ep-app-ana-06.woodgroup.com TRAP 1 "SNMP authentication failure"

Then check the nagios.log file to see if the traps are received.

Code: Select all

grep -i ep-app-ana-06.woodgroup.com /nagiosfs/var/nagios.log | grep -i trap

The entries in the snmpttunknown log have to be added to the snmptt.conf file so they will be processes.

[sandeep.endla]

Hi Tgriep,

Thanks for the help.

I have run the below command and the TRAP is generated on the nagios console.

Could you, Please let us known how to add the traps receiving in the snmpttunknown.log to snmptt.conf file.

[tgriep]

To add the unknown traps to the snmptt.conf file is to search the internet for the OID that is displayed in the unknown log file to find out which MIB file it is in.
Once you find that, you would run the same command that was used to add the other entries but with some modifications, the example below should add the entries.

Code: Select all

snmpttconvertmib --in=NewMibFile --out=/etc/snmp/snmptt.conf --exec /nagiosfs/libexec/eventhandlers/submit_check_result $r TRAP 1 "$s"

Fore more details, look at this link.
http://snmptt.sourceforge.net/docs/snmp ... tmib.shtml

[sandeep.endla]

thanks tgreip,

Will do the same as requested.

Iam receiving the TRAPS in snmptt.log as below. but the traps are not processing is the "SNMP athentication failure" defined in snmptt.conf has any issue.

Mon Jun 11 12:13:02 2018 .1.3.6.1.6.3.1.1.5.5 Normal "Status Events" ep-app-bi-01.woodgroup.com - SNMP athentication failure
Mon Jun 11 12:13:07 2018 .1.3.6.1.6.3.1.1.5.5 Normal "Status Events" ep-app-bi-01.woodgroup.com - SNMP athentication failure
Mon Jun 11 12:13:12 2018 .1.3.6.1.6.3.1.1.5.5 Normal "Status Events" ep-app-bi-01.woodgroup.com - SNMP athentication failure

[root@ep-app-nag-02 snmptt]# cat /nagiosfs/var/nagios.log | grep -i ep-app-bi-01.woodgroup.com | grep -i trap
[1528671600] CURRENT SERVICE STATE: EP-APP-BI-01.WOODGROUP.com;TRAP;OK;HARD;1;

#
#
#
EVENT authenticationFailure .1.3.6.1.6.3.1.1.5.5 "Status Events" Normal
FORMAT SNMP athentication failure
#EXEC qpage -f TRAP notifygroup1 "SNMP authentication failure"

EXEC /nagiosfs/libexec/eventhandlers/submit_check_result $r TRAP 1 "SNMP authentication failure"
SDESC
An authenticationFailure trap signifies that the SNMPv2
entity, acting in an agent role, has received a protocol
message that is not properly authenticated. While all
implementations of the SNMPv2 must be capable of generating
this trap, the snmpEnableAuthenTraps object indicates
whether this trap will be generated.
EDESC
#

[tgriep]

Can you post your snmptt.conf file as well as the output of these commands run as root?

Code: Select all

ls -l /nagiosfs/
ls -l /nagiosfs/libexec/
ls -l /nagiosfs/libexec/eventhandlers/
grep snmp /etc/group
ps -ef |grep snmp