Nagios Traps as Service not changing Status

[veeravamsi]

Hi Team,

We have devices sending Traps and we can see those on /var/log/snmptt/snmpttunknown.log and i did add simple entry for OID im interested in snmptt.conf , and i still dont see Service Monitor for SNMP change status or show the Trap information ?

Am i missing anything ?

--Vamsi

[cdienger]

Please see https://assets.nagios.com/downloads/nag ... ios-XI.pdf if you haven't already. It goes through setting up a passive check in XI which is what SNMP trap results are sent to. Please note that a single trap can set the a single status(OK, WARNING, CRITICAL, UNKNOWN) of a service but you could have multiple traps point to the same service to report different statuses. It is also an option to use 'freshness' options to change the status of a service if a trap doesn't come in after a set period of time.

Please provide the following if the above doesn't help resolve the issue:

What version of XI is this?

Can you provide a screenshot of the trap definition(s) in XI?

Are there multiple traps for the same service or just a single trap?

Is the 'Check freshness' option on the service enabled? What is the 'Freshness threshold' set to?

[veeravamsi]

Thank you for your response. Can we also parse Forwarded Traps from Worker Node by Retaining the Original Sender IPAddress ?

Below are details requested.

What version of XI is this?
Yes we are using XI version 5.6.x
Can you provide a screenshot of the trap definition(s) in XI?
Let me attach
Are there multiple traps for the same service or just a single trap?
Yes . We are parsing multiple Traps
Is the 'Check freshness' option on the service enabled? What is the 'Freshness threshold' set to?

[tgriep]

Login to the XI GUI and go to the Admin > Unconfigured Objects menu, do you will see the Trap there from the device?
If so, configure it and from then on, the system will automatically receive it and you can view that in the Service Status menu.
To configure it, click on the Blue arrow and configure that trap by filling in the information.
After you are finished, and the next time a trap is received, it should show up in the Service Status menu.

If the trap is not in the Unconfigured Objects menu, run the following 3 commands as root.

Code: Select all

tar cvfz /tmp/snmp.tgz /etc/snmp/*
tar cvfz /tmp/sharesnmp.tgz /usr/share/snmp/mibs/* --dereference
tar cvfz /tmp/snmplog.tgz /var/log/snmptt/*

Then post these files so we can check the settings, logs and the MIB files for any errors.

Code: Select all

/tmp/snmp.tgz
/tmp/sharesnmp.tgz
/tmp/snmplog.tgz
/var/log/snmptrapd.log

Plus, what is the OID number that you added to the snmptt.conf file and did you restart the snmptt daemon after the change? That is required.

[veeravamsi]

Below is the sample definition i have added to /etc/snmp/snmptt.conf

#
EVENT CDUMonitoringTest .1.3.6.1.4.1.30932.1.1.9.0.5 "Status Events" Critical
FORMAT CDU Monitoring Traps Received (warmStart)
EXEC /usr/local/bin/snmptraphandling.py "$aA" "SNMP Traps" "$s" "$@" "$-*" "CDU Monitoring Traps $1 state: $2 state: $3"
SDESC
A warmStart trap signifies that the SNMPv2 entity
EDESC
#

And i do see some unconfigured Objects in the Admin Section , whats the difference between all these three different spots on Nagios XI : SNMP Trap Interface ;
Unconfigured Objects ;
/etc/snmp/snmptt.conf

[tgriep]

When a new trap or passive object is sent to the Nagios server, they show up in the unconfigured objects menu so they can be configured for notifications and such.
If the device that sent the trap is in that menu, configure it so the status in the GUI can be updated when a new trap is received.

The SNMP Trap Interface is a way to configure traps in the Web interface instead of editing the configurations from the command line.
https://assets.nagios.com/downloads/nag ... h-NXTI.pdf

The use of the /etc/snmp/snmptt.conf file is a manual way to add and edit traps to be translated without using the GUI.

[veeravamsi]

Thank you . Let me know if you think i should open a Ticket with you to have conversation to understand better method as i have below queries :

1. Trap as Service VS Interface Traps == For Event Integration

We want to utilize Trap Feature as Service as we have EVENT Integration active using Nagios API : /api/v1/objects/statehistory
That is why i thought its good to have Traps as Service ( Traps or Passive method ) instead of Interface ( as Interface traps doesnt show up in the statehistory API ).

2. Whitelist Nagios IPs to enable Communication

We have Nagios Primary with its Worker Configuration setup . And Target Devices need to whitelist Nagios IPAddress (For Traps) && Worker IPAddress ( SNMP polling ) to be able to communicate. Can we improve and make things work with Worker Node itself , meaning have Traps received on Worker and Process as Service ?

Thank you and i appreciate your help and response.

[tgriep]

1. I might be a bit confused by what you said for number 1. but if a Trap is setup in Nagios, it is received by the snmptrapd daemon and processed by the snmptt daemon and then sent to the Nagios daemon as a Passive Service that is tied to the Host that sent the trap. The name of the service is called "SNMP Traps".

I do not understand what an Interface Trap is.

2. When you say this "meaning have Traps received on Worker and Process as Service ?" you are referring to the Nagios server, correct?

If so, the following document are the instructions to setup the XI server with the SNMP MIB files and instructions to setup the XI server to receive SNMP Traps from remote devices.
https://assets.nagios.com/downloads/nag ... h-NXTI.pdf

[veeravamsi]

Ok . Let me add little more details -

Installation/Configuration has two Servers :
We are using nagios-primaryserver.domain.com Which has Nagios XI Installed , and another server say nagios-worker.domain.com which has Mod-Gearman Worker ( https://support.nagios.com/kb/article.php?id=484 ) configured in order to run all the Service Checks ( CPU , Disk , Memory , SNMP Polling ) .

Integration :
https://nagios-primaryserver.domain.com ... atehistory API is being used for Integration to send events to Centralized Monitoring Console ( different Tool/Platform )

I believe there are two ways we can consume Incoming Traps on Nagios :

SNMP Trap Interface

SNMPTrapInterface.PNG

Unconfigured Objects or SNMP Traps "Service"

SNMPTrapsService.PNG

We have tested SNMP Traps "Service" ( Passive Monitors or Unconfigured Objects ) which creates Service Monitor and this is visible in API i mentioned for Event Integration.

We are unclear on Integration if we utilize SNMP Trap Interface as this wont showup in https://nagios-primaryserver.domain.com ... atehistory API . Is this true or may be we are doing it incorrectly ?

Our Goal is to Map all the Events - (SNMP Get-Port 161 Outbound)Polled AND Incoming Traps(SNMP Traps-Port 162 Inbound) to Respective Node for Event Correlation.

[tgriep]

The SNMP Trap interface is a tool to help setup SNMP Traps in XI and it is used to setup the Passive Services in the XI GUI.
The service that is setup is called SNMP Traps which is tied to the Host that sent the trap. Once a Trap is setup in the SNMP Trap interface, it should be received by the device that sends the trap.
But, the first time a trap is received, it has to be configured in the Admin > Unconfigured Objects menu. After that, it will be received automatically and show up in the SNMP Traps service.

Go and configure the trap from the Unconfigured Objects menu from your example.

At this point, you should be able to do the API call and get the Status of the service.