SNMP Trap Monitoring in Nagios XI

[ssax]

We'll keep an eye out for your results.

Thank you!

[emartine]

Files have sent via PM due to potential for sensitive info.

The alert in question has x.x.x.143

Wed Oct 14 17:10:38 2020 .1.3.6.1.4.1.4184.2.0.2 Critical "Fatal" server IP - Received trap "oplGenericV2Trap" with variables "
enterprises.4184.2.1.2.1.2.23.67.101.114.110.101.114.95.79.80.69.78.76.105.110.107.95.50.52.46.49.45.48.53:Cerner OPENLink 24.1-05
enterprises.4184.2.1.2.1.5.23.67.101.114.110.101.114.95.79.80.69.78.76.105.110.107.95.50.52.46.49.45.48.53:1
enterprises.4184.2.2.2.1.1.12.73.67.79.80.50.52.49.53.72.48.65.72:ICOP2415H0AH
enterprises.4184.2.5.1.0:SR03
enterprises.4184.2.5.2.0:1
enterprises.4184.2.5.3.0:INIT - Server process loading definitions.
enterprises.4184.2.5.4.0:2020-10-14 17:10:38
enterprises.4184.2.5.8.0:7929857
enterprises.4184.2.5.9.0:7929857"

[emartine]

Please keep me posted.

[ssax]

Does it work if you change the MATCH statements to use $5 instead of $6?

[emartine]

I don't believe so. Why use $5 when the status we want is on $6 ?

[tgriep]

What is happening is that the device at IP address xxx.xxx.xxx.3 is sending the status in the 5th field and not the 6th field and that is why is was suggested to use the 5th field for the MATCH statement.
The device at IP address xxx.xxx.xxx.4 is sending the status in the 6th field like the MIB suggests so that one is working.

What you will have to do is create another Trap definition and put in another MATCH to match that IP address and change the other MATCH to 5.

[emartine]

Please remove IP addresses from the post.

[tgriep]

The address are removed.

[emartine]

Thank you for that I didn't catch that. I am not seeing an OK status from the 3 environment to compare both the critical and ok states for the 4 environment. I am going to request that from the service owner and see if the returned status section of the trap also matches the same position.

[tgriep]

OK, post what you find. It is strange that the fields are different but it could be a firmware software issue with the devices or the manufacturer not keeping the fields the same for some reason.