help with SNMP Trap Test

[UWBernie]

We are running v5.6.14 on a 64-bit CentOS 7 VM. I am attempting to configure some SNMP traps, and they are not showing up in the trap interface. In the process of troubleshooting, I clicked on the "Add Example Trap Definition" and the "Send Test Trap" I don't see the test trap showing up in the interface, the test file is empty, and when I tail the /var/log/snmptt.log file I see no new entries there. We do have existing snmp using the legacy snmp setup. Any help on what might be misconfigured?

[tgriep]

One cause of this is if the permissions set wrong on the files and folders so to cover all of the bases, run the following as root to set all of the permissions for all of the files and folders to the correct settings

Code: Select all

chown snmptt:nagios /etc/snmp/nagios-check-storage
chown root:nagios /etc/snmp/snmptt.conf /etc/snmp/snmptt.conf.nxti /etc/snmp /usr/local/bin/addmib
chown nagios:nagios /usr/local/nagiosxi/var/NXTI_Write_Test /etc/snmp/snmptt.ini
chown -R snmptt:snmptt /var/spool/snmptt /var/log/snmptt
chmod 0664 /etc/snmp/nagios-check-storage
chmod 664 /etc/snmp/snmptt_nxti.bak
chmod 664 /etc/snmp/snmptt.conf.nxti
chmod 666 /usr/local/nagiosxi/var/NXTI_Write_Test
chmod 664 /etc/snmp/snmptt.conf
chmod -R g+w /etc/snmp
chmod g+x /usr/local/bin/addmib
chmod -R ug+w /var/spool/snmptt /var/log/snmptt
chmod g-w /var/log/snmptt
chmod g+w /var/lib/net-snmp -R
chmod g+x /usr/local/bin/snmptraphandling.py

Restart the snmptrapd and the snmptt daemons so they can access the files.

Code: Select all

systemctl restart snmptrapd
systemctl restart snmptt

Then see if you can add the example SNMP Trap to the system.

If not, we would need to see the SNMP configuration files and the MIB files from the server so can you run the following 3 commands as root.

Code: Select all

tar cvfz /tmp/snmp.tgz /etc/snmp/*
tar cvfz /tmp/sharesnmp.tgz /usr/share/snmp/mibs/* --dereference
tar cvfz /tmp/snmplog.tgz /var/log/snmptt/*

Then post these 3 files so we can check the settings and the MIB files for any errors.

Code: Select all

/tmp/snmp.tgz
/tmp/sharesnmp.tgz
/tmp/snmplog.tgz

[UWBernie]

I executed the commands provided and still not seeing anything in the logs after sending a test trap from the web interface. Files sent in a PM.

[tgriep]

The test trap is in the configuration files but when it is added, it does not enable the Passive Section of the defined trap so go in to the SNMP Trap Interface and go to the Defined Traps TAB.
Exit the test trap and enable the passive section of the trap and enable the options.

I attached a screen shot, make sure you click on everything that was the arrow pointed to it and save the change.

Go to the Advanced TAB and send the test trap. Go back to the Received Traps TAB and see if it is there.
Then go to the Admin > Unconfigured Objects menu and you should see the trap there with 127.0.0.1 ad the address and SNMP Traps as the service.

If so, you should be OK at this point.


Some of the other traps do not have the passive section setup so to enable all of them, go to the Admin > Manage MIBs menu and click on the Process All Traps button.
That should update the rest of the traps.

[UWBernie]

I enabled the passive check and I still see no received traps when using the test button. The banner says the trap was sent but does not show up. I followed the instructions and have processed all the mibs.

a coworker noticed that after the permission changes I made this morning we are now getting the following warning in the eventman.log
"PROCESSED 2 EVENTS
buffer too small to read octet string (17 < 17)
buffer too small to read octet string (0 < 17)
buffer too small to read octet string (0 < 17)
buffer too small to read octet string (0 < 17)
buffer too small to read octet string (0 < 17)
....................
PROCESSED 0 EVENTS
buffer too small to read octet string (17 < 17)
buffer too small to read octet string (0 < 17)
buffer too small to read octet string (0 < 17)
buffer too small to read octet string (0 < 17)
buffer too small to read octet string (0 < 17)
......."

Any other thoughts?

Not sure if that's related at all.

[UWBernie]

I found the issue, my /etc/snmp/snmptrapd.conf was missing the disableAuthorization yes line.
I am now seeing inbound snmptraps in the nagiosxi received traps tab

I found this kb very helpful. https://support.nagios.com/kb/article.php?id=88

Thanks

[tgriep]

Ah, that would cause it. Good catch.
Let us know if you have any other questions or that we can lock up the post.

[UWBernie]

feel free to lock it up

[scottwilkerson]

feel free to lock it up

Locking thread