snmptt passive check is showing UNKNOWN host

[acentek]

[1610722634] Warning: Passive check result was received for service 'FIRE_CAT_Alarm' on host 'UNKNOWN', but the host could not be found!
[1610722634] Error: External command failed -> PROCESS_SERVICE_CHECK_RESULT;UNKNOWN;FIRE_CAT_Alarm;2; Critical - FIRE CAT Alarm
[1610722634] External command [1610722631] PROCESS_SERVICE_CHECK_RESULT;UNKNOWN;FIRE_CAT_Alarm;2; Critical - FIRE CAT Alarm returned error Command failed
[1610723692] Warning: Passive check result was received for service 'FIRE_CAT_Alarm' on host 'UNKNOWN', but the host could not be found!
[1610723692] Error: External command failed -> PROCESS_SERVICE_CHECK_RESULT;UNKNOWN;FIRE_CAT_Alarm;0; Normal - FIRE CAT Alarm

Fri Jan 15 08:57:11 2021 .1.3.6.1.4.1.2682.1.4.8018 Normal "Status Events" UNKNOWN - Generated when discrete point 18 is set. NetGuardian-G4 v4.2U.25 Ossian C.O. 01-15-2021 08:57:11.31 99 1 1 18 OSSN FIRE CAT Alarm
Fri Jan 15 09:14:50 2021 .1.3.6.1.4.1.2682.1.4.9018 Normal "Status Events" UNKNOWN - Generated when discrete point 18 clears. NetGuardian-G4 v4.2U.25 Ossian C.O. 01-15-2021 09:14:50.22 99 1 1 18 OSSN FIRE CAT Clear
Fri Jan 15 09:21:23 2021 .1.3.6.1.4.1.2682.1.4.8018 Normal "Status Events" UNKNOWN - Generated when discrete point 18 is set. NetGuardian-G4 v4.2U.25 Ossian C.O. 01-15-2021 09:21:22.37 99 1 1 18 OSSN FIRE CAT Alarm


As you can see above host return UNKNOWN on Nagios 5.7.5

When testing the NetGuardian running the passive check it always returns unknown at this time.

[acentek]

Here is a log from prior when it worked.

[1603128561] SERVICE NOTIFICATION: opsgenie_for_MN_Central_Office;OSSN-NetGuard-G4;FIRE_CAT_Alarm;CRITICAL;notify-service-by-opsgenie_Contact_2;Critical - FIRE CAT Alarm
[1603128561] SERVICE NOTIFICATION: opsgenie_for_MN_Central_Office;OSSN-NetGuard-G4;FIRE_CAT_Alarm;CRITICAL;notify-service-by-opsgenie_Contact;Critical - FIRE CAT Alarm
[1603128561] SERVICE ALERT: OSSN-NetGuard-G4;FIRE_CAT_Alarm;CRITICAL;HARD;1;Critical - FIRE CAT Alarm
[1603128571] SERVICE NOTIFICATION: opsgenie_for_MN_Central_Office;OSSN-NetGuard-G4;FIRE_CAT_Alarm;OK;notify-service-by-opsgenie_Contact_2;Normal - FIRE CAT Alarm
[1603128571] SERVICE NOTIFICATION: opsgenie_for_MN_Central_Office;OSSN-NetGuard-G4;FIRE_CAT_Alarm;OK;notify-service-by-opsgenie_Contact;Normal - FIRE CAT Alarm

[acentek]

We have confirmed that pre 5.7.5 everything worked but since the upgrade snmptt passive traps are failing unknown host.

Thoughts ideas anything?

[ssax]

Please send me a copy of your profile.zip, you can download it from Admin > System Profile by clicking the Download Profile button.

Run this command as root and send me the resulting /tmp/SNMPFILES.zip file as well:

Code: Select all

zip -r /tmp/SNMPFILES.zip /etc/snmp

I have also reached out to development on this to see if they have any ideas.

Thank you!

[ssax]

In addition to my previous post, please try editing this file:

Code: Select all

/usr/sbin/snmptt

Change line 3291 from this:

Code: Select all

if ($tempvar[0] =~ /<UNKNOWN>/) {

To this:

Code: Select all

if ($tempvar[0] =~ /UNKNOWN/) {

See if that resolves it.

Taken from here:

https://sourceforge.net/p/snmptt/bugs/46/

[acentek]

I have sent the requested files via PM.

[ssax]

Did you test out that change? Did it resolve it?

I think it's ultimately failing because you have dns_enable = 0 in your /etc/snmptt.ini, I think $r in the EXEC line requires DNS working, you can try changing the $r to $aA.

Try changing this in your /etc/snmp/snmptt.conf:

Code: Select all

EVENT dpsRTUv2p8018Set .1.3.6.1.4.1.2682.1.4.8018 "Status Events" Normal
FORMAT Generated when discrete point 18 is set. $*
EXEC /usr/local/bin/netguardian_point18_set.py "$r" "SNMP Traps" "$s" "$@" "$-*" "Generated when discrete point 18 is set. $*"
SDESC
Generated when discrete point 18 is set.
Variables:
  1: sysDescr
  2: sysLocation
  3: dpsRTUv2DateTime
  4: dpsRTUv2APort
  5: dpsRTUv2CAddress
  6: dpsRTUv2ADisplay
  7: dpsRTUv2APoint
  8: dpsRTUv2APntDesc
  9: dpsRTUv2AState
EDESC

To this (changing $r in the EXEC line to $aA):

Code: Select all

EVENT dpsRTUv2p8018Set .1.3.6.1.4.1.2682.1.4.8018 "Status Events" Normal
FORMAT Generated when discrete point 18 is set. $*
EXEC /usr/local/bin/netguardian_point18_set.py "$aA" "SNMP Traps" "$s" "$@" "$-*" "Generated when discrete point 18 is set. $*"
SDESC
Generated when discrete point 18 is set.
Variables:
  1: sysDescr
  2: sysLocation
  3: dpsRTUv2DateTime
  4: dpsRTUv2APort
  5: dpsRTUv2CAddress
  6: dpsRTUv2ADisplay
  7: dpsRTUv2APoint
  8: dpsRTUv2APntDesc
  9: dpsRTUv2AState
EDESC

Then restart SNMPTT and test that .1.3.6.1.4.1.2682.1.4.8018 trap to see if it's resolved.

Code: Select all

service snmptt restart

[acentek]

I made both changes and am waiting to see if it is resolved.

[acentek]

This has resolved the issue. Thank you very much.

[ssax]

That's great to hear! Let us know when we're okay to lock this up.