Nagios Command File / SNMP issue

[proddan]

Hi Everyone,

I have a NagiosXI 2024 R1.1.4 installation, and am having trouble with external commands

In error, someone set Nagios as an SNMP trap target on one of our SANs, but didn't set up the check in Nagios.
The SAN had a problem earlier in the month, and has been sending SNMP messages to Nagios which end up in the external command file.
I see messages like this in the external command file:

Code: Select all

[1754526435] PROCESS_SERVICE_CHECK_RESULT;UNKNOWN;SNMP Traps;0;Alert notification contains details about an event that  comp_sw_port Port 0:2:2 Failed (Shutdown Due To Too Many Firmware Cores). 0 2 2025-08-07 01:27:15 BST 0 196613 1 1618607   / enterprises.12925.1.7.1.5.1 ():comp_sw_port enterprises.12925.1.7.1.6.1 ():Port 0:2:2 Failed (Shutdown Due To Too Many Firmware Cores). enterprises.12925.1.7.1.4.1 ():0 enterprises.12925.1.7.1.2.1 ():2 enterprises.12925.1.7.1.3.1 ():2025-08-07 01:27:15 BST enterprises.12925.1.7.1.7.1 ():0 enterprises.12925.1.7.1.8.1 ():196613 enterprises.12925.1.7.1.9.1 ():1 enterprises.12925.1.7.1.10.1 ():1618607 enterprises.12925.1.7.1.11.1 (): enterprises.12925.1.7.1.12.1 ():

This was recorded today, but the date of the message is 8th August. The SAN has now been decommissioned, so I know it's no longer sending these messages.

I have restarted Nagios to clear the external command file, but entries like this keep reappearing.
Sometimes I see an entry in unconfigured objects, but when I clear them the issue persists.

We do use passive SMMP checks so turning off external commands isn't an option.

How can I stop these messages getting in the external command file?

Many Thanks,

Peter.

[StevenBeauchemin]

I think the messages get stored here:
/var/spool/snmptt

is anything there?

the file:
/etc/snmp/snmptt.ini

has these lines:

# Directory to read received traps from. Ex: /var/spool/snmptt/
# Don't forget the trailing slash!
spool_directory = /var/spool/snmptt/

Steve B

[proddan]

Thanks very much for this!

Yes, you are correct, the messages seemed to be stored in /var/spool/snmptt

I've stopped the SNMP service, cleared out that folder, then restarted. Hopefully this sorts it.


Peter.

[proddan]

Just wanted to say that this 100% fixed the issue - since I've cleaned out /var/spool/snmptt the command file has been free of these SNMP messages, and the log files have been clean of these errors also.

Thanks again.

Peter.

[nagios-dnelson]

Excellent!

Thanks for the follow-up message! I'm glad that everything is sorted for you now!

-Doug