Traps going to snmpttunknown.log

[jbennett]

But looking at the text of the trap in your image, it does say that the ups has switched to battery backup power.

I should clarify that the items below the SNMP Traps - UPS service, are just standard SNMP checks that I have included while trying to resolve this issue. The hope is that once I get the traps functioning the way I want, I will be able to remove the duplicate SNMP checks (think 2000+ service cheks on our UPSs & PDUs).

"Thu Dec 20 14:39:54 2012 .1.3.6.1.4.1.2468.1.2.1.2.0.8 Normal "Status Events" xxx.xxx.xxx.xxx - WARNING: The UPS has switched to battery backup power. 100 1104 14793 The UPS has switched to battery backup power"

I assume you expect the entry to be red with a status of critical. In this case, it looks like the translated trap entry in snmpt.conf (or wherever it is) was assigned the severity 'normal', which nagios translates to 'OK'. If this trap is only called when the unit goes on battery, you can change the severity in the snmptt.conf entry to match what you want it to show up as in nagios. This is from the Adjusting Trap Severity section of "Integrating_SNMP_Traps_With_XI.pdf":

I don't know why I didn't catch that. I'm off to edit those now.

[jbennett]

OK - when I check my snmptt.conf file, I have duplicate entries for the same trap in this instance (and I'm betting for others as well):

Code: Select all

EVENT ushaUpsOnBattery .1.3.6.1.4.1.2468.1.2.1.2.0.8 "Status Events" Normal
FORMAT WARNING: The UPS has switched to battery backup power. $*
EXEC /usr/local/bin/snmptraphandling.py "$r" "SNMP Traps" "$s" "$@" "$-*" "WARNING: The UPS has switched to battery backup power. $*"
SDESC
WARNING: The UPS has switched to battery backup power.
Variables:
  1: upsEstimatedChargeRemaining
  2: upsBatteryVoltage
  3: upsSecondsOnBattery
EDESC

Code: Select all

EVENT ushaUpsOnBattery .1.3.6.1.4.1.2468.1.2.1.2.0.8 "Status Events" Warning
FORMAT WARNING: The UPS has switched to battery backup power. $*
EXEC /usr/local/bin/snmptraphandling.py "$r" "SNMP Traps" "$s" "$@" "$-*" "WARNING: The UPS has switched to battery backup power. $*"
SDESC
WARNING: The UPS has switched to battery backup power.
Variables:
  1: upsEstimatedChargeRemaining
  2: upsBatteryVoltage
  3: upsSecondsOnBattery
EDESC

Checking the USHAP.MIB file for the same string, I see the following:

Code: Select all

ushaUpsOnBattery TRAP-TYPE
        ENTERPRISE upsTraps
        VARIABLES {
        upsEstimatedChargeRemaining,
        upsBatteryVoltage,
        upsSecondsOnBattery
        }
        DESCRIPTION
                "WARNING: The UPS has switched to battery backup power."
        ::= 8

Which doesn't indicate critical, warning, or normal?

Why would this be?

I should also note that I checked the Falcon site and downloaded their MIB files to compare against what's on the CD and they are identical per ExamDiff.

[jbennett]

OK - turns out there was a newer version of the MIB file for the TrippLite PDU.

However, when I try to addmib from the command line, I am told that the file has been added already.

When I check the snmptt.conf file, the new OIDs are not added.

Do I have any options here? Would it work if I were to rename the file to incriment it by 1? (TRIPPLITE-MIB.txt -> TRIPPLITE-MIB1.txt

[jwelch]

You can remove the mib files you don't want and clean out the entries in the snmptt.conf file, then re-add the mib you want and go back in and modify the snmptt to suit your needs. I *think* the traps are assigned a 'normal' severity by default, but you just go in and change it to what you want depending on what event the trap is for. I seem to remember that there is a marker placed in the snmptt.conf file to indiicate what file the translated traps come from. That's how it knows that the mib has 'already been loaded'. Looking in my snmptt.conf I see entries like this:

MIB: AGENTX-MIB (file:/usr/share/snmp/mibs/AGENTX-MIB.txt) converted on Thu Aug 30 11:43:44 2012 using snmpttconvertmib v1.3

So I assume you can find the marker for your mib file in snmptt.conf and remove that line and everything between that and the next file marker.