Help with SNMP traps?

jbennett · Post by **jbennett** » Thu Mar 21, 2013 8:26 pm

[root@nagiosxivm ~]# snmptrap -v 1 -c roadway 10.250.2.55 UCD-TRAP-TEST-MIB::demotraps "" 6 17 "" SNMPv2-MIB::syslocation.0 s "Here"
No log handling enabled - turning on stderr logging
SNMPv2-MIB::syslocation.0: Unknown Object Identifier

When I check the unknown log on the new server, I don't see anything relating to this in there. However, I do see some traps from other devices being dumped in there.

When I check the traps service check, I see that it is set to use the check_dummy check?

All of my current traps that I have (396) set up on my system show: OK: Trap reset on Thu Mar 21 20:24:20 CDT 2013

Is this correct? It seems that I've had some PDUs and UPSs go down in the past and the trap has never changed state?

scottwilkerson · Post by **scottwilkerson** » Thu Mar 21, 2013 8:43 pm

Sorry I didn't catch this earlier, it should be SNMPv2-MIB::sysLocation.0

Code: Select all

snmptrap -v 1 -c roadway 10.250.2.55 UCD-TRAP-TEST-MIB::demotraps "" 6 17 "" SNMPv2-MIB::sysLocation.0 s "Here"

jbennett · Post by **jbennett** » Fri Mar 22, 2013 8:47 am

That worked!

Code: Select all

Fri Mar 22 08:28:29 2013: Unknown trap (.1.3.6.1.4.1.2021.13.990.0.17) received from 10.100.30.10 at:
Value 0: 10.100.30.10
Value 1: 10.100.30.10
Value 2: 2:18:55:18.22
Value 3: .1.3.6.1.4.1.2021.13.990.0.17
Value 4: 10.100.30.10
Value 5: roadway
Value 6: .1.3.6.1.4.1.2021.13.990
Value 7:
Value 8:
Value 9:
Value 10:
Ent Value 0: .1.3.6.1.2.1.1.6.0=Here

What was different?

I have had the traps configured for a month or so but have yet to be notified of any status changes in the traps. Since getting the trap to work from my old Nagios box, I realized I haven't changed a single thing on the new box.

All of my current traps just show: OK: Trap reset on Fri Mar 22 08:37:32 CDT 2013

Post by **nscott** » Fri Mar 22, 2013 9:56 am

sysLocation had a capitalized L in it, when in your example it did not.

jbennett · Post by **jbennett** » Wed Mar 27, 2013 11:42 am

I'm noticing that my snmptt.debug log file is getting rather large.

I don't seem to be getting any trap updates.

As an exmaple, I have a PDU that is offline, yet the trap check tells me: OK: Trap reset on Wed Mar 27 11:39:07 CDT 2013

I have 4 other service checks done via SNMP on these devices until I can get traps working correctly.

All 4 of those checks show: SNMP problem - No data received from host

When I check the snmptt.debug log file, I see a whole bunch of the following:

Code: Select all

Processing file: #snmptt-trap-1359929377340843
  Invalid trap file.  Expected a hostname on line 2 but got nothing
  Error processing trap file #snmptt-trap-1359929377340843.  Skipping...
Processing file: #snmptt-trap-1359929377831637
  Invalid trap file.  Expected a serial time on the first line but got nothing
  Error processing trap file #snmptt-trap-1359929377831637.  Skipping...
Processing file: #snmptt-trap-1359929378192109
  Invalid trap file.  Expected a hostname on line 2 but got nothing
  Error processing trap file #snmptt-trap-1359929378192109.  Skipping...
Processing file: #snmptt-trap-1359929378435943
  Invalid trap file.  Expected a hostname on line 2 but got nothing
  Error processing trap file #snmptt-trap-1359929378435943.  Skipping...
Processing file: #snmptt-trap-1359929378626032
  Invalid trap file.  Expected a hostname on line 2 but got nothing
  Error processing trap file #snmptt-trap-1359929378626032.  Skipping...
Processing file: #snmptt-trap-1359929379252798
  Invalid trap file.  Expected a hostname on line 2 but got nothing
  Error processing trap file #snmptt-trap-1359929379252798.  Skipping...
Processing file: #snmptt-trap-1359929379462835
  Invalid trap file.  Expected a hostname on line 2 but got nothing
  Error processing trap file #snmptt-trap-1359929379462835.  Skipping...
Processing file: #snmptt-trap-1359929379593267
  Invalid trap file.  Expected a hostname on line 2 but got nothing
  Error processing trap file #snmptt-trap-1359929379593267.  Skipping...
Processing file: #snmptt-trap-1360015770046524
  Invalid trap file.  Expected a serial time on the first line but got nothing
  Error processing trap file #snmptt-trap-1360015770046524.  Skipping...
Processing file: #snmptt-trap-1360015770261224
  Invalid trap file.  Expected a serial time on the first line but got nothing
  Error processing trap file #snmptt-trap-1360015770261224.  Skipping...
Processing file: #snmptt-trap-1360015770802634
  Invalid trap file.  Expected a serial time on the first line but got nothing
  Error processing trap file #snmptt-trap-1360015770802634.  Skipping...
Processing file: #snmptt-trap-1360015771163098
  Invalid trap file.  Expected a serial time on the first line but got nothing
  Error processing trap file #snmptt-trap-1360015771163098.  Skipping...
Processing file: #snmptt-trap-1360015771418483
  Invalid trap file.  Expected a serial time on the first line but got nothing
  Error processing trap file #snmptt-trap-1360015771418483.  Skipping...
Processing file: #snmptt-trap-1360015771674006
  Invalid trap file.  Expected a serial time on the first line but got nothing
  Error processing trap file #snmptt-trap-1360015771674006.  Skipping...
Processing file: #snmptt-trap-1360015771936977
  Invalid trap file.  Expected a serial time on the first line but got nothing
  Error processing trap file #snmptt-trap-1360015771936977.  Skipping...
Sleeping for 5 seconds

When I check the /var/spool/snmptt directory:

Code: Select all

[root@LNTTAVMNAG1 snmptt]# ls -lh
total 28K
-rw-r--r-- 1 root root 11 Feb  3 16:09 #snmptt-trap-1359929377340843
-rw-r--r-- 1 root root  0 Feb  3 16:09 #snmptt-trap-1359929377831637
-rw-r--r-- 1 root root 11 Feb  3 16:09 #snmptt-trap-1359929378192109
-rw-r--r-- 1 root root 11 Feb  3 16:09 #snmptt-trap-1359929378435943
-rw-r--r-- 1 root root 11 Feb  3 16:09 #snmptt-trap-1359929378626032
-rw-r--r-- 1 root root 11 Feb  3 16:09 #snmptt-trap-1359929379252798
-rw-r--r-- 1 root root 11 Feb  3 16:09 #snmptt-trap-1359929379462835
-rw-r--r-- 1 root root 11 Feb  3 16:09 #snmptt-trap-1359929379593267
-rw-r--r-- 1 root root  0 Feb  4 16:09 #snmptt-trap-1360015770046524
-rw-r--r-- 1 root root  0 Feb  4 16:09 #snmptt-trap-1360015770261224
-rw-r--r-- 1 root root  0 Feb  4 16:09 #snmptt-trap-1360015770802634
-rw-r--r-- 1 root root  0 Feb  4 16:09 #snmptt-trap-1360015771163098
-rw-r--r-- 1 root root  0 Feb  4 16:09 #snmptt-trap-1360015771418483
-rw-r--r-- 1 root root  0 Feb  4 16:09 #snmptt-trap-1360015771674006
-rw-r--r-- 1 root root  0 Feb  4 16:09 #snmptt-trap-1360015771936977

What does this indicate?

In some searching, I've found where one individual ran into this same issue and ended up changing his snmptrapd.conf file to:

Code: Select all

traphandler default /usr/sbin snmptthandler

from:

Code: Select all

traphandler default /usr/sbin snmptt

When I check my snmptrapd.conf file, I see the following:

Code: Select all

disableAuthorization yes
traphandle default /usr/local/sbin/snmptthandler

For reference:

Code: Select all

# ls -lh /usr/local/sbin/snmptthandler
-rwxr-xr-x 1 root root 6.4K Nov  1 16:02 /usr/local/sbin/snmptthandler

scottwilkerson · Post by **scottwilkerson** » Wed Mar 27, 2013 4:38 pm

All the items in /var/spool/snmptt are almost 2 month old, likely from before it was working, I would remove them.

You likely can turn debugging off.

As for the traps not making it in there, are you sure the PDU sent a trap before it went offline?? If so,do you see results in a state history report for when it went offline?

jbennett · Post by **jbennett** » Thu Mar 28, 2013 9:25 am

scottwilkerson wrote:All the items in /var/spool/snmptt are almost 2 month old, likely from before it was working, I would remove them.

You likely can turn debugging off.

I checked that folder again and now I have a number of other items in there from yesterday as well. I then went to the /etc/snmp/snmptt.ini file and set DEBUGGING = 0 then restarted snmptt.

Now when I check the folder, I don't see anything. Interesting.

As for the traps not making it in there, are you sure the PDU sent a trap before it went offline?? If so,do you see results in a state history report for when it went offline?

I'm looking for a state history report, but I'm not finding anything?

On the SNMP Trap, I do see the following:

Duration: 138d 7h 50m 44s

scottwilkerson · Post by **scottwilkerson** » Thu Mar 28, 2013 12:46 pm

State History is in Nagios XI under Reports -> State History

Post by **lmiltchev** » Thu Mar 28, 2013 1:12 pm

I'm looking for a state history report, but I'm not finding anything?

Did the state of the service change within the specified period?

jbennett · Post by **jbennett** » Thu Mar 28, 2013 1:57 pm

scottwilkerson wrote:State History is in Nagios XI under Reports -> State History

Ok - from the report:

Code: Select all

Host Data
Host 	UP 	Down 	Unreachable 
DNT-MLP2-8-PDU-2  	93.485%  	6.515%  	0%  

Service Data
Host 	Service 	Ok 	Warning 	Unknown 	Critical 
DNT-MLP2-8-PDU-2  	PDU Input Frequency  	93.101%  	0%  	6.899%  	0%  
  	PDU Input Voltage  	93.088%  	0%  	6.912%  	0%  
  	PDU Input Voltage 2  	93.124%  	0%  	6.876%  	0%  
  	PDU Output Voltage  	93.101%  	0%  	6.899%  	0%  
  	SNMP Traps - PDU  	100%  	0%  	0%  	0%  
 	Average  	94.483%  	0.000%  	5.517%  	0.000%

The traps never show down.

Nagios Support Forum

Help with SNMP traps?

Re: Help with SNMP traps?

Re: Help with SNMP traps?

Re: Help with SNMP traps?

Re: Help with SNMP traps?

Re: Help with SNMP traps?

Re: Help with SNMP traps?

Re: Help with SNMP traps?

Re: Help with SNMP traps?

Re: Help with SNMP traps?

Re: Help with SNMP traps?