Help with SNMP traps?

[scottwilkerson]

State History is in Nagios XI under Reports -> State History

Ok - from the report:

Code: Select all

Host Data
Host 	UP 	Down 	Unreachable 
DNT-MLP2-8-PDU-2  	93.485%  	6.515%  	0%  

Service Data
Host 	Service 	Ok 	Warning 	Unknown 	Critical 
DNT-MLP2-8-PDU-2  	PDU Input Frequency  	93.101%  	0%  	6.899%  	0%  
  	PDU Input Voltage  	93.088%  	0%  	6.912%  	0%  
  	PDU Input Voltage 2  	93.124%  	0%  	6.876%  	0%  
  	PDU Output Voltage  	93.101%  	0%  	6.899%  	0%  
  	SNMP Traps - PDU  	100%  	0%  	0%  	0%  
 	Average  	94.483%  	0.000%  	5.517%  	0.000%  

The traps never show down.

This is part of the Availability Report not the State History, but I see it is 100% for the period. Can you see that a trap was in fact sent from the PDU if you look in /var/log/snmp/snmptt.log

[jbennett]

There is nothing in /var/log/snmptt/snmptt.log on the date in question and nothing in snmpttunknown.log for the date in question either.

[nscott]

For the record, changing the snmptrapd to call snmptt and snmptthandler base upon how you have SNMPTT running. If you in the snmptt.ini you have

Code: Select all

mode = standalone

You should be using snmptt, if its daemon, it should be snmptthandler. This will be a game breaker if it isn't set correctly. Also, with the debug on, do you see snmptrapd messages showing up in the /var/log/messages when traps are sent?

[jbennett]

I just came across something rather interesting.

While trying to get NRDS working, I went to the Unconfigured Objects page. Once there, I saw a few IP addresses that were for some of our UPSs and PDUs. I went ahead and ran them through the unconfigured objects wizard since they were showing traps as one of the services.

Lo and behold, I'm now getting traps for these 4 items.

What's different?

Here's an example of what I'm getting for one location that DOES have an issue to report:

When I search for the UPS by the host name as I had it originally configured:

Code: Select all

SNMP Traps - UPS	Ok	31d 3h 52m 36s	1/5	2013-04-01 21:25:30	OK: TRAP RESET
UPS Battery Status Check	Critical	2h 16m 56s	10/10	2013-04-01 21:15:15	SNMP CRITICAL - *3*

When I check the host under the IP address that was in the Unconfigured Objects wizard, the specific host in question is going back and forth between these two traps:

Code: Select all

xxx.xxx.xxx.xxx	SNMP Traps	Warning	1h 0m 22s	1/1	2013-04-01 21:30:13	SEVERE: The UPS batteries are low and will soon be exhausted. The UPS batteries are low and will soon be exhausted / enterprises.2468.1.2.1.2 ():The UPS batteries are low and will soon be exhausted

and

Code: Select all

xxx.xxx.xxx.xxx	SNMP Traps	Ok	1h 0m 55s	1/1	2013-04-01 21:29:08	INFORMATION: The UPS has return from a low battery condition. The UPS has return from a low battery condition / enterprises.2468.1.2.1.2 ():The UPS has return from a low battery condition

Which makes sense when I check the UPS and see the following:

Code: Select all

Battery Capacity Remaining (%)	0

For the record, changing the snmptrapd to call snmptt and snmptthandler base upon how you have SNMPTT running. If you in the snmptt.ini you have

Code: Select all

mode = standalone

You should be using snmptt, if its daemon, it should be snmptthandler. This will be a game breaker if it isn't set correctly. Also, with the debug on, do you see snmptrapd messages showing up in the /var/log/messages when traps are sent?

I think you might be onto something here. My system was set to standalone. Newbie question: I'm not sure how to check how I have snmptt running? I'm not sure if I have it set-up as a daemon or not. I just followed the documentation for the automated install provided here: http://assets.nagios.com/downloads/nagi ... ith_XI.pdf

[scottwilkerson]

Lo and behold, I'm now getting traps for these 4 items.

What's different?

My guess was that these systems are sending the traps with the IP as the hostname and these IP's weren't in XI yet.

If XI receives a passive result (Trap or otherwise) if the host has not been configured yet, it will place the item in unconfigured objects.

[lmiltchev]

I hope this helps:

http://snmptt.sourceforge.net/docs/snmp ... -Operation

[jbennett]

Lo and behold, I'm now getting traps for these 4 items.

What's different?

My guess was that these systems are sending the traps with the IP as the hostname and these IP's weren't in XI yet.

If XI receives a passive result (Trap or otherwise) if the host has not been configured yet, it will place the item in unconfigured objects.

I have a field where I can set a host name on the PDUs. This is set on all PDUs, but it doesn't necessarially match the host name in Nagios.

I do have all PDUs listed in Nagios with a host name as a location identifier, not just an IP. Are you saying that you think this might be the issue?

What's getting me is that I haven't seen any other devices show up as unconfigured. We have like 600 of these devices and only 4 of them have shown up?

[scottwilkerson]

I do have all PDUs listed in Nagios with a host name as a location identifier, not just an IP. Are you saying that you think this might be the issue?

Yes, it all depends on what the PDU sends the trap as, if that matches it should show up.

What's getting me is that I haven't seen any other devices show up as unconfigured. We have like 600 of these devices and only 4 of them have shown up?

They will only show up if the device sends a known trap, if it hasn't sent a trap or the trap is unknown, it will not show up.

[jbennett]

I do have all PDUs listed in Nagios with a host name as a location identifier, not just an IP. Are you saying that you think this might be the issue?

Yes, it all depends on what the PDU sends the trap as, if that matches it should show up.

It sounds like I would need to go back through and adjust all of these devices to be the same as the address field and utilize the Description or Display Name field for the location name then. Am I understanding that correctly?

[scottwilkerson]

That sounds correct, Nagios expects the trap to be sent from what it has listed in the host_name field