SNMP Traps

[stratogen_richard]

Hi,

I am having an issue in getting snmp traps to show up in nagiosxi. I have installed all the relevant packages and can see the traps coming in. They are in the log files as expected. I can even see them in NSTI, however, when I add the snmp service to the host it just sits on "waiting for trap..." at all times, and there is nothing I can seem to do to get the traps to display.

Any help would be appreciated.

[sreinhardt]

Most likely this is an issue with either the snmptt.conf exec lines, or permissions for the user the snmptt user trying to access nagios.cmd.

Please send back the results of these:

Code: Select all

grep -i 'daemon_uid\|mode =' /etc/snmp/snmptt.ini
grep -i -m 5 'exec' /etc/snmp/snmptt.conf
grep -i 'nag' /etc/group
grep -i 'snmp' /etc/group

[stratogen_richard]

grep -i 'daemon_uid\|mode =' /etc/snmp/snmptt.ini
mode = standalone
description_mode = 0
# A second (child) process will be started as the daemon_uid user so
daemon_uid = snmptt

grep -i -m 5 'exec' /etc/snmp/snmptt.conf
EXEC /usr/local/bin/snmptraphandling.py "$r" "SNMP Traps" "$s" "$@" "$-*" "The newRoot trap indicates that the sending agent has $*"
EXEC /usr/local/bin/snmptraphandling.py "$r" "SNMP Traps" "$s" "$@" "$-*" "A topologyChange trap is sent by a bridge when any of $*"
EXEC /usr/local/bin/snmptraphandling.py "$r" "SNMP Traps" "$s" "$@" "$-*" "Notification that the trigger indicated by the object $*"
EXEC /usr/local/bin/snmptraphandling.py "$r" "SNMP Traps" "$s" "$@" "$-*" "Notification that the rising threshold was met for triggers $*"
EXEC /usr/local/bin/snmptraphandling.py "$r" "SNMP Traps" "$s" "$@" "$-*" "Notification that the falling threshold was met for triggers $*"

grep -i 'nag' /etc/group
nagios500:nagios,apache
nagcmd501:nagios,apache

grep -i 'snmp' /etc/group
snmptt496:

[scottwilkerson]

Also, can you run

Code: Select all

ll /var/log/snmptt/

[stratogen_richard]

-rw-r--r-- 1 snmptt root 1807755 Nov 7 09:29 snmptt.debug
-rw-r--r-- 1 snmptt root 367278 Oct 24 03:22 snmptt.debug-20131024
-rw-r--r-- 1 snmptt root 1342303 Oct 27 03:41 snmptt.debug-20131027
-rw-r--r-- 1 snmptt root 2979028 Nov 3 03:50 snmptt.debug-20131103
-rw-r--r-- 1 root root 456 Nov 6 16:01 snmptt.log
-rw-r--r-- 1 root root 2588 Oct 25 10:12 snmptt.log-20131027
-rw-r--r-- 1 root root 569 Oct 31 14:21 snmptt.log-20131103
-rw-r--r-- 1 root root 0 Feb 3 2013 snmpttsystem.log
-rw-r--r-- 1 root root 420 Jan 30 2013 snmpttsystem.log-20130203
-rw-r--r-- 1 root root 0 Nov 3 03:50 snmpttunknown.log
-rw-r--r-- 1 root root 1149 Oct 25 10:12 snmpttunknown.log-20131027
-rw-r--r-- 1 root root 1299 Nov 1 13:40 snmpttunknown.log-20131103

[sreinhardt]

In /etc/snmptt.ini change to these values

Code: Select all

Mode = daemon
daemon_uid = 

Restart snmptt and trapd

Code: Select all

service snmptt stop
service snmptrapd restart
service snmptt start

Then return us the output from these please.

Code: Select all

ps -ef | grep snmp
ll /var/spool/snmptt/

[stratogen_richard]

ps -ef | grep snmp
root 13097 1 0 Oct23 ? 00:06:51 /usr/sbin/snmpd -LS0-6d -Lf /dev/null -p /var/run/snmpd.pid
root 31661 1 0 17:11 ? 00:00:00 /usr/sbin/snmptrapd -Lsd -On -p /var/run/snmptrapd.pid
root 31738 1 0 17:11 ? 00:00:00 /usr/bin/perl /usr/sbin/snmptt --daemon
root 31812 6246 0 17:11 pts/0 00:00:00 grep snmp

ll /var/spool/snmptt/
total 0

[stratogen_richard]

once I updated to that the following appears in the logs when a trap comes in after I see the snmptrapd trap info message:

SNMPTT v1.4beta2 started
There seems to be another SNMPTT process (pid 7244) running.
You may want to kill it and delete the .pid file (/var/run/snmptt.pid). Aborting...

[sreinhardt]

OK, let's do this:

Code: Select all

ps -ef | grep snmp
service snmptt stop
ps -ef | grep snmp
killall snmptt
ps -ef | grep snmp
cat /var/run/snmptt.pid (Hopefully this should not exist.)
ps -ef | grep [PID from previous command]

#Kill any processes that show in that grep if there are any, if not and that pid file exists, remove /var/run/snmptt.pid

service snmptt start

[stratogen_richard]

ps -ef | grep snmp
root 1528 923 0 09:32 pts/0 00:00:00 grep snmp
root 7244 1 0 Nov07 ? 00:00:06 /usr/bin/perl /usr/sbin/snmptt --daemon
root 13097 1 0 Oct23 ? 00:07:09 /usr/sbin/snmpd -LS0-6d -Lf /dev/null -p /var/run/snmpd.pid
root 31661 1 0 Nov07 ? 00:00:03 /usr/sbin/snmptrapd -Lsd -On -p /var/run/snmptrapd.pid

service snmptt stop
Stopping snmptt: [ OK ]

ps -ef | grep snmp
root 1724 923 0 09:32 pts/0 00:00:00 grep snmp
root 13097 1 0 Oct23 ? 00:07:09 /usr/sbin/snmpd -LS0-6d -Lf /dev/null -p /var/run/snmpd.pid
root 31661 1 0 Nov07 ? 00:00:03 /usr/sbin/snmptrapd -Lsd -On -p /var/run/snmptrapd.pid

killall snmptt
snmptt: no process killed

cat /var/run/snmptt.pid
cat: /var/run/snmptt.pid: No such file or directory

service snmptt start
Starting snmptt: [ OK ]

In the logs when a trap is received is the same:
SNMPTT v1.4beta2 started
There seems to be another SNMPTT process (pid 5057) running.
You may want to kill it and delete the .pid file (/var/run/snmptt.pid). Aborting...