snmp trap sender component

[ss6396]

Short of seeing a trap at the destination, is there a way to verify snmp traps sent by enabling the snmp trap sender component are actually being sent? Are they logged somewhere? Also, what would it take for sent traps to also show up in the notification log?

[slansing]

Traps should be being logged already check the following directory:

Code: Select all

/var/log/snmptt/

As far as a specific trap sender log, I'll need to look into that, not sure if sent traps show up in those logs by default, or at all.

[ss6396]

I'm fairly certain /var/log/snmptt.log is for incoming traps. In any event, the trap I know that was sent is not in that log.

[sreinhardt]

You are correct, snmptt.log is for KNOWN traps, ones that are correctly interpreted by snmptt and snmptrapd. snmpttunknown.log is for traps that are UNKNOWN and are not being interpreted correctly. Are you seeing that trap in the unknown log? I have not been able to find an actual log file for the event handler, however you can run:

Code: Select all

tcpdump -i eth0 port 162

This will show outgoing and incoming snmptraps.

[ss6396]

Yes, the sent traps were in the snmpttunknown.log, that is how I knew traps were being sent because I set the destination back to itself. I know the snmpttunknown.log only displayed incoming traps because the sent traps did not show up there until I turned on the trap receiving component.

[sreinhardt]

Most likely, we just need to add the nagios mibs to your snmptt.conf. Running the following commands should do it. Once it does, please check snmptt.log for new entries from nagios.

Code: Select all

addmib /usr/local/nagiosxi/html/includes/components/snmptrapsender/mibs/NAGIOS-ROOT-MIB.txt
addmib /usr/local/nagiosxi/html/includes/components/snmptrapsender/mibs/NAGIOS-NOTIFY-MIB.txt
service snmptt restart; service snmptrapd restart

[ss6396]

Most likely, we just need to add the nagios mibs to your snmptt.conf. Running the following commands should do it. Once it does, please check snmptt.log for new entries from nagios.

Code: Select all

addmib /usr/local/nagiosxi/html/includes/components/snmptrapsender/mibs/NAGIOS-ROOT-MIB.txt
addmib /usr/local/nagiosxi/html/includes/components/snmptrapsender/mibs/NAGIOS-NOTIFY-MIB.txt
service snmptt restart; service snmptrapd restart

Thanks but I'm not actually concerned about receiving or processing the incoming traps. I'm only concerned about proof that the outgoing traps were generated and sent. We will eventually be sending those traps to a netcool objectserver and the ability to verify a trap was sent will be important. It would be most helpful if outgoing traps were logged somewhere.

[sreinhardt]

Well, them showing in snmpttunknown.log is proof that they were received by snmptrapd and processed by snmptt, and therefore sent by snmptrap sending component. If you wish to have additional logging or something of that nature, I would ask that you submit a feature request to tracker.nagios.com so that you may view its progress. Otherwise you likely can look in the nagios event log for times when global event handlers were executed.