trouble importing SNMPv2-SMI MIB

[RikLijkendijk]

Hi There,

We have devices that are monitored in a special way through kiwi syslog server.
When an even occurs, kiwi sends out an snmp trap to the Nagios XI server.
Kiwi uses a special oid for which they provide a mib-file. We have uploaded the mibfile (and used addmib) and we see that is is added to snmptt.conf
We have also added the dependent MIB files:

IMPORTS
enterprises FROM RFC1155-SMI
OBJECT-TYPE FROM RFC1155-SMI
DisplayString FROM RFC1213-MIB

;

We can see the trap arriving as an unknown trap in nsti on the xi server with this TrapOID:

SNMPv2-SMI::enterprises.20580.69

We have also added the SNMPv2-SMI MIBfile, but although it is added there is an error/warning:

Unknown object identifier: SNMPv2-SMI::

We have created a service for snmp trap listening for the host, but cannot get the traps to be recognized.

I have tried to find a solution by searching the internet, but i have not been able to find one.

This is a very important issue for us, please help us.

Thanks in advance,

Rik Lijkendijk
Detron ICT

[sreinhardt]

Most likely this is an issue translating the oid to the proper shortname. Could you post your /etc/snmp/snmptt.ini and /etc/snmp/snmptrapd.conf files?

[RikLijkendijk]

Hello,

Thanks for your reply and sorry for not reacting sooner.
We are in the middle of implementation, and things have been rather hectic this week.

Below are the contents of the files snmptrapd.conf and snmptt.ini.

I will be out of office next week, and will not be able to check your replys, but i will check them on my return.

Your help is very much appreciated!!!!

Kind Regards,

Rik Lijkendijk
Detron ICT
[email protected]

My snmptrapd.conf:

disableAuthorization yes
traphandle default /usr/sbin/snmptthandler

My snmptt.ini (All comment-lines removed)

snmptt_system_name =
mode = daemon
multiple_event = 1
dns_enable = 0
strip_domain = 0
strip_domain_list = <<END
domain.com
END
resolve_value_ip_addresses = 0
net_snmp_perl_enable = 0
net_snmp_perl_cache_enable = 1
net_snmp_perl_best_guess = 0
translate_log_trap_oid = 0
translate_value_oids = 1
translate_enterprise_oid_format = 1
translate_trap_oid_format = 1
translate_varname_oid_format = 1
translate_integers = 1
wildcard_expansion_separator = " "
allow_unsafe_regex = 0
remove_backslash_from_quotes = 0
dynamic_nodes = 0
description_mode = 0
description_clean = 1
threads_enable = 0
threads_max = 10
[DaemonMode]
daemon_fork = 1
daemon_uid = snmptt
pid_file = /var/run/snmptt.pid
spool_directory = /var/spool/snmptt/
sleep = 5
use_trap_time = 1
keep_unlogged_traps = 1
duplicate_trap_window = 0
stdout_enable = 0
log_enable = 1
log_file = /var/log/snmptt/snmptt.log
log_system_enable = 1
log_system_file = /var/log/snmptt/snmpttsystem.log
unknown_trap_log_enable = 1
unknown_trap_log_file = /var/log/snmptt/snmpttunknown.log
statistics_interval = 0
syslog_enable = 1
syslog_facility = local0
syslog_level_debug = <<END
END
syslog_level_info = <<END
END
syslog_level_notice = <<END
END
syslog_level_warning = <<END
END
syslog_level_err = <<END
END
syslog_level_crit = <<END
END
syslog_level_alert = <<END
END

syslog_level = warning
syslog_system_enable = 1
syslog_system_facility = local0
syslog_system_level = warning

[SQL]
db_translate_enterprise = 0
db_unknown_trap_format = '$-*'
sql_custom_columns = <<END
END
sql_custom_columns_unknown = <<END
END
mysql_dbi_enable = 1
mysql_dbi_host = localhost
mysql_dbi_port = 3306
mysql_dbi_database = snmptt
mysql_dbi_table = snmptt
mysql_dbi_table_unknown = snmptt_unknown
mysql_dbi_table_statistics =
mysql_dbi_username = snmptt
mysql_dbi_password = (redacted out)
mysql_ping_on_insert = 1
mysql_ping_interval = 300
postgresql_dbi_enable = 0
postgresql_dbi_module = 0
postgresql_dbi_hostport_enable = 0
postgresql_dbi_host = localhost
postgresql_dbi_port = 5432
postgresql_dbi_database = snmptt
postgresql_dbi_table_unknown = snmptt_unknown
postgresql_dbi_table_statistics =
postgresql_dbi_table = snmptt
postgresql_dbi_username = snmpttuser
postgresql_dbi_password = password
postgresql_ping_on_insert = 1
postgresql_ping_interval = 300
dbd_odbc_enable = 0
dbd_odbc_dsn = snmptt
dbd_odbc_table = snmptt
dbd_odbc_table_unknown = snmptt_unknown
dbd_odbc_table_statistics =
dbd_odbc_username = snmptt
dbd_odbc_password = password
dbd_odbc_ping_on_insert = 1
dbd_odbc_ping_interval = 300

[Exec]
exec_enable = 1
pre_exec_enable = 1
unknown_trap_exec =
unknown_trap_exec_format =
exec_escape = 1

[Debugging]
DEBUGGING = 0
DEBUGGING_FILE =
DEBUGGING_FILE_HANDLER =

[TrapFiles]
snmptt_conf_files = <<END
/usr/share/snmp/mibs/processed_mibs/KIWI-ENTERPRISES-MIB.txt
/etc/snmp/snmptt.conf
END

[sreinhardt]

Not a problem on the delays at all, totally understandable. So it looks like you've got everything setup correctly, and since you are getting them in unknown we can ignore checking file permissions. I think we are having a pretty simple issue where we just need to alter a few quick things.

If you have /etc/sysconfig/snmptrapd, change the following lines to include -On:

Code: Select all

# snmptrapd command line options
OPTIONS="-On -Lsd -p /var/run/snmptrapd.pid"

You might also want\need to change it in /etc/init.d/snmptrapd on the same options line:

Code: Select all

# snmptrapd command line options
OPTIONS="-On -Lsd -p /var/run/snmptrapd.pid"

This will cause snmptrapd to output full numeric oid's instead of trying to interpret them for snmptt. I think the only other change you will need to make is to snmptt.ini to enable net_snmp_perl_enable.

Code: Select all

net_snmp_perl_enable = 1

Restart both your daemons, and see if that resolves the issues, and puts the traps in snmptt.log now.

Code: Select all

service snmptt restart; service snmptrapd restart;

[RikLijkendijk]

Hi Spenser,

Thanks for your reply and suggestions.
After a short vacation i am picking up where i left off.

I have made the changes and restarted the services.
Like you said the OID's are now full numeric, but unfortunately the traps are still unknown.

Do you have any other suggestions?

Kind Regards,

Rik Lijkendijk

[sreinhardt]

Could you post a sample of the traps that are showing in unknown, as well as your /etc/snmp/snmptt.conf file?

[RikLijkendijk]

Hello Spenser,

These are the latest two unknown traps as they appear in snmpttunknown.log

Thu Mar 27 00:06:14 2014: Unknown trap (.1.3.6.1.4.1.20580.69) received from 13.204.232.32 at:
Value 0: 13.204.232.32
Value 1: 13.204.232.32
Value 2: 833050367
Value 3: .1.3.6.1.4.1.20580.69
Value 4: 13.204.232.32
Value 5:
Value 6:
Value 7:
Value 8:
Value 9:
Value 10:
Ent Value 0: .1.3.6.1.4.1.20580.69.181=Success: PCC01 - DISKBACKUP O.K. on PCC01


Thu Mar 27 01:49:39 2014: Unknown trap (.1.3.6.1.4.1.20580.69) received from 13.204.232.32 at:
Value 0: 13.204.232.32
Value 1: 13.204.232.32
Value 2: 833670889
Value 3: .1.3.6.1.4.1.20580.69
Value 4: 13.204.232.32
Value 5:
Value 6:
Value 7:
Value 8:
Value 9:
Value 10:
Ent Value 0: .1.3.6.1.4.1.20580.69.181=Success: SABRE - DISKBACKUP O.K. on Sabre

This is the content of snmptt.conf

#
EVENT authenticationFailure .1.3.6.1.6.3.1.1.5.5 "Status Events" Normal
FORMAT SNMP athentication failure
#EXEC qpage -f TRAP notifygroup1 "SNMP authentication failure"
SDESC
An authenticationFailure trap signifies that the SNMPv2
entity, acting in an agent role, has received a protocol
message that is not properly authenticated. While all
implementations of the SNMPv2 must be capable of generating
this trap, the snmpEnableAuthenTraps object indicates
whether this trap will be generated.
EDESC

#
MIB: RFC1155-SMI (file:./RFC1155-SMI.txt) converted on Mon Mar 10 13:12:12 2014 using snmpttconvertmib v1.3
#
MIB: RFC1213-MIB (file:./RFC1213-MIB.txt) converted on Mon Mar 10 13:12:35 2014 using snmpttconvertmib v1.3
#
MIB: RFC-1215 (file:./RFC-1215.txt) converted on Mon Mar 10 13:12:46 2014 using snmpttconvertmib v1.3
#
MIB: SNMPv2-SMI (file:./SNMPv2-SMI.txt) converted on Mon Mar 10 13:16:22 2014 using snmpttconvertmib v1.3
#
MIB: HOST-RESOURCES-MIB (file:/usr/share/snmp/mibs/HOST-RESOURCES-MIB.txt) converted on Mon Mar 10 15:15:10 2014 using snmpttconvertmib v1.3
#
MIB: KIWI-ENTERPRISES-MIB (file:/usr/share/snmp/mibs/KIWI-ENTERPRISES-MIB.txt) converted on Mon Mar 24 11:42:36 2014 using snmpttconvertmib v1.3
#
EVENT kiwiTrap .1.3.6.1.4.1.20580.69.0.1 "Status Events" Normal
FORMAT This trap is sent by Kiwi Syslog Daemon 'Send SNMP Trap' Action. $*
EXEC /usr/local/bin/snmptraphandling.py "$r" "SNMP Traps" "$s" "$@" "$-*" "This trap is sent by Kiwi Syslog Daemon 'Send SNMP Trap' Action. $*"
SDESC
This trap is sent by Kiwi Syslog Daemon 'Send SNMP Trap' Action.
Variables:
1: TrapData
EDESC

Thanks for your help, we really need this.

Greetings,

Rik Lijkendijk

[lmiltchev]

Can you run the following commands and show the output?

Code: Select all

grep snmptt /etc/passwd
grep snmptt /etc/group

[RikLijkendijk]

grep snmptt /etc/passwd :

snmptt497:497:SNMP Trap Translator:/var/spool/snmptt:/sbin/nologin

grep snmptt /etc/group :

nagios500:nagios,apache,snmptt
nagcmd501:nagios,apache,snmptt
snmptt497:

[slansing]

What are you trying to check with those traps? It looks like disk backup checks, is that part of the kiwi log server's mib? Was there only one mib that they gave you for these traps?