Still having problems getting traps to show up in the XI webpages.
Here is a review of what I have so far..
Versions installed
Code: Select all
$ rpm -qa | grep snmp
php-snmp-5.3.3-27.el6_5.x86_64
net-snmp-utils-5.5-49.el6_5.1.x86_64
net-snmp-libs-5.5-49.el6_5.1.x86_64
net-snmp-perl-5.5-49.el6_5.1.x86_64
snmptt-1.4-0.9.beta2.el6.noarch
net-snmp-5.5-49.el6_5.1.x86_64Code: Select all
$ ls -lva /usr/local/bin | grep -i 'snmp\|addmib'
-rwxr-xr-x 1 root nagios 804 Feb 18 14:41 addmib
-rwxr-xr-x 1 root root 2078 Feb 18 14:41 snmptraphandling.py
-rwxr-xr-x 1 root root 30438 Feb 18 14:41 snmpttconvertmibCode: Select all
$ sudo cat /etc/snmp/snmptrapd.conf
disableAuthorization yes
traphandle default /usr/sbin/snmptthandlerCode: Select all
$ grep -i 'daemon_uid\|mode =' /etc/snmp/snmptt.ini
mode = daemon
description_mode = 0
# A second (child) process will be started as the daemon_uid user so
daemon_uid = snmpttCode: Select all
$ grep -i -m 5 'exec' /etc/snmp/snmptt.conf
#EXEC qpage -f TRAP notifygroup1 "Device reinitialized (coldStart)"
#EXEC qpage -f TRAP notifygroup1 "Device reinitialized (warmStart)"
#EXEC qpage -f TRAP notifygroup1 "Link down on interface $1. Admin state: $2. Operational state: $3"
#EXEC qpage -f TRAP notifygroup1 "Link up on interface $1. Admin state: $2. Operational state: $3"
#EXEC qpage -f TRAP notifygroup1 "SNMP authentication failure"Code: Select all
$ grep -i 'nag' /etc/group
nagios:x:500:nagios,apache,snmptt
nagcmd:x:501:nagios,apache,snmpttCode: Select all
$ grep -i 'snmp' /etc/group
nagios:x:500:nagios,apache,snmptt
nagcmd:x:501:nagios,apache,snmptt
snmptt:x:496:Code: Select all
$ ll /var/log/snmptt/
total 31212
-rw-r--r-- 1 snmptt root 8699898 Mar 26 15:38 snmptt.debug
-rw-r--r-- 1 snmptt root 8708115 Mar 26 03:15 snmptt.debug-20140326
-rw-r--r-- 1 root root 1067351 Mar 26 15:35 snmptthandler.debug
-rw-r--r-- 1 root root 1065975 Mar 26 03:10 snmptthandler.debug-20140326
-rw-rw-r-- 1 snmptt root 1689095 Mar 26 15:35 snmptt.log
-rw-rw-r-- 1 snmptt root 3838760 Mar 9 03:15 snmptt.log-20140309
-rw-rw-r-- 1 snmptt root 3381852 Mar 16 04:45 snmptt.log-20140316
-rw-rw-r-- 1 snmptt root 2576782 Mar 21 14:20 snmptt.log-20140321
-rw-rw-r-- 1 snmptt root 741794 Mar 23 03:30 snmptt.log-20140323
-rw-r--r-- 1 root root 0 Mar 26 03:15 snmpttsystem.log
-rw-r--r-- 1 root root 238 Feb 18 14:41 snmpttsystem.log-20140223
-rw-r--r-- 1 root root 1075 Feb 25 08:38 snmpttsystem.log-20140302
-rw-r--r-- 1 root root 1890 Mar 20 16:40 snmpttsystem.log-20140321
-rw-r--r-- 1 root root 1260 Mar 25 14:44 snmpttsystem.log-20140326
-rw-rw-r-- 1 snmptt root 14073 Mar 25 15:03 snmpttunknown.log
-rw-rw-r-- 1 snmptt root 16675 Mar 9 01:59 snmpttunknown.log-20140309
-rw-rw-r-- 1 snmptt root 41326 Mar 16 03:32 snmpttunknown.log-20140316
-rw-rw-r-- 1 snmptt root 8498 Mar 20 10:30 snmpttunknown.log-20140321
-rw-rw-r-- 1 snmptt root 3826 Mar 23 03:32 snmpttunknown.log-20140323Code: Select all
$ ll -d /var/log/snmptt/
drwxrwxr-x 2 snmptt snmptt 4096 Mar 26 03:15 /var/log/snmptt/Code: Select all
$ ll /var/spool/snmptt/
total 0Code: Select all
$ ll -d /var/spool/snmptt/
drwxrwxr-x 2 snmptt snmptt 4096 Mar 26 15:35 /var/spool/snmptt/Code: Select all
$ sudo snmptrap -v 1 -c public nagios .1.3.6.1.6.3 "" 0 0 coldStart.0
$Code: Select all
$ tail -30 snmptthandler.debug
SNMPTTHANDLER started: Wed Mar 26 15:41:08 2014
s = 1395873668, usec = 127704
s_pad = 1395873668, usec_pad = 127704
Data received:
syslog.ourcompany.com
UDP: [10.14.134.21]:51522->[10.14.134.14]
DISMAN-EVENT-MIB::sysUpTimeInstance 0:0:00:00.00
SNMPv2-MIB::snmpTrapOID.0 SNMPv2-MIB::coldStart
SNMP-COMMUNITY-MIB::snmpTrapAddress.0 10.14.134.21
SNMP-COMMUNITY-MIB::snmpTrapCommunity.0 "public"
SNMPv2-MIB::snmpTrapEnterprise.0 SNMPv2-SMI::snmpModules
$ tail snmptt.log
Wed Mar 26 15:41:05 2014 .1.3.6.1.6.3.1.1.5.1 Normal "Status Events" syslog - Device reinitialized (coldStart)
Wed Mar 26 15:41:08 2014 .1.3.6.1.6.3.1.1.5.1 Normal "Status Events" syslog - Device reinitialized (coldStart)Code: Select all
$ tail -f snmptt.debug
Sleeping for 5 seconds
Sleeping for 5 seconds
Processing file: #snmptt-trap-1395873966150083
Reading trap. Current time: Wed Mar 26 15:46:07 2014
Symbolic trap variable name detected (DISMAN-EVENT-MIB::sysUpTimeInstance). Will attempt to translate to a numerical OID
Translated to .1.3.6.1.2.1.1.3.0
Symbolic trap variable name detected (SNMPv2-MIB::snmpTrapOID.0). Will attempt to translate to a numerical OID
Translated to .1.3.6.1.6.3.1.1.4.1.0
Symbolic trap variable name detected (SNMP-COMMUNITY-MIB::snmpTrapAddress.0). Will attempt to translate to a numerical OID
Translated to .1.3.6.1.6.3.18.1.3.0
Symbolic trap variable name detected (SNMP-COMMUNITY-MIB::snmpTrapCommunity.0). Will attempt to translate to a numerical OID
Translated to .1.3.6.1.6.3.18.1.4.0
Symbolic trap variable name detected (SNMPv2-MIB::snmpTrapEnterprise.0). Will attempt to translate to a numerical OID
Translated to .1.3.6.1.6.3.1.1.4.3.0
Raw trap passed from snmptrapd:
1395873966
syslog.ourcompany.com
UDP: [10.14.134.21]:54350->[10.14.134.14]
DISMAN-EVENT-MIB::sysUpTimeInstance 0:0:00:00.00
SNMPv2-MIB::snmpTrapOID.0 SNMPv2-MIB::coldStart
SNMP-COMMUNITY-MIB::snmpTrapAddress.0 10.14.134.21
SNMP-COMMUNITY-MIB::snmpTrapCommunity.0 "public"
SNMPv2-MIB::snmpTrapEnterprise.0 SNMPv2-SMI::snmpModules
Items passed from snmptrapd:
value 0: syslog.ourcompany.com
value 1: 10.14.134.21
value 2: .1.3.6.1.2.1.1.3.0
value 3: 0:0:00:00.00
value 4: .1.3.6.1.6.3.1.1.4.1.0
value 5: SNMPv2-MIB::coldStart
value 6: .1.3.6.1.6.3.18.1.3.0
value 7: 10.14.134.21
value 8: .1.3.6.1.6.3.18.1.4.0
value 9: public
value 10: .1.3.6.1.6.3.1.1.4.3.0
value 11: SNMPv2-SMI::snmpModules
Symbolic trap variable name detected (SNMPv2-MIB::coldStart). Will attempt to translate to a numerical OID
Translated to .1.3.6.1.6.3.1.1.5.1
Symbolic trap variable name detected (SNMPv2-SMI::snmpModules). Will attempt to translate to a numerical OID
Translated to .1.3.6.1.6.3
Agent IP address (10.14.134.21) is the same as the host IP, so copying the host name: syslog.ourcompany.com
Trap received from syslog.ourcompany.com: SNMPv2-MIB::coldStart
0: hostname
1: ip address
2: uptime
3: trapname / OID
4: ip address from trap agent
5: trap community string
6: enterprise
7: securityEngineID (snmptthandler-embedded required)
8: securityName (snmptthandler-embedded required)
9: contextEngineID (snmptthandler-embedded required)
10: contextName (snmptthandler-embedded required)
0+: passed variables
Value 0: syslog
Value 1: 10.14.134.21
Value 2: 0:0:00:00.00
Value 3: .1.3.6.1.6.3.1.1.5.1
Value 4: 10.14.134.21
Value 5: public
Value 6: .1.3.6.1.6.3
Value 7:
Value 8:
Value 9:
Value 10:
Agent dns name: syslog
Exact match of trap found in EVENT hash table
Working with EVENT entry: .1.3.6.1.6.3.1.1.5.1 => coldStart,Status Events,Normal,
No nodes defined for this entry so all nodes will match
No MATCH entries defined for this entry
Trap defined, processing...
PREEXEC line(s):
FORMAT line:
OID of enterprise: .1.3.6.1.6.3. Will attempt to translate to text
OID found in cache: '.1.3.6.1.6.3' -> 'snmpModules'
Translated to snmpModules
OID of received trap: .1.3.6.1.6.3.1.1.5.1. Will attempt to translate to text
OID found in cache: '.1.3.6.1.6.3.1.1.5.1' -> 'coldStart'
Translated to coldStart
Device reinitialized (coldStart)
.1.3.6.1.6.3.1.1.5.1 Normal "Status Events" syslog - Device reinitialized (coldStart)
EXEC line(s):
EXEC line not defined
Sleeping for 5 seconds
The client machine is already running nrpe client and is registered and showing up in the Nagios XI interface properly.
I have setup the SNMP Traps config for the client, but Nagios show "waiting for traps".
Code: Select all
Host Service Status Duration Attempt Last Check Status Information
syslog SNMP Traps Passive Only Check Ok 1d 3h 30m 38s 1/1 2014-03-25 12:23:56 Waiting for trap...
Thanks,
Loopie
