SNMP help

[costanza2k1]

Hi all,
Need some help in getting SNMP to work in Nagios XI. The traps are making it to my server but just not populating in the event view under 'snmp traps'. Any ideas?

Attaching some info that maybe useful:

Code: Select all

rpm -qa | grep snmp
snmptt-1.4-0.9.beta2.el6.noarch
net-snmp-perl-5.5-49.el6_5.1.x86_64
php-snmp-5.4.25-1.el6.remi.x86_64
net-snmp-utils-5.5-49.el6_5.1.x86_64
net-snmp-libs-5.5-49.el6_5.1.x86_64
net-snmp-5.5-49.el6_5.1.x86_64

Code: Select all

 ls -lva /usr/local/bin | grep -i 'snmp\|addmib'
-rwxr-xr-x   1 root nagios      804 Mar 31 13:49 addmib
-rwxr-xr-x   1 root root       2078 Mar 31 13:49 snmptraphandling.py
-rwxr-xr-x   1 root root      30438 Mar 31 13:49 snmpttconvertmib

Code: Select all

sudo cat /etc/snmp/snmptrapd.conf
disableAuthorization yes
traphandle default /usr/sbin/snmptthandler

Code: Select all

rep -i 'daemon_uid\|mode =' /etc/snmp/snmptt.ini
mode = daemon
description_mode = 0
# A second (child) process will be started as the daemon_uid user so
daemon_uid = snmptt

Code: Select all

grep -i -m 5 'exec' /etc/snmp/snmptt.conf
#EXEC qpage -f TRAP notifygroup1 "Device reinitialized (coldStart)"
#EXEC qpage -f TRAP notifygroup1 "Device reinitialized (warmStart)"
#EXEC qpage -f TRAP notifygroup1 "Link down on interface $1.  Admin state: $2.  Operational state: $3"
#EXEC qpage -f TRAP notifygroup1 "Link up on interface $1.  Admin state: $2.  Operational state: $3"
#EXEC qpage -f TRAP notifygroup1 "SNMP authentication failure"

Code: Select all

grep -i 'nag' /etc/group
nagios:x:10011:nagios,apache,snmptt
nagcmd:x:40060:nagios,apache,snmptt

Code: Select all

grep -i 'snmp' /etc/group
nagios:x:10011:nagios,apache,snmptt
nagcmd:x:40060:nagios,apache,snmptt
snmptt:x:497:

Code: Select all

ll /var/log/snmptt/
total 460
-rw-rw-r-- 1 snmptt root     6407 Apr  2 16:22 snmptt.log
-rw-rw-r-- 1 snmptt snmptt      0 Apr  1 03:45 snmpttsystem.log
-rw-rw-r-- 1 snmptt snmptt    238 Feb 18 13:58 snmpttsystem.log-20140223
-rw-rw-r-- 1 snmptt snmptt    238 Mar 18 14:03 snmpttsystem.log-20140319
-rw-rw-r-- 1 snmptt snmptt    410 Mar 31 13:49 snmpttsystem.log-20140401
-rw-rw-r-- 1 snmptt snmptt  42015 Apr  3 08:50 snmpttunknown.log
-rw-rw-r-- 1 snmptt snmptt  52036 Feb 24 05:33 snmpttunknown.log-20140302
-rw-rw-r-- 1 snmptt snmptt  27749 Mar 19 00:32 snmpttunknown.log-20140319
-rw-rw-r-- 1 snmptt snmptt 109586 Mar 23 00:52 snmpttunknown.log-20140323
-rw-rw-r-- 1 snmptt snmptt 191153 Mar 30 01:27 snmpttunknown.log-2014033

Code: Select all

drwxrwxr-x 2 snmptt snmptt 4096 Apr  1 03:45 /var/log/snmptt/

Code: Select all

ll /var/spool/snmptt/
total 0

Code: Select all

 ll -d /var/spool/snmptt/
drwxrwxr-x 2 snmptt snmptt 4096 Apr  3 08:50 /var/spool/snmptt/

Any other info you may need please let me know...

[sreinhardt]

Well your permissions, config settings, and modify dates look great. Are the traps coming into snmptt.log or snmpttunknown.log? Also if you could run the following command, just so I can make sure that your exec lines are correct.

Code: Select all

grep -i 'exec' /etc/snmp/snmptt.conf | tail -n 10

Also have you checked in Admin->Unconfigured objects for traps that you know should have properly come in? Finally, is this actually an nsti issue or just snmp and XI? If the latter, I am going to move it to XI support, as nsti is a separate product.

[costanza2k1]

Well your permissions, config settings, and modify dates look great. Are the traps coming into snmptt.log or snmpttunknown.log? Also if you could run the following command, just so I can make sure that your exec lines are correct.

Code: Select all

grep -i 'exec' /etc/snmp/snmptt.conf | tail -n 10

Also have you checked in Admin->Unconfigured objects for traps that you know should have properly come in? Finally, is this actually an nsti issue or just snmp and XI? If the latter, I am going to move it to XI support, as nsti is a separate product.

Man I feel like I'm very close here. Traps are making it to snmptt.log and snmpttunknown.log...they just aren't making it to my Nagios XI screen. I checked unconfigured objects and the devices aren't there, I deleted the host + snmp service and resinstalled them...they're still not coming in. I believe this is an XI issue, wrong board :/

Code: Select all

grep -i 'exec' /etc/snmp/snmptt.conf | tail -n 10
#EXEC qpage -f TRAP notifygroup1 "Device reinitialized (coldStart)"
#EXEC qpage -f TRAP notifygroup1 "Device reinitialized (warmStart)"
#EXEC qpage -f TRAP notifygroup1 "Link down on interface $1.  Admin state: $2.  Operational state: $3"
#EXEC qpage -f TRAP notifygroup1 "Link up on interface $1.  Admin state: $2.  Operational state: $3"
#EXEC qpage -f TRAP notifygroup1 "SNMP authentication failure"

[costanza2k1]

Following this post to see if I can resolve the issue with the Exec lines...

http://support.nagios.com/forum/viewtop ... lit=SNMPTT

[sreinhardt]

That is exactly what you are going to want to do, for any of the default traps! Otherwise adding and processing via the web interface or running addmib should add the proper lines for new mibs added. Let me know if you have any troubles.

[costanza2k1]

That is exactly what you are going to want to do, for any of the default traps! Otherwise adding and processing via the web interface or running addmib should add the proper lines for new mibs added. Let me know if you have any troubles.

what I did was add a ton of mibs via command line instead of the web gui...just to speed things up. Should I adding every MIB through the site?

[sreinhardt]

If you wish to add them manually, that is fine. However be sure you are adding them to /usr/share/snmp/mibs/ and run addmib [path/to/mib] to get them to add the proper exec line. If you used something else to add them to the config, I would just touch a new, empty, config and use addmib.

[costanza2k1]

It's working only after I looked at 'unconfigured objects'...I added my server as a passive rec and it's working. The wizard itself is giving me nothing, any clues as to why that's happening?

2014-04-04 11_50_58-Nagios XI.png

[sreinhardt]

This would be due to a hostname mismatch. Your traps are coming in without the fqdn including the hostname, but just the hostname. Your host is configured to use the full fqdn, and since it needs to be an exact match, they will not come into the one created from the wizard.

[costanza2k1]

This would be due to a hostname mismatch. Your traps are coming in without the fqdn including the hostname, but just the hostname. Your host is configured to use the full fqdn, and since it needs to be an exact match, they will not come into the one created from the wizard.

That's bizarre, is there a way to make the traps resolve to a FQDN? Maybe on the Nagios XI server itself?