'UNKNOWN' Host within snmptt.log

[kcarlson]

Hello, I will try this and report back. My concern is that I now have multiple traps and hosts that are showing as 'unknown'. If this fix corrects my issue, will I need to then go in and edit each trap? These have previously worked fine before.

Thanks!

[ssax]

Please try this:

Stop snmptt:

Code: Select all

service snmptt stop

Then send in a trap to replicate the (null) and once you've sent it, send me the trap file from this directory:

/var/spool/snmptt.

Then once you're done, start snmptt back up again:

Code: Select all

service snmptt start

Then do this as well:

Edit your /etc/snmp/snmptt.ini and set:

Code: Select all

DEBUGGING = 2

Then restart snmptt:

Code: Select all

service snmptt restart

Then submit one of the traps that say (null) and after that send me this file:

Code: Select all

/var/log/snmptt/snmptt.debug

Then disable debugging (set it to 0) and restart the service.

If that doesn't provide any details, please create a ticket for this and include a link back to this forum thread so we can get a remote session setup:

https://support.nagios.com/tickets/

Thank you!

[ssax]

In addition to my previous post, please try editing this file:

Code: Select all

/usr/sbin/snmptt

Change line 3291 from this:

Code: Select all

if ($tempvar[0] =~ /<UNKNOWN>/) {

To this:

Code: Select all

if ($tempvar[0] =~ /UNKNOWN/) {

See if that resolves it.

Taken from here:

https://sourceforge.net/p/snmptt/bugs/46/

[kcarlson]

Hello,

I have sent PM's with attachments you had requested. I then edited line 3291 in /usr/sbin/snmptt to the changes you had posted. I then restarted snmptt and sent a test trap. The test trap continues to show UNKNOWN as host in snmptt.log.

Thanks

[ssax]

EDIT: I think this is likely failing because DNS is not working and the $r in the EXEC line requires it.

Does this command work with one of the hosts where it's showing as UNKNOWN?
- Change X.X.X.X. to the IP of the sending device

Code: Select all

nslookup X.X.X.X

Try changing the trap EXEC line where it shows $r and change it to $aA to see if that resolves it for one of them:

From:

Code: Select all

EXEC /usr/local/bin/snmptraphandling.py "$r" "SNMP Traps" "$s" "$@" "$-*" "Critical alarms are sent for service affecting $*"

To:

Code: Select all

EXEC /usr/local/bin/snmptraphandling.py "$aA" "SNMP Traps" "$s" "$@" "$-*" "Critical alarms are sent for service affecting $*"

Restart SNMPTT and then test again with the trap you modified:

Code: Select all

systemctl restart snmptt

If that doesn't resolve it, please create a ticket for this and include a link back to this forum thread so we can get a remote session setup:

https://support.nagios.com/tickets/

[kcarlson]

Hello

I apologize for the long delay in getting this tested.

When performing a nslookup on that host I receive a:

** server can't find X.X.X.X.in-addr.arpa: REFUSED

When performing a nslookup against google it is successful.

I edited the particular trap I am using to test in /etc/snmp/snmptt.conf. I then restarted snmptt and went back to my device to send a test trap. The trap is still appearing in /var/log/snmptt/snmptt.log as 'UNKNOWN' but I am now receiving email notifications that a test trap was sent from that host.

Thanks!

[ssax]

Please create a ticket for this and include a link back to this forum thread so we can get a remote session setup:

https://support.nagios.com/tickets/

Thank you!