Page 3 of 6

Re: recieving SNMP traps

Posted: Wed Aug 21, 2013 9:45 am
by benhank
benhank wrote:sreinhardt"] lso I should ask, is that actually the snmp string you have setup in snmpd.conf?
Ummm heh heh...whatyoutalkinboutwillis?


I looked into the /var/*/spool/ dir and the files were there.
looking good! the only other issue is that the server now shows up in the unconfigured objects list, and the server is listed without the "domain.org"
which is different from the name nagios displays.
I get the feeling that I have to re add the server, but how is that done?
is it
passive check wiz ->traps wiz?
Is there anything in the nagiosxi gui that I have to configure so nagios will receive the incoming trap data?
Sorry for the additional questions bro,but I already must have missed something, and I cant screw this up when I set up my prod svr..

Re: recieving SNMP traps

Posted: Wed Aug 21, 2013 10:40 am
by sreinhardt
Actually if you look in the snmptt.ini, your file is set to strip domains, iirc. Remove that option and it should leave your domain on. of course... restart services, and see if it starts coming into the trap service correctly. Glad to hear we are really making progress now! I'm not sure what it is about snmp traps, but when they cause trouble it is usually big issues for silly reasons, like the daemon deciding to run as root instead of snmptt...

As for the community string, you had one that I might put in on a testing machine :D and the actually do need to match to send traps correctly. So if you already had your actual internal one setup, it was probably ignoring the test traps.

Re: recieving SNMP traps

Posted: Wed Aug 21, 2013 11:06 am
by benhank
hey man thanks for the patience.
I'll make that change to the ini, but should I add the svr using the passive check wiz and then the traps wiz?
I have the same community strings (why count the geniuses just call it a password..._)
here is an example of the file in the snmptt spool dir:

Code: Select all

1377097615
lkennagiosp03.domain.org
UDP: [172.22.x.x]:47470->[172.22.3.17]
.1.3.6.1.2.1.1.3.0 139:17:43:40.50
.1.3.6.1.6.3.1.1.4.1.0 .1.3.6.1.4.1.2021.13.990.0.17
.1.3.6.1.2.1.1.6.0 "Here"
.1.3.6.1.6.3.18.1.3.0 172.22.x.x
.1.3.6.1.6.3.18.1.4.0 "public"
.1.3.6.1.6.3.1.1.4.3.0 .1.3.6.1.4.1.2021.13.990
These are coming in even without me manually sending the traps.
However I have another server which has constantly been sending traps but they aren't arriving anymore.

Re: recieving SNMP traps

Posted: Wed Aug 21, 2013 11:17 am
by sreinhardt
That's what we're here for, or so I'm told! But as always you are certainly welcome!
Right, password, such a novel idea!

You should only need to add via the trap wizard, it will automatically create the passive service and name it snmp traps.
Are the other ones not coming into unconfigured objects, to the service, or both?
Let's ll that spool dir again and make sure the permissions stuck, if this same one keeps coming in, its likely that snmptt doesn't have rights to remove the spool file\entry.

Code: Select all

ll /var/spool/snmptt/

Re: recieving SNMP traps

Posted: Wed Aug 21, 2013 2:34 pm
by benhank
say what?

Code: Select all

]# ll /var/spool/snmptt/
total 0
[root@LkennagiosT01 ~]#

guess what? I just ran this:

Code: Select all

net-snmp-config --default-mibdirs
and it returned this:

Code: Select all

[root@LkennagiosT01 ~]# net-snmp-config --default-mibdirs
/root/.snmp/mibs:/usr/local/share/snmp/mibs
[root@LkennagiosT01 ~]#
but I dumped all my mibs here:

Code: Select all

usr/share/snmp/nibs
before I do anything else, is this something that has to be changed?

the nagios doc says to use the /snmp/mibs dir, what should I do?

Re: recieving SNMP traps

Posted: Thu Aug 22, 2013 10:53 am
by sreinhardt
The mibdirs are just fine, snmptt and trapd know where to look for them. It is however, strange that you have nothing in the spool directory. Maybe try su-ing into the snmptt user and touch a file in /var/spool/snmptt/.

Re: recieving SNMP traps

Posted: Thu Aug 22, 2013 11:09 am
by benhank
i think I know what happened. There was an snmp update...

Re: recieving SNMP traps

Posted: Thu Aug 22, 2013 11:15 am
by sreinhardt
for net-snmp stuff, or one of the daemons? Either way, interesting and something that we at nagios should look into if it causes issues.

Re: recieving SNMP traps

Posted: Thu Aug 22, 2013 11:32 am
by benhank
these ones >sigh< I am such an idiot.... at least It's my test server...

Capture.JPG

I just checked that /usr/local/share/snmp/ folder does not exist on my servers that have not been updated.

I forgot to mention...my addmib command is gone ... >busts out crying< >loud wailing sounds of chewbacca in pain reverberate in IT dept ...<

Re: recieving SNMP traps

Posted: Thu Aug 22, 2013 1:23 pm
by sreinhardt
QOTD!!
>busts out crying< >loud wailing sounds of chewbacca in pain reverberate in IT dept ...<
I just checked with nscott, the resident master of snmp things, and addmib may come with our snmptt rpm, however the /usr/share/snmp is definitely an net-snmp thing. We may have to look at where to alter the /etc/snmp files to work with this change. Let's just make sure the specific snmptt rpm is still the same.

Code: Select all

rpm -qa | grep snmptt
Should return:
snmptt-1.3-3.nagios.noarch