Handling Forwarded SNMP Alerts

[scottwilkerson]

However.. and Nagios XI lacks in this. If you receive one trap with an error and one trap short after clearing or giving another error just the lat trap will be shown. SO passive trap are not a strong part of Nagios. You can install http://labs.nagios.com/2012/01/10/nagio ... available/ which I did and it helped to store all traps in a sql DB to log and show there.

Somewhat true, however the trap will still have sent notifications, be in the event log and in the notification log. I do agree that if you want historical information using a tool like NSTI will give the ability to easily search for and filter specific traps.

[Andreas_c_Schmidt]

So is this sorted? do you see your traps ? or did give up ?

[citpaj]

Been distracted by other work. Not sorted out yet, and certainly not given up. I hope to get back to it this afternoon or tomorrow morning. I will update the posting when I have news for you. Thanks.

[scottwilkerson]

Thanks

[Andreas_c_Schmidt]

In case you get stuck with the NSTI install and config of snmptt, and since there is no real good documentation so far. ...
http://www.solaris-cookbook.com/WP-Cook ... ace-guide/

[slansing]

Thanks for the link Andreas I'm sure that will help if he runs into an issue.

[citpaj]

Using your instructions I was able to get the StruxureWare traps logging to /var/log/snmptt/snmpttunknown.log.

After adding the following to /etc/snmp/snmptt.conf, restarting the three SNMP services and doing the chmod -R 777 /var/spool/snmptt, chmod -R 777 /var/log/snmptt:

# MIB Translation for APC StruxureWare TRAPS
EVENT Error .1.3.6.1.4.1.318.0.740* "Error" Critical
FORMAT The Trap indicates that there is a problem with the Rewrapper $*
EXEC /usr/local/bin/snmptraphandling.py "$r" "SNMP Traps" "$s" "$@" "$-*" "The Trap indicates that there is a problem with the Rewrapper $*"

... I'm not seeing those traps in snmpttunknown.log or /var/log/snmptrapdlog (or the Nagios console).

Can you think of anything else to get this kick-started? Thanks.

[scottwilkerson]

Actually if you have these in /etc/snmp/snmptt.conf you won't see them in snmpttunknown.log, you would see them in
/var/log/snmp/snmptt.log

[Andreas_c_Schmidt]

if you installed / configured NSTI then you wont see them anymore .. they all go into the Mysql database.

Else you should see them and all other with tail -f /var/log/snmptrapdlog.

check with ls -al /var/spool/snmp/ |wc -l .. if you spool dir is not flooded as it happend on my side.

[scottwilkerson]

Very true, thanks for reminding me...