Nagios Support Forum

Posted: **Thu Mar 06, 2014 4:00 am**

Hi guys,

I'm having a trouble where Nagios sends notification by email for the same trap from the same host multiple times in exactly the same intervals - 5 seconds in between. In case of our Juniper routers, Juniper indeed sends same trap when link fails multiple times, but Cisco sends only one trap for interface, yet Nagios sends multiple emails, and they are always 5-6 seconds apart.

So when a link fails, i get 2-7 emails for the same interface.

Is there a way to suppress sending same notification for same OID for the same host so that I could only get

I'm reading both SNMPTT and Nagios documentation, but I couldn't find anything.

The closest thing is setting volatile parameter to 0, but that suppresses sending trap for same interface indefinitely or at least it's cleared.

This is my configuration for the service:

Code: Select all

define service{
   name                    linkDown_trap-service
   use                     generic-service
   register                0
   service_description     linkDown_trap
   is_volatile             1
   check_command           check-host-alive
   flap_detection_enabled  0
   process_perf_data       0
   retain_status_information 0 
   max_check_attempts      1
   normal_check_interval   1
   retry_check_interval    1
   passive_checks_enabled  1
   active_checks_enabled   1 
   check_period            none
   notification_interval   31536000
   contact_groups          admins
}

I would really be thankful for help on this.

Kind Regards

Posted: **Thu Mar 06, 2014 12:16 pm**

Could this be due to the contact group admins? If you look in the service detail history, do you see nagios catching several traps for this? Generally this only happens in a few very select cases, trap spooler not clearing properly, multiple contacts with email addresses that send to same or similar people, or actually receiving multiple traps. If it is truly the third option, there isn't too much that can be done unless you want to modify snmptrapsender.py to respect not sending to nagios the multiple traps.

Posted: **Sat Mar 08, 2014 9:08 am**

Thanks.

It looks like host is indeed sending multiple traps for on event.

I'm running Nagios Core on OpenBSD, and there's no snmptrapsender.py on this host.

snmptt calls submit_check_result which then calls /var/www/var/nagios/rw/nagios.cmd.

Can you suggest a best way to say allow processing of only one trap per host per second? This way I could avoid huge amount of spamming.

Kind regards

Posted: **Sat Mar 08, 2014 1:59 pm**

I discovered duplicate_trap_window in snmptt.ini configuration file. It does exactly what I need, suppresses reporting of same event to Nagios for a configurable amount of time. Can't see how I missed this one.

The snpmtt has to run in daemon mode, which I configured. I also turned on debug because Nagios now wouldn't receive anything from snmptt. This is weird because you can clearly see that EXEC is being called, for example:

OID of received trap: .1.3.6.1.6.3.1.1.5.3. Will attempt to translate to text
Translated to linkDown
EXEC command:/usr/local/libexec/nagios/eventhandlers/submit_check_result "myrouter" "linkDown_trap" "2" "117 up down xe-0/0/2"
Processing file: #snmptt-trap-1394303545458195

Code: Select all

ls -ald /usr/local/libexec/nagios/eventhandlers/submit_check_result
-rwxr-xr-x  1 snmptt  snmptt  1182 Feb 24 14:01 /usr/local/libexec/nagios/eventhandlers/submit_check_result

Could anyone please try and help me out with this?

Posted: **Sun Mar 09, 2014 11:35 am**

Problem solved.

(I'm talking to myself in this thread).

Thanks.

Posted: **Mon Mar 10, 2014 9:38 am**

Sorry we didn't get to you sooner, you caught us on the weekend.

I'll mark this as solved and close the thread now. Feel free to open another if you need help in the future.

Nagios Support Forum

Suppress notification for same SNMP trap

Suppress notification for same SNMP trap

Re: Suppress notification for same SNMP trap

Re: Suppress notification for same SNMP trap

Re: Suppress notification for same SNMP trap

Re: Suppress notification for same SNMP trap

Re: Suppress notification for same SNMP trap