Page 1 of 1

snmp trap sender component

Posted: Wed Mar 19, 2014 1:04 pm
by ss6396
Short of seeing a trap at the destination, is there a way to verify snmp traps sent by enabling the snmp trap sender component are actually being sent? Are they logged somewhere? Also, what would it take for sent traps to also show up in the notification log?

Re: snmp trap sender component

Posted: Wed Mar 19, 2014 1:40 pm
by slansing
Traps should be being logged already check the following directory:

Code: Select all

/var/log/snmptt/
As far as a specific trap sender log, I'll need to look into that, not sure if sent traps show up in those logs by default, or at all.

Re: snmp trap sender component

Posted: Wed Mar 19, 2014 3:32 pm
by ss6396
I'm fairly certain /var/log/snmptt.log is for incoming traps. In any event, the trap I know that was sent is not in that log.

Re: snmp trap sender component

Posted: Wed Mar 19, 2014 4:41 pm
by sreinhardt
You are correct, snmptt.log is for KNOWN traps, ones that are correctly interpreted by snmptt and snmptrapd. snmpttunknown.log is for traps that are UNKNOWN and are not being interpreted correctly. Are you seeing that trap in the unknown log? I have not been able to find an actual log file for the event handler, however you can run:

Code: Select all

tcpdump -i eth0 port 162
This will show outgoing and incoming snmptraps.

Re: snmp trap sender component

Posted: Thu Mar 20, 2014 8:45 am
by ss6396
Yes, the sent traps were in the snmpttunknown.log, that is how I knew traps were being sent because I set the destination back to itself. I know the snmpttunknown.log only displayed incoming traps because the sent traps did not show up there until I turned on the trap receiving component.

Re: snmp trap sender component

Posted: Thu Mar 20, 2014 10:14 am
by sreinhardt
Most likely, we just need to add the nagios mibs to your snmptt.conf. Running the following commands should do it. Once it does, please check snmptt.log for new entries from nagios.

Code: Select all

addmib /usr/local/nagiosxi/html/includes/components/snmptrapsender/mibs/NAGIOS-ROOT-MIB.txt
addmib /usr/local/nagiosxi/html/includes/components/snmptrapsender/mibs/NAGIOS-NOTIFY-MIB.txt
service snmptt restart; service snmptrapd restart

Re: snmp trap sender component

Posted: Thu Mar 20, 2014 11:10 am
by ss6396
sreinhardt wrote:Most likely, we just need to add the nagios mibs to your snmptt.conf. Running the following commands should do it. Once it does, please check snmptt.log for new entries from nagios.

Code: Select all

addmib /usr/local/nagiosxi/html/includes/components/snmptrapsender/mibs/NAGIOS-ROOT-MIB.txt
addmib /usr/local/nagiosxi/html/includes/components/snmptrapsender/mibs/NAGIOS-NOTIFY-MIB.txt
service snmptt restart; service snmptrapd restart
Thanks but I'm not actually concerned about receiving or processing the incoming traps. I'm only concerned about proof that the outgoing traps were generated and sent. We will eventually be sending those traps to a netcool objectserver and the ability to verify a trap was sent will be important. It would be most helpful if outgoing traps were logged somewhere.

Re: snmp trap sender component

Posted: Thu Mar 20, 2014 11:21 am
by sreinhardt
Well, them showing in snmpttunknown.log is proof that they were received by snmptrapd and processed by snmptt, and therefore sent by snmptrap sending component. If you wish to have additional logging or something of that nature, I would ask that you submit a feature request to tracker.nagios.com so that you may view its progress. Otherwise you likely can look in the nagios event log for times when global event handlers were executed.