Nagios Support Forum

hi,

I have a problem that Nagios didn't classify traps alarm correct, since some system send error alarms but Nagios classify that as normal.


example of these traps:


Sun Jan 18 12:05:30 2015 ERICSSON-SNF-ALARM-MIB::snfAlarmActiveState Normal "Status Events" 10.200.35.54 - This notification reports an active state of an alarm. It mirrors the notification Failed to decode received data. .iso Failed to decode received data. A block of 'TTFILE05-7416.20150111', originating from Mediator, was corrupt (this would have been record #0). The type: CME20R14MSCber.CallDataRecord was probably not set and is not optional The corrupt part of the block is stored as '/var/opt/mediation/MMStorage/NRTDE/CXC1734739_R8B/storage/corrupt/TTFILE05-7416.20150111:0' and will not be re-decoded. processingErrorAlarm corruptData PROCESSING 303 3 07 DF 01 12 0C 05 10 03 2B 02 00 1 10.200.35.13 8
Sun Jan 18 12:05:30 2015 ERICSSON-SNF-ALARM-MIB::snfAlarmActiveState Normal "Status Events" 10.200.35.54 - This notification reports an active state of an alarm. It mirrors the notification Failed to decode received data. .iso Failed to decode received data. A block of 'TTFILE05-7416.20150111', originating from Mediator, was corrupt (this would have been record #0). The type: CME20R14MSCber.CallDataRecord was probably not set and is not optional The corrupt part of the block is stored as '/var/opt/mediation/MMStorage/NRTDE/CXC1734739_R8B/storage/corrupt/TTFILE05-7416.20150111:0' and will not be re-decoded. processingErrorAlarm corruptData PROCESSING 303 3 07 DF 01 12 0C 05 10 03 2B 02 00 1 10.200.35.13 8

thanks,

Lets take a look at the snmptt.conf rules and the mib. Can you attach the two following files to your next post:

Can I suggest you read this post as it might be relevant to your problem:

http://support.nagios.com/forum/viewtop ... 81#p123119

please find the attached

I have a problem that Nagios didn't classify traps alarm correct, since some system send error alarms but Nagios classify that as normal.

You will need to edit the snmptt.conf file and alter the severity of these events to match your personal needs. For example, if you wanted to change this trap to be "Critical", you would change this: to this: Read more on adjusting trap severity here:
http://assets.nagios.com/downloads/nagi ... ios_XI.pdf

To expand on lmiltchev's answer, this post talks about using a MATCH statement:

http://support.nagios.com/forum/viewtop ... 81#p123119

hi

I faced problem like this , suddenly , trap was classified as warning , today is classified as critical:


warning
TrapName smscSiwplmnWarningTrap / trapData (OCTETSTR):%SPL-I-INFO, Number of Rejected Duplicates in past (60 min) interval: 0, Log filename: DUPLOG_SIWPLMN_12_1425263673.LOG, smscSiwplmnName (OCTETSTR):SIWPLMN_12, trapTimeStamp (OCTETSTR): 2-MAR-2015 08:3

critical
TrapName smscSiwplmnWarningTrap / trapData (OCTETSTR):%SPL-I-INFO, Number of Rejected Duplicates in past (60 min) interval: 0, Log filename: DUPLOG_SIWPLMN_11_1425483086.LOG, smscSiwplmnName (OCTETSTR):SIWPLMN_11, trapTimeStamp (OCTETSTR): 4-MAR-2015 16:5

Are you making sure to restart snmptt after making changes? Also, looking over the snmptt.conf it looks like some of your traps that should be critical are still listed as normal.

when I restart snmp, the classification become waring as before, but in snmptt.conf , the traps not classified correct, they are normal for all of them

Please open up the file below:
Check at the bottom for the order in which it will look for the trap definitions, after adding the mibs through the XI interface and selecting process traps, mine shows as:
It may be picking up the processed_mibs one first, did you change it in there as well?

Then execute: