Page 1 of 1

Nagios XI wrong SNMP traps from previously compiled MIBS

Posted: Fri Aug 07, 2015 12:48 pm
by tmedinc
ProactiveNet doesn't parse SNMP traps from previously compiled MIBS

Description of the issue:

Code: Select all

The definition in the map file is derived from what is defined in the NAGIOS-NOTIFY-MIB and NAGIOS-ROOT-MIB and dependent MIBS (SNMPv2-SMI, SNMPv2-TC) - see import sections in each MIB (extracted below)

		 =========================
		 NAGIOS-NOTIFY-MIB DEFINITIONS ::= BEGIN
		   IMPORTS
		 		 MODULE-IDENTITY, OBJECT-TYPE,  NOTIFICATION-TYPE,
		 		 Integer32
		 		   FROM SNMPv2-SMI
		 		 nagios,NotifyType,HostStateID,HostStateType,ServiceStateID
		 		   FROM NAGIOS-ROOT-MIB;
		 		   
		 -------------------->

		 NAGIOS-ROOT-MIB DEFINITIONS ::= BEGIN
		 IMPORTS
		   MODULE-IDENTITY,  enterprises 
		 		 FROM SNMPv2-SMI
		   TEXTUAL-CONVENTION
		 		 FROM SNMPv2-TC;
		 =========================

Based on MIB definitions, following CLASS mapping/definition is derived.

		 =========================
		 CLASS SNMP_nHostNotify
		 $TrapOID equals /^1\.3\.6\.1\.4\.1\.20006\.1\.6($|\.)/
		 snmpv_nHostNotifyType = GetListElem ($var, 0)
		 snmpv_nHostNotifyNum = GetListElem ($var, 1)
		 snmpv_nHostAckAuthor = GetListElem ($var, 2)
		 snmpv_nHostAckComment = GetListElem ($var, 3)
		 snmpv_nHostname = GetListElem ($var, 4)
		 snmpv_nHostStateID = GetListElem ($var, 5)
		 snmpv_nHostAttempt = GetListElem ($var, 6)
		 snmpv_nHostGroupName = GetListElem ($var, 7)
		 snmpv_nHostLastCheck = GetListElem ($var, 8)
		 snmpv_nHostLastChange = GetListElem ($var, 9)
		 snmpv_nHostOutput = GetListElem ($var, 10)
		 snmpi_nHostNotifyType = GetListElem ($idx, 0)
		 snmpi_nHostNotifyNum = GetListElem ($idx, 1)
		 snmpi_nHostAckAuthor = GetListElem ($idx, 2)
		 snmpi_nHostAckComment = GetListElem ($idx, 3)
		 snmpi_nHostname = GetListElem ($idx, 4)
		 snmpi_nHostStateID = GetListElem ($idx, 5)
		 snmpi_nHostAttempt = GetListElem ($idx, 6)
		 snmpi_nHostGroupName = GetListElem ($idx, 7)
		 snmpi_nHostLastCheck = GetListElem ($idx, 8)
		 snmpi_nHostLastChange = GetListElem ($idx, 9)
		 snmpi_nHostOutput = GetListElem ($idx, 10)
		 END
		 =========================

The "snmpv_" means value is assigned from var binding array 
		 e.g.:
		 In the below, the snmpv_nHostNotifyType slot will be assigned the value at 0 position from the array of var bindings ($var, 0)
		 		 snmpv_nHostNotifyType = GetListElem ($var, 0)

		 
The "snmpi_" means value is assigned from var binding array 
		 e.g.:
		 In the below, the snmpi_nHostNotifyType slot will be assigned the value at 0 position from the array of index ($idx, 0)
		 		 snmpi_nHostNotifyType = GetListElem ($idx, 0)


When you see "snmpi_nHostname=['__NO_INDEX__'];" - it means the index value is not there in the idx array in the trap itself.
You should see something similar to below in the mcxa.trace logs in the parsed trap.

		 =========================
		 'idx' => [
		 		 		 		 [
		 		 		 		 '__NO_INDEX__'
		 		 		 		 ],
		 		 		 		 [
		 		 		 		 '__NO_INDEX__'
		 		 		 		 ],
		 		 		 		 [
		 		 		 		 '__NO_INDEX__'
		 		 		 		 ]
		 		 		 ],
		 =========================
		 

The NAGIOS-NOTIFY-MIB suggests that their is a configuration file containing the information we do not see being passed to the map file.

nSvcHostname      OBJECT-TYPE
  SYNTAX          OCTET STRING
  MAX-ACCESS      read-only
  STATUS          current
  DESCRIPTION
    "Hostname as specified in the Nagios configuration file."
  ::= { nagiosSvcEventEntry 2 }

nSvcHostAlias     OBJECT-TYPE
  SYNTAX          OCTET STRING
  MAX-ACCESS      read-only
  STATUS          current
  DESCRIPTION
    "The host alias as specified in the Nagios configuration file"
  ::= { nagiosSvcEventEntry 3 }

To what configuration file is the NAGIOS-NOTIFY-MIB file refering?

Re: Nagios XI wrong SNMP traps from previously compiled MIBS

Posted: Fri Aug 07, 2015 1:47 pm
by ssax
I apologize, but I'm not sure exactly what you're asking.

Are you trying to do this:

XI Server -> (SNMP Trap) -> ProactiveNet

And ProactiveNet is unable to parse the trap?

Is the classmap specific to ProactiveNet (sorry, I've never heard of it).

Did you have to manually create the class map or did you import the MIBs through the ProactiveNet interface?

Have you also reached out to ProactiveNet to see if they have any ideas?

Re: Nagios XI wrong SNMP traps from previously compiled MIBS

Posted: Tue Aug 11, 2015 2:08 pm
by tmedinc
ssax wrote:I apologize, but I'm not sure exactly what you're asking.

Are you trying to do this:

XI Server -> (SNMP Trap) -> ProactiveNet

And ProactiveNet is unable to parse the trap?

Is the classmap specific to ProactiveNet (sorry, I've never heard of it).

Did you have to manually create the class map or did you import the MIBs through the ProactiveNet interface?

Have you also reached out to ProactiveNet to see if they have any ideas?
Yes, the intention is XI Server -> (SNMP Trap) -> ProactiveNet.

ProactiveNet receive the snmp trap OK, but the trap doesn't came out as the MIB defines it.

The MIB is compiled in proactivenet. It get parsed but for instance, the host name of the snmptrap that was alerted doesn't appear in the correct tag.

"snmpi_nHostname=['__NO_INDEX__']"

So the question is, is there a configuration file(format) that defines the snmp trap that nagios xi send?

We ask BMC for help on this issue and they asked us what I'm posting on this thread.

Regards.

Re: Nagios XI wrong SNMP traps from previously compiled MIBS

Posted: Tue Aug 11, 2015 4:31 pm
by ssax
Looking at the code this is how the trapsender component sends them:

For Hosts:

Code: Select all

$trap_command = "/usr/bin/snmptrap -v 2c -c $community $tcp$address$port '' NAGIOS-NOTIFY-MIB::nHostEvent nHostname s \"%host%\" nHostStateID i %hoststateid% nHostOutput s \"%hostoutput%\"";
For Services:

Code: Select all

$trap_command = "/usr/bin/snmptrap -v 2c -c $community $tcp$address$port '' NAGIOS-NOTIFY-MIB::nSvcEvent nSvcHostname s \"%host%\" nSvcDesc s \"%service%\" nSvcStateID i %servicestateid% nSvcOutput s \"%serviceoutput%\"";
Is that what you're looking for? It's just an snmptrap command so it should follow the standard snmp format.