Did you follow this guide for setting up traps?
https://assets.nagios.com/downloads/nag ... ios_XI.pdf
Take a read through that if you haven't already.
MIB files are used for two things:
1. To translate those long numbered OIDs into friendly names.
2. A place to define SNMP traps.
---
Here's some extra info as well that may help you
---
There are two types of SNMP communication:
Active checks - (snmpwalk/snmpget/SNMP polling) - This is when your XI server reaches out on a specified interval and checks the status of an OID.
Passive checks - (SNMP Traps) - Your remote device sends the trap as soon as it detects it (XI has no idea when this will happen and doesn't actively poll)
This is the general flow of how SNMP traps work:
Device -> XI Server -> snmptrapd -> snmptt -> Nagios XI
Here's how it works in greater detail:
1. The device sends a SNMP trap with say an OID of .1.3.6.1.6.3.1.1.5.1 to the Nagios XI server.
2. The snmptrapd service receives the trap and then runs the default handler for traps (in this case SNMPTT)
- Taken from
/etc/snmp/snmptrapd.conf
Code: Select all
traphandle default /usr/sbin/snmptthandler
3. SNMPTT reads the trap and does some processing on it based on it's configuration (translate IP of sender into DNS name, strip domain, all configurable in
/etc/snmp/snmptt.ini).
4. SNMPTT doesn't know anything about the traps in your MIB files, the MIB files on the system are just used for translation from .1.3.6.1.6.3.1.1.5.1 into coldStart. You need to process the MIB file that contains your traps to get them into the
/etc/snmp/snmptt.conf file which SNMPTT reads to match against to see if it should do anything with it (.1.3.6.1.6.3.1.1.5.1).
5. Since you've run addmib on the MIB file containing your traps (in this case /usr/share/snmp/mibs/SNMPv2-MIB.txt) it processes the trap and puts it into a format SNMPTT understands and changes the EXEC line (see below) to execute the
/usr/local/bin/snmptraphandling.py script (that's what puts it into Nagios).
Code: Select all
EVENT coldStart .1.3.6.1.6.3.1.1.5.1 "Status Events" Critical
FORMAT A coldStart trap signifies that the SNMP entity, $*
EXEC /usr/local/bin/snmptraphandling.py "$r" "SNMP Traps" "$s" "$@" "$-*" "A coldStart trap signifies that the SNMP entity, $*"
SDESC
A coldStart trap signifies that the SNMP entity,
supporting a notification originator application, is
reinitializing itself and that its configuration may
have been altered.
Variables:
EDESC
So SNMPTT says "Hey, I received a trap with OID .1.3.6.1.6.3.1.1.5.1, do I know anything about it? Let me check my
/etc/snmp/snmptt.conf file. Oh, I see it matches the coldStart event (from above EVENT line) and it's set as Critical (from above event line, can be Normal,Warning,Critical), I will run this EXEC line now (which happens to put it into Nagios)."
You can read more about SNMPTT and what those lines mean (and how you can change them if you want) here:
http://snmptt.sourceforge.net/docs/snmptt.shtml