oid the same for critical and clear snmp traps

[brudnick]

Hello all

I am working with our infoblox system and receiving traps from it. Unfortunately the oid for the alert and clear are the same. Is there anyway to make Nagios recognize the clear trap to clear the alert?

Below is an example from /var/log/snmptt/snmptt.log

Mon Jun 20 10:46:05 2016 .1.3.6.1.4.1.7779.3.1.1.1.1.2 Critical "Status Events" snmp.trap.ip.com - This trap is generated whenever a software failure is detected. snmp.trap.ip.com 3 Login 58 A GUI login failure has occurred
Mon Jun 20 10:46:09 2016 .1.3.6.1.4.1.7779.3.1.1.1.1.2 Critical "Status Events" snmp.trap.ip.com - This trap is generated whenever a software failure is detected. snmp.trap.ip.com 3 Login 0 SNMP Trap is cleared. GUI Login

[ssax]

You will need to duplicate the trap in /etc/snmp/snmptt.conf and add a MATCH statement to limit it:

Code: Select all

EVENT ibProcessingFailureTrap .1.3.6.1.4.1.7779.3.1.1.1.1.2 "Status Events" Critical
FORMAT This trap is generated whenever a software failure is detected. $*
EXEC /usr/local/bin/snmptraphandling.py "$r" "SNMP Traps" "$s" "$@" "$-*" "This trap is generated whenever a software failure is detected. $*"
MATCH $5: ! (SNMP Trap is cleared)
SDESC
This trap is generated whenever a software failure is detected.
Variables:
  1: ibNodeName
  2: ibTrapSeverity
  3: ibSubsystemName
  4: ibProbableCause
  5: ibTrapDesc
EDESC

Code: Select all

EVENT ibProcessingFailureTrap .1.3.6.1.4.1.7779.3.1.1.1.1.2 "Status Events" Normal
FORMAT This trap is generated whenever a software failure is detected. $*
EXEC /usr/local/bin/snmptraphandling.py "$r" "SNMP Traps" "$s" "$@" "$-*" "This trap is generated whenever a software failure is detected. $*"
MATCH $5: (SNMP Trap is cleared)
SDESC
This trap is generated whenever a software failure is detected.
Variables:
  1: ibNodeName
  2: ibTrapSeverity
  3: ibSubsystemName
  4: ibProbableCause
  5: ibTrapDesc
EDESC

Then restart SNMPTT:

Code: Select all

service snmptt restart

Let us know if that works for you.

[brudnick]

I just made the change to the config file. Just waiting for traps to be sent to verify. Will post once I receive some traps.

[tmcdonald]

Awesome, keep us posted!