Page 1 of 1

oid the same for critical and clear snmp traps

Posted: Mon Jun 20, 2016 12:41 pm
by brudnick
Hello all

I am working with our infoblox system and receiving traps from it. Unfortunately the oid for the alert and clear are the same. Is there anyway to make Nagios recognize the clear trap to clear the alert?

Below is an example from /var/log/snmptt/snmptt.log

Mon Jun 20 10:46:05 2016 .1.3.6.1.4.1.7779.3.1.1.1.1.2 Critical "Status Events" snmp.trap.ip.com - This trap is generated whenever a software failure is detected. snmp.trap.ip.com 3 Login 58 A GUI login failure has occurred
Mon Jun 20 10:46:09 2016 .1.3.6.1.4.1.7779.3.1.1.1.1.2 Critical "Status Events" snmp.trap.ip.com - This trap is generated whenever a software failure is detected. snmp.trap.ip.com 3 Login 0 SNMP Trap is cleared. GUI Login

Re: oid the same for critical and clear snmp traps

Posted: Mon Jun 20, 2016 4:13 pm
by ssax
You will need to duplicate the trap in /etc/snmp/snmptt.conf and add a MATCH statement to limit it:

Code: Select all

EVENT ibProcessingFailureTrap .1.3.6.1.4.1.7779.3.1.1.1.1.2 "Status Events" Critical
FORMAT This trap is generated whenever a software failure is detected. $*
EXEC /usr/local/bin/snmptraphandling.py "$r" "SNMP Traps" "$s" "$@" "$-*" "This trap is generated whenever a software failure is detected. $*"
MATCH $5: ! (SNMP Trap is cleared)
SDESC
This trap is generated whenever a software failure is detected.
Variables:
  1: ibNodeName
  2: ibTrapSeverity
  3: ibSubsystemName
  4: ibProbableCause
  5: ibTrapDesc
EDESC

Code: Select all

EVENT ibProcessingFailureTrap .1.3.6.1.4.1.7779.3.1.1.1.1.2 "Status Events" Normal
FORMAT This trap is generated whenever a software failure is detected. $*
EXEC /usr/local/bin/snmptraphandling.py "$r" "SNMP Traps" "$s" "$@" "$-*" "This trap is generated whenever a software failure is detected. $*"
MATCH $5: (SNMP Trap is cleared)
SDESC
This trap is generated whenever a software failure is detected.
Variables:
  1: ibNodeName
  2: ibTrapSeverity
  3: ibSubsystemName
  4: ibProbableCause
  5: ibTrapDesc
EDESC
Then restart SNMPTT:

Code: Select all

service snmptt restart
Let us know if that works for you.

Re: oid the same for critical and clear snmp traps

Posted: Tue Jun 21, 2016 12:48 pm
by brudnick
I just made the change to the config file. Just waiting for traps to be sent to verify. Will post once I receive some traps.

Re: oid the same for critical and clear snmp traps

Posted: Tue Jun 21, 2016 3:57 pm
by tmcdonald
Awesome, keep us posted!