Nagios Crops additional Variable
Posted: Wed Apr 12, 2017 11:50 am
Hi
I'm working on a plugin to receive SNMP Alerts from external servers and create alerts using passive checks via external commands.
In details:
1 - the server send a trap,
2 - I catch it using snmptrapd
3 - I parse the trap send it to the right service.
4 - I send an external command to change the custom variable of the Alert
5 - I send an external command to force the check of the concerned Alert
during the 4th step nagios crops the variable I send, here is an example :
this is the line for nagios.log
[1492014187] EXTERNAL COMMAND: CHANGE_CUSTOM_SVC_VAR;snaprdap006;NAS_Trap_Handler;trapmessage;X.x.x.x::::UDP: \[X.X.XX]:39892-\>\[X.X.X.X\]::::DISMAN-EVENT-MIB::sysUpTimeInstance 1:16:43:55.00::::SNMPv2-MIB::snmpTrapOID.0 SNMPv2-SMI::enterprises.789.3.0.10461::::SNMPv2-SMI::enterprises.789.3.1.0 1-50-007824::::SNMPv2-SMI::enterprises.789.3.11.1.9.38883878 700002003959::::SNMPv2-SMI::enterprises.789.3.11.1.1.38883878 38883878::::SNMPv2-SMI::enterprises.789.3.11.1.5.38883878 Aggregate Not Overcommitted::::SNMPv2-SMI::enterprises.789.3.11.1.3.38883878 1::::SNMPv2-SMI::enterprises.789.3.11.1.4.38883878 1490256089::::SNMPv2-SMI::enterprises.789.3.11.1.6.38883878 Normal event on faslonnas12:aggr1 (Aggregate Not Overcommitted)::::SNMPv2-SMI::enterprises.789.3.11.1.7.38883878 Committed 55.6 TB (83.05\%) out of 66.9 TB available; Using 51.0 TB (76.21\%) out of 66.9 TB available::::SNMPv2-SMI::enterprises.789.3.11.1.2.38883878 225068::::SNMPv2-SMI::enterprises.789.3.11.1.8.38883878 1::::SNMPv2-SMI::enterprises.789.3.12.1.1.225068 225068::::SNMPv2-SMI::enterprises.789.3.12.1.3.225068 15::::SNMPv2-SMI::enterprises.789.3.12.1.2.225068 faslonnas12:aggr1::::SNMPv2-SMI::enterprises.789.3.12.1.4.225068 3::::SNMPv2-SMI::enterprises.789.3.11.1.10.38883878 2016442952::::SNMPv2-SMI::enterprises.789.3.12.1.5.225068 faslonnas12::::SNMPv2-SMI::enterprises.789.3.12.1.6.225068 ::::SNMPv2-SMI::enterprises.789.3.12.1.7.225068 0::::SNMPv2-SMI::enterprises.789.3.12.1.8.225068 ::::SNMP-COMMUNITY-MIB::snmpTrapAddress.0 X.X.X.X::::SNMP-COMMUNITY-MIB::snmpTrapCommunity.0 public::::SNMPv2-MIB::snmpTrapEnterprise.0 SNMPv2-SMI::enterprises.789.3::::
this is the state of the service to which i send the variable in status.dat:
servicestatus {
host_name=snaprdap006
service_description=NAS_Trap_Handler
modified_attributes=32768
check_command=nas_trap_handler
.
.
.
.
_TRAPMESSAGE=1;nasprdap02.fr.world.socgen::::UDP: \[X.X.X.X\]:39892-\>\[X.X.X.X\]::::DISMAN-EVENT-MIB::sysUpTimeInstance 1:16:43:55.00::::SNMPv2-MIB::snmpTrapOID.0 SNMPv2-SMI::enterprises.789.3.0.10461::::SNMPv2-SMI::enterprises.789.3.1.0 1-50-007824::::SNMPv2-SMI::enterprises.789.3.11.1.9.38883878 700002003959::::SNMPv2-SMI::enterprises.789.3.11.1.1.38883878 38883878::::SNMPv2-SMI::enterprises.789.3.11.1.5.38883878 Aggregate Not Overcommitted::::SNMPv2-SMI::enterprises.789.3.11.1.3.38883878 1::::SNMPv2-SMI::enterprises.789.3.11.1.4.38883878 1490256089::::SNMPv2-SMI::enterprises.789.3.11.1.6.38883878 Normal event on faslonnas12:aggr1 (Aggregate Not Overcommitted)::::SNMPv2-SMI::enterprises.789.3.11.1.7.38883878 Committed 55.6 TB (83.05\%) out of 66.9 TB available
_TRAPSOURCE=1;7mode
}
so as you see i don't receive the whole content of the variable and i don't see any error either in the logs neither in the debug.
is there any way to trace the execution of the execution of external commands
can you please guide me to investigate where the variable is cropped i order to determine the root cause
Regards
I'm working on a plugin to receive SNMP Alerts from external servers and create alerts using passive checks via external commands.
In details:
1 - the server send a trap,
2 - I catch it using snmptrapd
3 - I parse the trap send it to the right service.
4 - I send an external command to change the custom variable of the Alert
5 - I send an external command to force the check of the concerned Alert
during the 4th step nagios crops the variable I send, here is an example :
this is the line for nagios.log
[1492014187] EXTERNAL COMMAND: CHANGE_CUSTOM_SVC_VAR;snaprdap006;NAS_Trap_Handler;trapmessage;X.x.x.x::::UDP: \[X.X.XX]:39892-\>\[X.X.X.X\]::::DISMAN-EVENT-MIB::sysUpTimeInstance 1:16:43:55.00::::SNMPv2-MIB::snmpTrapOID.0 SNMPv2-SMI::enterprises.789.3.0.10461::::SNMPv2-SMI::enterprises.789.3.1.0 1-50-007824::::SNMPv2-SMI::enterprises.789.3.11.1.9.38883878 700002003959::::SNMPv2-SMI::enterprises.789.3.11.1.1.38883878 38883878::::SNMPv2-SMI::enterprises.789.3.11.1.5.38883878 Aggregate Not Overcommitted::::SNMPv2-SMI::enterprises.789.3.11.1.3.38883878 1::::SNMPv2-SMI::enterprises.789.3.11.1.4.38883878 1490256089::::SNMPv2-SMI::enterprises.789.3.11.1.6.38883878 Normal event on faslonnas12:aggr1 (Aggregate Not Overcommitted)::::SNMPv2-SMI::enterprises.789.3.11.1.7.38883878 Committed 55.6 TB (83.05\%) out of 66.9 TB available; Using 51.0 TB (76.21\%) out of 66.9 TB available::::SNMPv2-SMI::enterprises.789.3.11.1.2.38883878 225068::::SNMPv2-SMI::enterprises.789.3.11.1.8.38883878 1::::SNMPv2-SMI::enterprises.789.3.12.1.1.225068 225068::::SNMPv2-SMI::enterprises.789.3.12.1.3.225068 15::::SNMPv2-SMI::enterprises.789.3.12.1.2.225068 faslonnas12:aggr1::::SNMPv2-SMI::enterprises.789.3.12.1.4.225068 3::::SNMPv2-SMI::enterprises.789.3.11.1.10.38883878 2016442952::::SNMPv2-SMI::enterprises.789.3.12.1.5.225068 faslonnas12::::SNMPv2-SMI::enterprises.789.3.12.1.6.225068 ::::SNMPv2-SMI::enterprises.789.3.12.1.7.225068 0::::SNMPv2-SMI::enterprises.789.3.12.1.8.225068 ::::SNMP-COMMUNITY-MIB::snmpTrapAddress.0 X.X.X.X::::SNMP-COMMUNITY-MIB::snmpTrapCommunity.0 public::::SNMPv2-MIB::snmpTrapEnterprise.0 SNMPv2-SMI::enterprises.789.3::::
this is the state of the service to which i send the variable in status.dat:
servicestatus {
host_name=snaprdap006
service_description=NAS_Trap_Handler
modified_attributes=32768
check_command=nas_trap_handler
.
.
.
.
_TRAPMESSAGE=1;nasprdap02.fr.world.socgen::::UDP: \[X.X.X.X\]:39892-\>\[X.X.X.X\]::::DISMAN-EVENT-MIB::sysUpTimeInstance 1:16:43:55.00::::SNMPv2-MIB::snmpTrapOID.0 SNMPv2-SMI::enterprises.789.3.0.10461::::SNMPv2-SMI::enterprises.789.3.1.0 1-50-007824::::SNMPv2-SMI::enterprises.789.3.11.1.9.38883878 700002003959::::SNMPv2-SMI::enterprises.789.3.11.1.1.38883878 38883878::::SNMPv2-SMI::enterprises.789.3.11.1.5.38883878 Aggregate Not Overcommitted::::SNMPv2-SMI::enterprises.789.3.11.1.3.38883878 1::::SNMPv2-SMI::enterprises.789.3.11.1.4.38883878 1490256089::::SNMPv2-SMI::enterprises.789.3.11.1.6.38883878 Normal event on faslonnas12:aggr1 (Aggregate Not Overcommitted)::::SNMPv2-SMI::enterprises.789.3.11.1.7.38883878 Committed 55.6 TB (83.05\%) out of 66.9 TB available
_TRAPSOURCE=1;7mode
}
so as you see i don't receive the whole content of the variable and i don't see any error either in the logs neither in the debug.
is there any way to trace the execution of the execution of external commands
can you please guide me to investigate where the variable is cropped i order to determine the root cause
Regards