Page 1 of 2
Cisco RTT / IPSLA showing SNMP Traps in hex on Nagios
Posted: Mon Jan 15, 2018 11:30 am
by vijilants
System:
Nagios XI Version : 5.4.11
londnms1 2.6.32-431.29.2.el6.i686 i686
CentOS release 6.5 (Final)
Gnome Installed
Hi ,
Can somebody please advise on the following.
I am trying to use Nagios to monitor IPSLA / RTT SNMP traps from Cisco devices.
However these are the sort of messages I am getting in nagios....
A rttMonThresholdNotification indicates the 0A 01 01 56 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2 / enterprises.9.9.42.1.2.1.1.3.1 (): enterprises.9.9.42.1.4.1.1.5.1 ():0A 01 01 56 00 00 00 00 00 00 00 00 00 00 00 00 00
A rttMonNotification indicates the occurrence of a 0A 01 01 56 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 7 2 0 0 0 00 00 00 00 13 BA 67 10 00 00 00 04 44 00 00 24 00 00 00 00 00 00 00 00 00 00 00 00 / enterprises.9.9.42.
The first one is when a problem occurs (Warning) and the second one is when a problem clears (Normal).
As you can see, this gives next to no useful info.
Can you please advise on how to get this reporting correctly ?
Thanks
Re: Cisco RTT / IPSLA showing SNMP Traps in hex on Nagios
Posted: Mon Jan 15, 2018 2:44 pm
by tgriep
When you uploaded the CISCO-RTTMON-MIB mib file to the Nagios XI server, did you also upload the CISCO-SMI Mib file as well?
The RTTMON file needs the other MIB file loaded on the server to translate certain OID's and that could be one cause if the issue.
Some trap strings may be received in hexadecimal format. You can add option -Oa to snmptrapd daemon to force the received information to ASCII.
To do this, edit the /etc/sysconfig/snmptrapd file and on the OPTIONS= line, add the following to it.
If it is commented out, uncomment it and set it to the following.
Code: Select all
OPTIONS="-Oa -Lsd -p /var/run/snmptrapd.pid"
Then restart the daemon by running
Generate a Trap and see if it is decoded to ASCII for you.
Re: Cisco RTT / IPSLA showing SNMP Traps in hex on Nagios
Posted: Tue Jan 16, 2018 8:17 am
by vijilants
tgriep wrote:When you uploaded the CISCO-RTTMON-MIB mib file to the Nagios XI server, did you also upload the CISCO-SMI Mib file as well?
The RTTMON file needs the other MIB file loaded on the server to translate certain OID's and that could be one cause if the issue.
Some trap strings may be received in hexadecimal format. You can add option -Oa to snmptrapd daemon to force the received information to ASCII.
To do this, edit the /etc/sysconfig/snmptrapd file and on the OPTIONS= line, add the following to it.
If it is commented out, uncomment it and set it to the following.
Code: Select all
OPTIONS="-Oa -Lsd -p /var/run/snmptrapd.pid"
Then restart the daemon by running
Generate a Trap and see if it is decoded to ASCII for you.
Cisco-SMI is already installed.
Here is the output of my existing snmptrapd file below. Can you please show me exactly where I need to add the code above ?
Thanks
Code: Select all
OPTIONS="-Lsd -On -p /var/run/snmptrapd.pid"
Re: Cisco RTT / IPSLA showing SNMP Traps in hex on Nagios
Posted: Tue Jan 16, 2018 9:21 am
by tgriep
Change that line from
Code: Select all
OPTIONS="-Lsd -On -p /var/run/snmptrapd.pid"
to
Code: Select all
OPTIONS="-Lsd -Oa -p /var/run/snmptrapd.pid"
Save the file and restart the snmptrapd daemon by running
Re: Cisco RTT / IPSLA showing SNMP Traps in hex on Nagios
Posted: Tue Jan 16, 2018 10:11 am
by vijilants
OK, after the changes made above now I am getting this in the information box for the trap(see below) . Not much better.
Code: Select all
A rttMonNotification indicates the occurrence of a ..V........................ 7 2 0 0 0 ......g.....D..$............ / enterprises.9.9.42.1.2.1.1.3.1 (): enterprises.9.9.42.1.4.1.1.5.1 (): ..V........................ enterprises.9.9.42.1.2.19.1.2.1 ():
Re: Cisco RTT / IPSLA showing SNMP Traps in hex on Nagios
Posted: Tue Jan 16, 2018 2:42 pm
by dwhitfield
At this point, I would suggest submitting a ticket at
https://support.nagios.com/tickets/ to speed this along.
Re: Cisco RTT / IPSLA showing SNMP Traps in hex on Nagios
Posted: Tue Jan 16, 2018 3:01 pm
by tgriep
I was hoping that there may of been some useful information that can be used when it was converted to ASCII.
You can put back the setting back to -On.
If could be that the system is sending HEX as the data so there may be nothing to do to fix it.
I couldn't find much information on what the data should look like but I did find a description of the OID's meaning at the link below.
https://www.cisco.com/c/en/us/td/docs/r ... 1mib4.html
Re: Cisco RTT / IPSLA showing SNMP Traps in hex on Nagios
Posted: Wed Jan 17, 2018 9:03 am
by vijilants
On the same subject, I have noticed that the following traps for IP SLA timeouts are in router logs and the snmptt.log but do not appear in the GUI when you search in the GUI under SNMP state history for the host
One is for a condition occuring and the other is for the condition clearing.
This is what is in the router log:
Code: Select all
Jan 17 09:03:45: %RTT-4-OPER_TIMEOUT: condition occurred, entry number = 1
Jan 17 09:03:45: %RTT-3-IPSLATHRESHOLD: IP SLAs(1): Threshold Occurred for timeout
Jan 17 09:03:46: %RTT-4-OPER_TIMEOUT: condition cleared, entry number = 1
Jan 17 09:03:46: %RTT-3-IPSLATHRESHOLD: IP SLAs(1): Threshold Cleared for timeout
This is what is in the snmptt.log for the event:
Code: Select all
Wed Jan 17 09:03:46 2018 .1.3.6.1.4.1.9.9.41.2.0.1 Warning "Status Events" SomSW02 - When a syslog message is generated by the device a clogMessageGenerated notification is sent. The sending of these notifications can be enabled/disabled via the clogNotificationsEnabled object. RTT 5 OPER_TIMEOUT condition occurred, entry number = 1 32:2:44:33.57
Wed Jan 17 09:03:47 2018 .1.3.6.1.4.1.9.9.41.2.0.1 Normal "Status Events" SomSW02 - When a syslog message is generated by the device a RTT 5 OPER_TIMEOUT condition cleared, entry number = 1 32:2:44:34.58
The above does not appear in the GUI for SNMP traps.
However searching for the actual mib variable, this is what I found in the snmptt.conf file:
Code: Select all
#
MIB: CISCO-SYSLOG-MIB (file:/usr/share/snmp/mibs/CISCO-SYSLOG-MIB.txt) converted on Fri Dec 8 08:55:51 2017 using snmpttconvertmib v1.3
#
#
#
EVENT clogMessageGenerated .1.3.6.1.4.1.9.9.41.2.0.1 "Status Events" Normal
FORMAT When a syslog message is generated by the device a $*
EXEC /usr/local/bin/snmptraphandling.py "$r" "SNMP Traps" "$s" "$@" "$-*" "When a syslog message is generated by the device a $*"
SDESC
When a syslog message is generated by the device a
clogMessageGenerated notification is sent. The
sending of these notifications can be enabled/disabled
via the clogNotificationsEnabled object.
Variables:
1: clogHistFacility
2: clogHistSeverity
3: clogHistMsgName
4: clogHistMsgText
5: clogHistTimestamp
EDESC
Both traps appear to have the same OID but for two different scenarios...one being the for condition occuring , one being for clearing.
So how do I get these to show up in the GUI under SNMP traps, with Warning when the condition occurs and Normal when the codition clears ?
Thanks
Re: Cisco RTT / IPSLA showing SNMP Traps in hex on Nagios
Posted: Wed Jan 17, 2018 2:01 pm
by tgriep
The default state setting in the snmptt.conf file for traps is set to the OK state so when multiple traps come in to the same OID, they will overwrite the existing trap info in the gui so that is why they to not show up in the state history.
Since the state is always OK, it will not log the details for the trap.
What you would have to do it to create a new entry in the snmptt.conf file with settings to create a warning or critical state and then when they get sent to Nagios, that will show up in the State History.
In the link below, is a KB article with a lot of details on how traps work with XI and there are some examples on how to create Warning and Critical Traps.
https://support.nagios.com/kb/article/n ... al-77.html
Look under this section "Create Custom Events In SNMPTT" in the article.
Re: Cisco RTT / IPSLA showing SNMP Traps in hex on Nagios
Posted: Thu Jan 18, 2018 8:06 am
by vijilants
Thank you for the link.
However, due to an urgent operational issue on our network that require this IP SLA monitoring service, I'm afraid I don't have time to read through all of this or experiment with it.
Can you kindly guide me as to what I need to do to get this going as quickly as possible per my post and I will read the document after ?
Many Thanks