Page 1 of 2
Traps are not processing
Posted: Sun Jun 03, 2018 9:46 pm
by sandeep.endla
Hi ,
I have configured the snmp trap monitoring on the nagios core. I am receiving the traps on /valog/snmptt/snmptt.log, but the traps are not processing it is showing empty for the TRAPS for the server (ep-app-ana-06.woodgroup.com) in nagios.log. Could you, Please help with it.
Attaching the snmptt.ini, snmptt.conf and snmptt.log
[root@ep-app-nag-02 var]# cat nagios.log | grep -i ep-app-ana-06.woodgroup.com | grep -i trap
[1528066800] CURRENT SERVICE STATE: ep-app-ana-06.woodgroup.com;TRAP;OK;HARD;1;
[root@ep-app-nag-02 var]#
Re: Traps are not processing
Posted: Mon Jun 04, 2018 2:17 pm
by tgriep
This entry in the snmptt.conf file
Code: Select all
EVENT authenticationFailure .1.3.6.1.6.3.1.1.5.5 "Status Events" Normal
Has an empty EXEC command which is used to send the received trap to the Nagios process.
You need to put an EXEC line in that OID like the example below.
Code: Select all
EXEC /nagiosfs/libexec/eventhandlers/submit_check_result $r TRAP 1 "SNMP authentication failure"
Another thing I see if that there are 2 different paths for the submit_check_result script.
Code: Select all
/nagiosfs/libexec/eventhandlers/submit_check_result
/usr/lib64/nagios/plugins/submit_check_result
Make sure that they are both valid or change the invalid one to the correct one.
Re: Traps are not processing
Posted: Thu Jun 07, 2018 9:07 am
by sandeep.endla
Hi tgriep,
Ihave given the EXEC entry for the the below mentioned OIDs.
Also we have changed the submit_check_result for all the EVENTS with /nagiosfs/libexec/eventhandlers/submit_check_result.
Now also the TRAPs are not working.
Re: Traps are not processing
Posted: Thu Jun 07, 2018 12:30 pm
by tgriep
Let's enable logging for the snmptt daemon by editing the snmptt.ini file and changing the following from
Code: Select all
log_system_enable = 0
unknown_trap_log_enable = 0
to
Code: Select all
log_system_enable = 1
unknown_trap_log_enable = 1
Save the change and restart the daemon by running
service snmptt restart
Wait for the system to receive some traps or force them to run and then post the following files here so we can view them.
Code: Select all
/var/log/snmptt/snmptt.log
/var/log/snmptt/snmpttsystem.log
/var/log/snmptt/snmpttunknown.log
Re: Traps are not processing
Posted: Fri Jun 08, 2018 11:23 am
by sandeep.endla
Hi Tgriep,
We have made the changes in snmptt.ini file as mentioned. Please find the attached log files
Re: Traps are not processing
Posted: Fri Jun 08, 2018 1:33 pm
by tgriep
Code: Select all
su - nagios
/nagiosfs/libexec/eventhandlers/submit_check_result ep-app-ana-06.woodgroup.com TRAP 1 "SNMP authentication failure"
Then check the nagios.log file to see if the traps are received.
Code: Select all
grep -i ep-app-ana-06.woodgroup.com /nagiosfs/var/nagios.log | grep -i trap
The entries in the snmpttunknown log have to be added to the snmptt.conf file so they will be processes.
Re: Traps are not processing
Posted: Mon Jun 11, 2018 9:22 am
by sandeep.endla
Hi Tgriep,
Thanks for the help.
I have run the below command and the TRAP is generated on the nagios console.
Could you, Please let us known how to add the traps receiving in the snmpttunknown.log to snmptt.conf file.
Re: Traps are not processing
Posted: Mon Jun 11, 2018 10:43 am
by tgriep
To add the unknown traps to the snmptt.conf file is to search the internet for the OID that is displayed in the unknown log file to find out which MIB file it is in.
Once you find that, you would run the same command that was used to add the other entries but with some modifications, the example below should add the entries.
Code: Select all
snmpttconvertmib --in=NewMibFile --out=/etc/snmp/snmptt.conf --exec /nagiosfs/libexec/eventhandlers/submit_check_result $r TRAP 1 "$s"
Fore more details, look at this link.
http://snmptt.sourceforge.net/docs/snmp ... tmib.shtml
Re: Traps are not processing
Posted: Mon Jun 11, 2018 11:49 am
by sandeep.endla
thanks tgreip,
Will do the same as requested.
Iam receiving the TRAPS in snmptt.log as below. but the traps are not processing is the "SNMP athentication failure" defined in snmptt.conf has any issue.
Mon Jun 11 12:13:02 2018 .1.3.6.1.6.3.1.1.5.5 Normal "Status Events" ep-app-bi-01.woodgroup.com - SNMP athentication failure
Mon Jun 11 12:13:07 2018 .1.3.6.1.6.3.1.1.5.5 Normal "Status Events" ep-app-bi-01.woodgroup.com - SNMP athentication failure
Mon Jun 11 12:13:12 2018 .1.3.6.1.6.3.1.1.5.5 Normal "Status Events" ep-app-bi-01.woodgroup.com - SNMP athentication failure
[root@ep-app-nag-02 snmptt]# cat /nagiosfs/var/nagios.log | grep -i ep-app-bi-01.woodgroup.com | grep -i trap
[1528671600] CURRENT SERVICE STATE: EP-APP-BI-01.WOODGROUP.com;TRAP;OK;HARD;1;
#
#
#
EVENT authenticationFailure .1.3.6.1.6.3.1.1.5.5 "Status Events" Normal
FORMAT SNMP athentication failure
#EXEC qpage -f TRAP notifygroup1 "SNMP authentication failure"
EXEC /nagiosfs/libexec/eventhandlers/submit_check_result $r TRAP 1 "SNMP authentication failure"
SDESC
An authenticationFailure trap signifies that the SNMPv2
entity, acting in an agent role, has received a protocol
message that is not properly authenticated. While all
implementations of the SNMPv2 must be capable of generating
this trap, the snmpEnableAuthenTraps object indicates
whether this trap will be generated.
EDESC
#
Re: Traps are not processing
Posted: Mon Jun 11, 2018 3:25 pm
by tgriep
Can you post your snmptt.conf file as well as the output of these commands run as root?
Code: Select all
ls -l /nagiosfs/
ls -l /nagiosfs/libexec/
ls -l /nagiosfs/libexec/eventhandlers/
grep snmp /etc/group
ps -ef |grep snmp