Page 1 of 1
Trap handling sequence
Posted: Wed Apr 03, 2019 10:14 am
by nms
Hi,
I have a question of how actually the SNMP traps are handled with the snmptt.
Assuming that we have:
Trap 1 as critical, sent at 00:01:30
Trap 2 as critical, sent at 00:01:40
Trap2 is then cleared, sent at 00:01:50
Does the GUI show the latest trap sent which is clearance (OK) for trap2?
I'm asking due to the fact that this might be a disadvantage since the last trap (Trap2) received is an OK (so green indicator in GUI) whilst there is still an issue with Trap1 (critical).
Rgds,
Matt
Re: Trap handling sequence
Posted: Wed Apr 03, 2019 2:08 pm
by cdienger
Assuming that all traps are going to the same default "SNMP Traps" service then yes, the GUI will show the last OK message. There are however options that may help. Creating separate services for traps and/or use of the MATCH option can give you a little more control over how traps are handled.
Using linkUp for example(
https://assets.nagios.com/downloads/nag ... ios_XI.pdf) one could create different services per interface by editing the snmptt.conf to look like:
Code: Select all
EVENT linkUp .1.3.6.1.6.3.1.1.5.4 "Status Events" Normal
FORMAT Link up on interface $1. Admin state: $2. Operational state: $3
EXEC /usr/local/bin/snmptraphandling.py "$r" "ETH0 Up" "$s" "$@" "$-*" "Link up on interface $1. Admin state: $2. Operational state: $3"
MATCH $1: eth0
EVENT linkUp .1.3.6.1.6.3.1.1.5.4 "Status Events" Normal
FORMAT Link up on interface $1. Admin state: $2. Operational state: $3
EXEC /usr/local/bin/snmptraphandling.py "$r" "ETH1 Up" "$s" "$@" "$-*" "Link up on interface $1. Admin state: $2. Operational state: $3"
MATCH $1: eth1
Two services would need to be created in XI then - one called "ETH0 Up" and the other "ETH1 Up". Each could then have their own alert settings, freshness threshold, etc... One thing to consider though(and is dependent on the traps), is that a "clear" update may not use the same OID that triggered a CRITICAL or WARNING state. linkDown for example uses OID .1.3.6.1.6.3.1.1.5.3. So if you setup a linkDown service, a linkUP trap wouldn't clear it since it would be handled by a different(linkUp) service.
More on the MATCH option and other options available to snmptt.conf are found at
http://snmptt.sourceforge.net/docs/snmp ... CONF-MATCH