Mib uploaded but still in unknown trap

[biswajit.banerjee]

Uploaded the mib with OID 1.3.6.1.4.1.2011.5.25.136.1.6.8 and shows in /etc/snmptt/snmptt.conf.nxti

EVENT hwDot3ahEfmRemoteDyingGaspEvent 1.3.6.1.4.1.2011.5.25.136.1.6.8 "status events" critical
FORMAT Received trap "$N" with variables "$+*"
EXEC php /usr/local/nagiosxi/scripts/nxti.php --event_name="$N" --event_oid="$i" --numeric_oid="$o" --symbolic_oid="$O" --community="$C" --trap_hostname="$R" --trap_ip="$aR" --agent_hostname="$A" --agent_ip="$aA" --category="$c" --severity="$s" --uptime="$T" --datetime="$x $X" --unixtime="$@" --bindings="$+*"
SDESC

EDESC

But Still going to snmpttunknown.log

04:50:12 20191202 : Unknown trap (.1.3.6.1.4.1.2011.5.25.136.1.6.8) received from 10.254.0.166 at:
Value 0: 10.254.0.166
Value 1: 10.254.0.166
Value 2: 133:20:51:51.21
Value 3: .1.3.6.1.4.1.2011.5.25.136.1.6.8
Value 4: 10.254.0.166
Value 5:
Value 6:
Value 7:
Value 8:
Value 9:
Value 10:
Ent Value 0: .1.3.6.1.4.1.2011.5.25.136.1.2.2.3.1.1.6=10:BE:F5:C7:92:A9
Ent Value 1: .1.3.6.1.2.1.2.2.1.2.6=XGigabitEthernet0/0/1

The Mib is attached
Can you please guide where is the issue ?

TIA

[tgriep]

Can you run the following 3 commands as root.

Code: Select all

tar cvfz /tmp/snmp.tgz /etc/snmp/*
tar cvfz /tmp/sharesnmp.tgz /usr/share/snmp/mibs/* --dereference
tar cvfz /tmp/snmplog.tgz /var/log/snmptt/*

Then post these 3 files so we can check the settings and the MIB files for any errors on why the Trap is still showing up in the unknown log.

Code: Select all

/tmp/snmp.tgz
/tmp/sharesnmp.tgz
/tmp/snmplog.tgz

[biswajit.banerjee]

Thanks for Reply
Please find the requested files attached

[tgriep]

I see the OID is duplicated in the snmptt.conf.nxti file so you should update the Defined Traps and remove one of the entries. See the entries below.

Code: Select all

EVENT portinterfacedown 1.3.6.1.4.1.2011.5.25.136.1.6.8 "status events" critical
FORMAT Received trap "$N" with variables "$+*"
EXEC php /usr/local/nagiosxi/scripts/nxti.php --event_name="$N"  --event_oid="$i" --numeric_oid="$o" --symbolic_oid="$O" --community="$C" --trap_hostname="$R" --trap_ip="$aR" --agent_hostname="$A" --agent_ip="$aA" --category="$c" --severity="$s" --uptime="$T" --datetime="$x $X" --unixtime="$@" --bindings="$+*"
SDESC
interface down
EDESC

Code: Select all

EVENT hwDot3ahEfmRemoteDyingGaspEvent 1.3.6.1.4.1.2011.5.25.136.1.6.8 "status events" critical
FORMAT Received trap "$N" with variables "$+*"
EXEC php /usr/local/nagiosxi/scripts/nxti.php --event_name="$N"  --event_oid="$i" --numeric_oid="$o" --symbolic_oid="$O" --community="$C" --trap_hostname="$R" --trap_ip="$aR" --agent_hostname="$A" --agent_ip="$aA" --category="$c" --severity="$s" --uptime="$T" --datetime="$x $X" --unixtime="$@" --bindings="$+*"
SDESC

EDESC

The HUAWEI-ETHOAM-MIB.mib file requires other MIB files to be loaded on the server and some of them are missing which is causing the trap to be unknowm.
Find and upload the following MIB to the server and then restart snmptt and see if the trap is received.

Code: Select all

HUAWEI-MIB
P-BRIDGE-MIB
Q-BRIDGE-MIB

[biswajit.banerjee]

Thanks for Update .
Can I remove the duplicate OID entry directly editing the file or I need to follow some procedure ? Please mention the procedure if any .
For Missing MIB , will update when received from the Vendor .

Thanks

[tgriep]

The duplicated OID has to be removed from the SNMP Trap Interface menu.
If you edit the file directly, the settings from the SNMP Trap menu will overwrite it and put it back.
Just click on the Defined Traps Tab, search for it and remove it.

[biswajit.banerjee]

Thanks for Support .
Issue Resolved

[tgriep]

Thanks for reporting back. I'll close and lock the post.