Page 1 of 1

snmptt passive check is showing UNKNOWN host

Posted: Fri Jan 15, 2021 11:24 am
by acentek
[1610722634] Warning: Passive check result was received for service 'FIRE_CAT_Alarm' on host 'UNKNOWN', but the host could not be found!
[1610722634] Error: External command failed -> PROCESS_SERVICE_CHECK_RESULT;UNKNOWN;FIRE_CAT_Alarm;2; Critical - FIRE CAT Alarm
[1610722634] External command [1610722631] PROCESS_SERVICE_CHECK_RESULT;UNKNOWN;FIRE_CAT_Alarm;2; Critical - FIRE CAT Alarm returned error Command failed
[1610723692] Warning: Passive check result was received for service 'FIRE_CAT_Alarm' on host 'UNKNOWN', but the host could not be found!
[1610723692] Error: External command failed -> PROCESS_SERVICE_CHECK_RESULT;UNKNOWN;FIRE_CAT_Alarm;0; Normal - FIRE CAT Alarm

Fri Jan 15 08:57:11 2021 .1.3.6.1.4.1.2682.1.4.8018 Normal "Status Events" UNKNOWN - Generated when discrete point 18 is set. NetGuardian-G4 v4.2U.25 Ossian C.O. 01-15-2021 08:57:11.31 99 1 1 18 OSSN FIRE CAT Alarm
Fri Jan 15 09:14:50 2021 .1.3.6.1.4.1.2682.1.4.9018 Normal "Status Events" UNKNOWN - Generated when discrete point 18 clears. NetGuardian-G4 v4.2U.25 Ossian C.O. 01-15-2021 09:14:50.22 99 1 1 18 OSSN FIRE CAT Clear
Fri Jan 15 09:21:23 2021 .1.3.6.1.4.1.2682.1.4.8018 Normal "Status Events" UNKNOWN - Generated when discrete point 18 is set. NetGuardian-G4 v4.2U.25 Ossian C.O. 01-15-2021 09:21:22.37 99 1 1 18 OSSN FIRE CAT Alarm


As you can see above host return UNKNOWN on Nagios 5.7.5

When testing the NetGuardian running the passive check it always returns unknown at this time.

Re: snmptt passive check is showing UNKNOWN host

Posted: Fri Jan 15, 2021 11:55 am
by acentek
Here is a log from prior when it worked.

[1603128561] SERVICE NOTIFICATION: opsgenie_for_MN_Central_Office;OSSN-NetGuard-G4;FIRE_CAT_Alarm;CRITICAL;notify-service-by-opsgenie_Contact_2;Critical - FIRE CAT Alarm
[1603128561] SERVICE NOTIFICATION: opsgenie_for_MN_Central_Office;OSSN-NetGuard-G4;FIRE_CAT_Alarm;CRITICAL;notify-service-by-opsgenie_Contact;Critical - FIRE CAT Alarm
[1603128561] SERVICE ALERT: OSSN-NetGuard-G4;FIRE_CAT_Alarm;CRITICAL;HARD;1;Critical - FIRE CAT Alarm
[1603128571] SERVICE NOTIFICATION: opsgenie_for_MN_Central_Office;OSSN-NetGuard-G4;FIRE_CAT_Alarm;OK;notify-service-by-opsgenie_Contact_2;Normal - FIRE CAT Alarm
[1603128571] SERVICE NOTIFICATION: opsgenie_for_MN_Central_Office;OSSN-NetGuard-G4;FIRE_CAT_Alarm;OK;notify-service-by-opsgenie_Contact;Normal - FIRE CAT Alarm

Re: snmptt passive check is showing UNKNOWN host

Posted: Fri Jan 15, 2021 4:15 pm
by acentek
We have confirmed that pre 5.7.5 everything worked but since the upgrade snmptt passive traps are failing unknown host.

Thoughts ideas anything?

Re: snmptt passive check is showing UNKNOWN host

Posted: Mon Jan 18, 2021 6:18 pm
by ssax
Please send me a copy of your profile.zip, you can download it from Admin > System Profile by clicking the Download Profile button.

Run this command as root and send me the resulting /tmp/SNMPFILES.zip file as well:

Code: Select all

zip -r /tmp/SNMPFILES.zip /etc/snmp
I have also reached out to development on this to see if they have any ideas.

Thank you!

Re: snmptt passive check is showing UNKNOWN host

Posted: Tue Jan 19, 2021 10:04 am
by ssax
In addition to my previous post, please try editing this file:

Code: Select all

/usr/sbin/snmptt
Change line 3291 from this:

Code: Select all

if ($tempvar[0] =~ /<UNKNOWN>/) {
To this:

Code: Select all

if ($tempvar[0] =~ /UNKNOWN/) {
See if that resolves it.

Taken from here:

https://sourceforge.net/p/snmptt/bugs/46/

Re: snmptt passive check is showing UNKNOWN host

Posted: Tue Jan 19, 2021 12:31 pm
by acentek
I have sent the requested files via PM.

Re: snmptt passive check is showing UNKNOWN host

Posted: Wed Jan 20, 2021 2:57 pm
by ssax
Did you test out that change? Did it resolve it?

I think it's ultimately failing because you have dns_enable = 0 in your /etc/snmptt.ini, I think $r in the EXEC line requires DNS working, you can try changing the $r to $aA.

Try changing this in your /etc/snmp/snmptt.conf:

Code: Select all

EVENT dpsRTUv2p8018Set .1.3.6.1.4.1.2682.1.4.8018 "Status Events" Normal
FORMAT Generated when discrete point 18 is set. $*
EXEC /usr/local/bin/netguardian_point18_set.py "$r" "SNMP Traps" "$s" "$@" "$-*" "Generated when discrete point 18 is set. $*"
SDESC
Generated when discrete point 18 is set.
Variables:
  1: sysDescr
  2: sysLocation
  3: dpsRTUv2DateTime
  4: dpsRTUv2APort
  5: dpsRTUv2CAddress
  6: dpsRTUv2ADisplay
  7: dpsRTUv2APoint
  8: dpsRTUv2APntDesc
  9: dpsRTUv2AState
EDESC
To this (changing $r in the EXEC line to $aA):

Code: Select all

EVENT dpsRTUv2p8018Set .1.3.6.1.4.1.2682.1.4.8018 "Status Events" Normal
FORMAT Generated when discrete point 18 is set. $*
EXEC /usr/local/bin/netguardian_point18_set.py "$aA" "SNMP Traps" "$s" "$@" "$-*" "Generated when discrete point 18 is set. $*"
SDESC
Generated when discrete point 18 is set.
Variables:
  1: sysDescr
  2: sysLocation
  3: dpsRTUv2DateTime
  4: dpsRTUv2APort
  5: dpsRTUv2CAddress
  6: dpsRTUv2ADisplay
  7: dpsRTUv2APoint
  8: dpsRTUv2APntDesc
  9: dpsRTUv2AState
EDESC
Then restart SNMPTT and test that .1.3.6.1.4.1.2682.1.4.8018 trap to see if it's resolved.

Code: Select all

service snmptt restart

Re: snmptt passive check is showing UNKNOWN host

Posted: Wed Jan 20, 2021 5:10 pm
by acentek
I made both changes and am waiting to see if it is resolved.

Re: snmptt passive check is showing UNKNOWN host

Posted: Wed Jan 20, 2021 7:27 pm
by acentek
This has resolved the issue. Thank you very much.

Re: snmptt passive check is showing UNKNOWN host

Posted: Thu Jan 21, 2021 6:46 pm
by ssax
That's great to hear! Let us know when we're okay to lock this up.