Passive Checks with SNMP Traps

[jbennett]

The other thread was closed so I have started this thread. Unfortunately, the initial issue that I posted about is not yet resolved.

I was able to successfully upload the wizard, however, I cannot see any traps when I scan devices.

I have verified that port 162 is open on my Nagios box (I believe):

Code: Select all

[root@nagiosxivm ~]# nmap -p 162 -sU -P0 xxx.xxx.xxx.xxx

Starting Nmap 5.21 ( http://nmap.org ) at 2012-08-16 14:17 UTC
Nmap scan report for xxx.xxx.xxx.xxx
Host is up.
PORT    STATE         SERVICE
162/udp open|filtered snmptrap

Nmap done: 1 IP address (1 host up) scanned in 2.58 seconds

I am attempting to monitor a Falcon UPS for starters..

In the Falcon USHA Web interface, USHA Management > SNMP TRAP Receivers > I have the following:

Code: Select all

NMS IP Address	 Community String	 Trap Type	 Severity	   Description
<XI IP Address>	   *                   USHA Trap    Informational Test

When I go through the wizard, I get the following after selecting the UPS where I've made these changes:

There are no monitoring options to configure with SNMP Traps. Click Next to continue.

When I check the log, I get the following:

Code: Select all

[root@nagiosxivm snmp]# tail /var/log/snmptt/snmptt.log
Wed Aug 15 07:25:12 2012 .1.3.6.1.4.1.2468.1.2.1.2.0.1 Normal "Status Events" xxx.xxx.xxx.xxx - INFORMATION: Utility power has been restore. Utility power has been restore

Telling me that the Nagios box is recieving the Traps.

I have adjusted trap severity, per the Integrating SNMP Traps document.

I can run a UPS battery test while I tail -f /var/log/snmptt/snmptt.log and I see the results come in as the test is running.

when I view /var/log/snmptt/snmpttsystem.log, I see the following:

Code: Select all

Thu Aug 16 15:10:33 2012 SNMPTT v1.3 shutdown
Thu Aug 16 15:10:33 2012 Total traps received=0,Total traps translated=0,Total traps ignored=0,Total unknown traps=0
Thu Aug 16 15:10:36 2012 SNMPTT v1.3 started
Thu Aug 16 15:10:37 2012 Loading /etc/snmp/snmptt.conf
Thu Aug 16 15:10:37 2012 Finished loading 2656 lines from /etc/snmp/snmptt.conf
Thu Aug 16 15:10:37 2012 Could not convert user id 'snmptt' to a numeric UID

If I id snmptt, I get the following:

Code: Select all

[root@nagiosxivm snmp]# id snmptt
id: snmptt: No such user

Have I missed a step?

Any help would be greatly appreciated.

[scottwilkerson]

Did you run the wizard? and add the host you are receiving the trap from?

[jbennett]

Yes, I ran the monitoring wizard and I get the following error:

There are no monitoring options to configure with SNMP Traps. Click Next to continue.

The host already exists. In the monitoring wizard, I select the host. When I click next, the above error shows.

[scottwilkerson]

This isn't an error, you need to "Click Next to continue."

[jbennett]

I didn't think it was an error, just that it wasn't finding anything to monitor. Now that I've moved passed that stage and finished the wizard, I have had the following for this UPS for the past 4 hours:

Code: Select all

SNMP Traps	Ok	4h 37m 25s	1/1	2012-08-27 16:41:46	Waiting for trap...

Am I to assume that it will say this UNTIL something is sent (an issue comes up)?

[nscott]

Yes, it will, as long as the MIB is installed properly it will trigger a change in the web interface tens of seconds after after the trap is received. If you have the ability to trip a trap on your UPS, you can test it out, tailing the /var/log/snmptt/snmpttunknown.log to make sure it isn't relelgated to "unknown" status, which means the MIB isn't installed properly.

But to directly answer your question, yes that is normal behavior until a trap is received.

[jbennett]

It appears that I don't have an unknown log file, which I suppose is a good sign.

I have a UPS that went to a failed state sometime yesterday. I am monitoring this UPS via Nagios with services.

I have just gone through the Trap wizard for this UPS and am now monitoring it this way in addition.

However, it's not showing up as a trap. I'm not sure if this is the normal behavior?

I am checking this function via SNMP:

Code: Select all

$USER1$/check_snmp -H $HOSTADDRESS$ -C <community> -o upsOutputSource -m USHA-MIB -w 2: -c :3

The result is currently:

Code: Select all

SNMP CRITICAL - *4*

Have I missed a step in this process?

On another UPS I'm monitoring, I'm getting a battery test result just fine:

Code: Select all

INFORMATION: The testing of UPS is completed. 1 3 1 1346112000 1800 The testing of UPS is completed / enterprises.2468.1.2.1.1.6.2.0 ():1 enterprises.2468.1.2.1.1.6.1.0 ():3 enterprises.2468.1.2.1.1.6.3.0 ():1 enterprises.2468.1.2.1.1.6.4.0 ():1346112000

[jbennett]

It seems that the Traps didn't pick the issue since it was already in a critical state. Once the UPS came out of that critical state, I recieved the following recovery service alerts:

Code: Select all

WARNING: The UPS has switched to battery backup power. 100 1099 1 The UPS has switched to battery backup power / enterprises.2468.1.2.1.1.2.4.0 ():100 enterprises.2468.1.2.1.1.2.5.0 ():1099 enterprises.2468.1.2.1.1.2.2.0 ():1 enterprises.2468.1.2.1.2 ():The UPS has switched to battery backup power
Date/Time: 2012-08-29 17:38:26

Code: Select all

WARNING: Utility power not available. Utility power not available / enterprises.2468.1.2.1.2 ():Utility power not available
Date/Time: 2012-08-29 17:38:42

Hopefully, future issues will be picked up immediately since monitoring since an OK state initially.