Home » Categories » Multiple Categories

Nagios XI - Update Default snmptt.conf EVENT

Problem Description

After following the documentation to Integrate SNMP Traps with Nagios XI (https://support.nagios.com/kb/article.php?id=232) there are five EVENTs defined in the /etc/snmp/snmptt.conf file.

These five entries have uncommented EXEC lines that point to a qpage command that does not work with Nagios XI.

This KB article provides the steps to replace the EXEC lines with the snmptraphandling.py command that will be able to notify Nagios XI.

Without these changes, these traps will be detected by the SNMP Trap Translator (SNMPTT) however nothing will be done with them and Nagios XI will never receive traps for these OIDs/MIBs.

 

 

Update snmptt.conf

Establish a terminal session to the Nagios XI server as the root user.

Execute the following commands:

sed -i 's/^EVENT coldStart \.1\.3\.6\.1\.6\.3\.1\.1\.5\.1 "Status Events" Normal/EVENT coldStart \.1\.3\.6\.1\.6\.3\.1\.1\.5\.1 "Status Events" Warning/g' /etc/snmp/snmptt.conf
sed -i 's/^#EXEC qpage -f TRAP notifygroup1 "Device reinitialized (coldStart)"/EXEC \/usr\/local\/bin\/snmptraphandling.py "\$r" "SNMP Traps" "\$s" "\$@" "\$-*" "Device reinitialized (coldStart) \$*"/g' /etc/snmp/snmptt.conf
sed -i 's/^#EXEC qpage -f TRAP notifygroup1 "Device reinitialized (warmStart)"/EXEC \/usr\/local\/bin\/snmptraphandling.py "\$r" "SNMP Traps" "\$s" "\$@" "\$-*" "Device reinitialized (warmStart) \$*"/g' /etc/snmp/snmptt.conf
sed -i 's/^EVENT linkDown \.1\.3\.6\.1\.6\.3\.1\.1\.5\.3 "Status Events" Normal/EVENT linkDown \.1\.3\.6\.1\.6\.3\.1\.1\.5\.3 "Status Events" Critical/g' /etc/snmp/snmptt.conf
sed -i 's/^#EXEC qpage -f TRAP notifygroup1 "Link down on interface \$1.  Admin state: \$2.  Operational state: \$3"/EXEC \/usr\/local\/bin\/snmptraphandling.py "\$r" "SNMP Traps" "\$s" "\$@" "\$-*" "Link down on interface \$1.  Admin state: \$2.  Operational state: \$3"/g' /etc/snmp/snmptt.conf 
sed -i 's/^#EXEC qpage -f TRAP notifygroup1 "Link up on interface \$1.  Admin state: \$2.  Operational state: \$3"/EXEC \/usr\/local\/bin\/snmptraphandling.py "\$r" "SNMP Traps" "\$s" "\$@" "\$-*" "Link up on interface \$1.  Admin state: \$2.  Operational state: \$3"/g' /etc/snmp/snmptt.conf
sed -i 's/^EVENT authenticationFailure \.1\.3\.6\.1\.6\.3\.1\.1\.5\.5 "Status Events" Normal/EVENT authenticationFailure \.1\.3\.6\.1\.6\.3\.1\.1\.5\.5 "Status Events" Warning/g' /etc/snmp/snmptt.conf
sed -i 's/^#EXEC qpage -f TRAP notifygroup1 "SNMP authentication failure"/EXEC \/usr\/local\/bin\/snmptraphandling.py "\$r" "SNMP Traps" "\$s" "\$@" "\$-*" "SNMP authentication failure \$*"/g' /etc/snmp/snmptt.conf 

 

After executing these commands you will need to restart the snmptt service.

 

These commands will make the following changes.

Before:

EVENT coldStart .1.3.6.1.6.3.1.1.5.1 "Status Events" Normal

After:

EVENT coldStart .1.3.6.1.6.3.1.1.5.1 "Status Events" Warning

 

Before:

#EXEC qpage -f TRAP notifygroup1 "Device reinitialized (coldStart)"

After:

EXEC /usr/local/bin/snmptraphandling.py "$r" "SNMP Traps" "$s" "$@" "$-*" "Device reinitialized (coldStart) $*"

 

Before:

#EXEC qpage -f TRAP notifygroup1 "Device reinitialized (warmStart)"

After:

EXEC /usr/local/bin/snmptraphandling.py "$r" "SNMP Traps" "$s" "$@" "$-*" "Device reinitialized (warmStart) $*"

 

Before:

EVENT linkDown .1.3.6.1.6.3.1.1.5.3 "Status Events" Normal

After:

EVENT linkDown .1.3.6.1.6.3.1.1.5.3 "Status Events" Critical

 

Before:

#EXEC qpage -f TRAP notifygroup1 "Link down on interface $1.  Admin state: $2.  Operational state: $3"

After:

EXEC /usr/local/bin/snmptraphandling.py "$r" "SNMP Traps" "$s" "$@" "$-*" "Link down on interface $1.  Admin state: $2.  Operational state: $3"

 

Before:

#EXEC qpage -f TRAP notifygroup1 "Link up on interface $1.  Admin state: $2.  Operational state: $3"

After:

EXEC /usr/local/bin/snmptraphandling.py "$r" "SNMP Traps" "$s" "$@" "$-*" "Link up on interface $1.  Admin state: $2.  Operational state: $3"

 

Before:

EVENT authenticationFailure .1.3.6.1.6.3.1.1.5.5 "Status Events" Normal

After:

EVENT authenticationFailure .1.3.6.1.6.3.1.1.5.5 "Status Events" Warning

 

Before:

#EXEC qpage -f TRAP notifygroup1 "SNMP authentication failure"

After:

EXEC /usr/local/bin/snmptraphandling.py "$r" "SNMP Traps" "$s" "$@" "$-*" "SNMP authentication failure $*"

 

The final config will appear as follows:

EVENT coldStart .1.3.6.1.6.3.1.1.5.1 "Status Events" Warning
FORMAT Device reinitialized (coldStart)
EXEC /usr/local/bin/snmptraphandling.py "$r" "SNMP Traps" "$s" "$@" "$-*" "Device reinitialized (coldStart) $*"
SDESC
A coldStart trap signifies that the SNMPv2 entity, acting
in an agent role, is reinitializing itself and that its
configuration may have been altered.
EDESC
#
#
#
EVENT warmStart .1.3.6.1.6.3.1.1.5.2 "Status Events" Normal
FORMAT Device reinitialized (warmStart)
EXEC /usr/local/bin/snmptraphandling.py "$r" "SNMP Traps" "$s" "$@" "$-*" "Device reinitialized (warmStart) $*"
SDESC
A warmStart trap signifies that the SNMPv2 entity, acting
in an agent role, is reinitializing itself such that its
configuration is unaltered.
EDESC
#
#
#
EVENT linkDown .1.3.6.1.6.3.1.1.5.3 "Status Events" Critical
FORMAT Link down on interface $1. Admin state: $2. Operational state: $3
EXEC /usr/local/bin/snmptraphandling.py "$r" "SNMP Traps" "$s" "$@" "$-*" "Link down on interface $1. Admin state: $2. Operational state: $3"
SDESC
A linkDown trap signifies that the SNMP entity, acting in
an agent role, has detected that the ifOperStatus object for
one of its communication links is about to enter the down
state from some other state (but not from the notPresent
state). This other state is indicated by the included value
of ifOperStatus.
EDESC
#
#
#
EVENT linkUp .1.3.6.1.6.3.1.1.5.4 "Status Events" Normal
FORMAT Link up on interface $1. Admin state: $2. Operational state: $3
EXEC /usr/local/bin/snmptraphandling.py "$r" "SNMP Traps" "$s" "$@" "$-*" "Link up on interface $1. Admin state: $2. Operational state: $3"
SDESC
A linkUp trap signifies that the SNMP entity, acting in an
agent role, has detected that the ifOperStatus object for
one of its communication links left the down state and
transitioned into some other state (but not into the
notPresent state). This other state is indicated by the
included value of ifOperStatus.
EDESC
#
#
#
EVENT authenticationFailure .1.3.6.1.6.3.1.1.5.5 "Status Events" Warning
FORMAT SNMP athentication failure
EXEC /usr/local/bin/snmptraphandling.py "$r" "SNMP Traps" "$s" "$@" "$-*" "SNMP authentication failure $*"
SDESC
An authenticationFailure trap signifies that the SNMPv2
entity, acting in an agent role, has received a protocol
message that is not properly authenticated. While all
implementations of the SNMPv2 must be capable of generating
this trap, the snmpEnableAuthenTraps object indicates
whether this trap will be generated.
EDESC

 

 

Restart snmptt Service

The command for restarting the snmptt service will differ depending on your operating system:

 

RHEL 7+ | CentOS 7+ | Oracle Linux 7+ | Debian | Ubuntu 16/18/20

systemctl restart snmptt.service

 

 

 

Final Thoughts

For any support related questions please visit the Nagios Support Forums at:

http://support.nagios.com/forum/

3 (2)
Article Rating (2 Votes)
Rate this article
  • Icon PDFExport to PDF
  • Icon MS-WordExport to MS Word
Attachments Attachments
There are no attachments for this article.
Related Articles RSS Feed
Nagios XI - Receiving IPv6 SNMP Traps
Viewed 7836 times since Thu, Apr 28, 2016
SNMP Trap - snmptt Service
Viewed 41150 times since Tue, Mar 24, 2015
SNMP Traps - Standard Handler vs Embedded Handler
Viewed 12176 times since Mon, Oct 24, 2016
Nagios XI - Receiving SNMP Traps From Nagios Network Analyzer
Viewed 5807 times since Mon, Oct 17, 2016
Nagios XI - SNMPTT Service generates Cannot find module errors
Viewed 5239 times since Sun, Apr 9, 2017
SNMP Trap - Firewall Rules
Viewed 22612 times since Tue, Mar 24, 2015
Nagios XI - SNMP Trap Hardening
Viewed 10725 times since Tue, Nov 6, 2018
Nagios XI - SNMP Traps with NXTI
Viewed 4532 times since Tue, Sep 18, 2018
SNMP traps are now showing UNKNOWN for the sender IP
Viewed 3652 times since Tue, Jan 19, 2021
SNMP Trap - How To Send A Test Trap
Viewed 210674 times since Fri, Apr 1, 2016