This KB article explains the differences between the Standard and Embedded handler for processing SNMP Traps.
Detailed steps are provided to configure Nagios XI to use either method (the standard handler is the default used).
Nagios XI 5.5 comes with SNMP Traps enabled by default. If you have an earlier version of Nagios XI SNMP Traps needs to be installed by following this guide:
How to Integrate SNMP Traps With Nagios XI
Editing Files
In many steps of this article you will be required to edit files. This documentation will use the vi text editor. When using the vi
editor:
SNMPTRAPD and SNMPTT
Receives the SNMP Traps from the network
It can accept or reject the traps depending on it's configuration
Nagios XI accepts v1 & v2c traps from any source by default
v3 traps require additional configuration due to the security nature of v3 traps
Spools the traps so SNMPTT can process them
Processes the spooled traps from SNMPTRAPD
Responsible for filtering the types of traps that are forwarded to Nagios XI
Allows Nagios to receive send alerts based on the trap states received from SNMPTT
Both of these components are used to receive and process SNMP Traps sent to the Nagios XI server.
Standard vs Embedded Handler
The handler is the program used by SNMPTRAPD to spool the trap for SNMPTT.
The difference between the two is as follows:
Each time a trap is received, a process must be created to run the snmptthandler program
SNMPv3 EngineID and names are not passed by SNMPTRAPD to snmptthandler (SNMP v3 traps will still be processed correctly)
Suitable for most standard installations
The handler is loaded and initialized when SNMPTRAPD is started, so there is less overhead as a new process does not need to be created and initialization is done only once
SNMPv3 EngineID and names variables are available in SNMPTT (B* variables)
Recommended if there is a high volume of traps being received
Standard Handler Configuration
The standard handler is enabled by default on Nagios XI. This is configured with the following line in the /etc/snmp/snmptrapd.conf file:
traphandle default /usr/sbin/snmptthandler
Enhanced Handler Configuration
The enhanced handler can be enabled by making the following configuration changes.
Edit the /etc/snmp/snmptrapd.conf file:
Remove this line:
traphandle default /usr/sbin/snmptthandler
Add this line (as per your operating system distribution):
RHEL | CentOS | Oracle Linux
perl do "/usr/share/snmptt/snmptthandler-embedded";
Debian | Ubuntu
perl do "/usr/lib/snmptt/snmptthandler-embedded";
You also need to edit the INIT script to add an extra option. The steps are slightly different depending on the operating system version being used.
RHEL 7+| CentOS 7+ | Oracle Linux 7+
Edit the /etc/sysconfig/snmptrapd file:
Add this line:
OPTIONS="-Lsd -On"
Now restart the SNMPTRAPD service:
systemctl daemon-reload
systemctl restart snmptrapd.service
Debian
Edit the /etc/default/snmptrapd file:
Find this line:
TRAPDOPTS='-Lsd -p /run/snmptrapd.pid'
Add -On to the line:
TRAPDOPTS='-Lsd -On -p /run/snmptrapd.pid'
Now restart the SNMPTRAPD service:
systemctl daemon-reload
systemctl restart snmptrapd.service
Ubuntu 16/18/20
Edit the /etc/default/snmptrapd file:
Find this line:
TRAPDOPTS='-Ln -p /run/snmptrapd.pid'
Add -On to the line:
TRAPDOPTS='-Ln -On -p /run/snmptrapd.pid'
Now restart the SNMPTRAPD service:
systemctl daemon-reload
systemctl restart snmptrapd.service
Test
If you changed the handler method above you can test it's working by sending a test trap. Please refer to this article:
Resources
The SNMPTT documentation was the basis for this KB article and is a very handy for understanding how SNMPTT works.
Final Thoughts
For any support related questions please visit the Nagios Support Forums at:
http://support.nagios.com/forum/
Article ID: 557
Created On: Mon, Oct 24, 2016 at 12:03 AM
Last Updated On: Wed, Jan 13, 2021 at 4:34 PM
Authored by: tlea
Online URL: https://support.nagios.com/kb/article/snmp-traps-standard-handler-vs-embedded-handler-557.html