Trapsnmp nagios

hello,

i would like to do any trapsnmp with nagios on opensuse, but i’ve a problem with the configuration.

i’m reading tutorial about trapsnmp and they tell me to configure the snmptrapd.conf file on /etc/init.d/snmptrapd.conf and put that in “OPTIONS=”-On -Lsd -p /var/run/snmptrapd.pid", but i don’t have this file on my suse. i just have snmpd.conf

must i used snmpd.conf ? if yes could you tell me how i must include this line “OPTIONS=”-On -Lsd -p /var/run/snmptrapd.pid""

SNMPD.conf

case “$1” in
start)
echo -n “Starting snmpd”

do not even try to start if the log file is (2GB-1MB) big.

the snmpd doesnt handle LFS properly

SNMPD_LOGFILE="${SNMPD_LOGFILE:-/var/log/net-snmpd.log}"
if -e “$SNMPD_LOGFILE” ] ; then
SNMPD_SIZE_LOGFILE="$(stat -c “%s” $SNMPD_LOGFILE)"
SNMPD_SIZE_MAX=“1073741824”
if $SNMPD_SIZE_LOGFILE -gt $SNMPD_SIZE_MAX ] ; then
echo -e "
“$SNMPD_LOGFILE” was to large. Running ‘logrotate’ for net-snmp." >&2
/usr/sbin/logrotate /etc/logrotate.d/net-snmp
fi # if $SNMPD_SIZE_LOGFILE -gt $SNMPD_SIZE_MAX ] ; then
fi # if -e “$SNMPD_LOGFILE” ] ; then
get_agents

Do not add -c /etc/snmpd.conf, since it is already loaded by default.

if $SNMPDCONF = “/etc/snmp/snmpd.conf” ]; then
SNMPDCONF=""
else
SNMPDCONF="-c $SNMPDCONF"
fi
case “${SNMPD_USE_SMUX:-yes}” in
[Nn][Oo])
SNMPDNOSMUX="-I -smux"
;;
esac
case “${SNMPD_LOG_SUCCESSFUL_CONNECTIONS:-yes}” in
[Nn][Oo])
SNMPDNOTCPWRAPPERLOG="–dontLogTCPWrappersConnects"
;;
esac
startproc $SNMPD $SNMPDCONF -r -A -LF ${SNMPD_LOGLEVEL:-d} $SNMPD_LOGFILE -p /var/run/snmpd.pid $agentargs $SNMPDNOSMUX $SNMPDNOTCPWRAPPERLOG
rc_status -v
rc_reset

start all agents

if test -n “$agents”; then
usleep 300000
for agent in $agents; do
echo -en " Starting basename $agent"
startproc -t1 $agent
rc_status -v ; rc_reset
done
fi
;;
stop)
echo -n “Shutting down snmpd:”
killproc -TERM $SNMPD
rc_status -v ; rc_reset

we also need to make sure all agents die

get_agents
if test -n “$agents”; then
for agent in $AGENTDIR/*; do
test -x $agent || continue
echo -ne " Shutting down basename $agent:"
killproc $agent
rc_status -v ; rc_reset
done
fi
;;
try-restart)
$0 status >/dev/null && $0 restart
rc_status
;;
restart)
$0 stop
$0 start
rc_status
;;
force-reload)
echo -n “Reload service snmpd:”
killproc -HUP $SNMPD
rc_status -v
;;
reload)
echo -n “Reload service snmpd:”
killproc -HUP $SNMPD
rc_status -v
;;
status)
echo -n “Checking for service snmpd:”
checkproc $SNMPD
rc_status -v
get_agents
if test -n “$agents”; then
echo -e “Checking for agents:”

for agent in $agents; do
echo -en " basename $agent"
checkproc $agent
rc_status -v
done
fi
;;
*)
echo “Usage: $0 {start|stop|try-restart|restart|force-reload|reload|status}”
exit 1
;;
esac
rc_exit

Hi
Don’t think multimedia was the correct place to post this :wink:

You need to create the snmptrap.conf file see the man page;

man snmptrapd.conf

“The Net-SNMP notification receiver (trap daemon) uses one or
more configuration files to control its operation and how incoming
traps (and INFORM requests) should be processed. This file
(snmptrapd.conf) can be located in one of several locations, as
described in the snmp_config(5) manual page.”


Cheers Malcolm °¿° (Linux Counter #276890)
SUSE Linux Enterprise Desktop 11 (x86_64) Kernel 2.6.27.23-0.1-default
up 11:58, 2 users, load average: 0.07, 0.19, 0.15
GPU GeForce 8600 GTS Silent - Driver Version: 185.18.14

yes i 've created this file

SNMPTRAPD.conf (etc/snmp/)
traphandle default /usr/sbin/snmptt
disableAuthorization yes
donotlogtraps yes

and

snmp.conf

com2sec Local 103.2.4.0/24 rtvyti

group rogroup v1 Local

view all included .1 80

prefixe lecture ecriture notification

Hi
Have you manually started snmptrapd from the command line to see if
it’s working ok? (you may want to enable logging to start with)


snmptrapd&


Cheers Malcolm °¿° (Linux Counter #276890)
SUSE Linux Enterprise Desktop 11 (x86_64) Kernel 2.6.27.23-0.1-default
up 12:51, 2 users, load average: 0.07, 0.02, 0.00
GPU GeForce 8600 GTS Silent - Driver Version: 185.18.14

when i do snmptrapd& i’ve that :

linux-fxqr:/var/log # snmptrapd&
[11] 21832

what can i do now lol

Hi
So if you use ps -ef you see the process running ok? Have you tried
sending a test trap and see if it’s detected?

eg;


snmptrap -v 2c -m ALL -c public localhost '' coldStart


Cheers Malcolm °¿° (Linux Counter #276890)
SUSE Linux Enterprise Desktop 11 (x86_64) Kernel 2.6.27.23-0.1-default
up 14:49, 3 users, load average: 0.22, 0.10, 0.02
GPU GeForce 8600 GTS Silent - Driver Version: 185.18.14

yes,

linux-fxqr:/var/log # ps -ef | grep snmptrapd
root 21833 1 0 08:56 ? 00:00:00 snmptrapd

but when i do :

snmptrap -v 1 -m ALL -c loiuc localhost ‘’ coldStart

i’ve

linux-fxqr:/var/log # snmptrap -v 1 -c loiuc localhost ‘’ coldStart
/etc/snmp/snmp.conf: line 6: Warning: Unknown token: com2sec.
/etc/snmp/snmp.conf: line 13: Warning: Unknown token: group.
/etc/snmp/snmp.conf: line 18: Warning: Unknown token: view.
/etc/snmp/snmp.conf: line 22: Warning: Unknown token: access.
unknown host: coldStart

My SNMP.conf

com2sec Local 192.168.77.0/24 loiuc
group rogroup v1 Local
view all included .1 80
access rogroup “” v1 noauth exact all none none


but about snmptrap, how can i do to restart … because snmptrapd& isn’t really good, why i do not have this file on /init.d/… only snmpd…
thanks

Hi
Don’t think you have configured up snmpd.conf quite correctly. To start
just run as root user;


snmpconf -g basic_setup

The startup file is not in /etc/init.d by default, to add run the
following;


sudo
cp /usr/share/doc/packages/net-snmp/rc.snmptrapd /etc/init.d/snmptrapd
sudo chmod 755 /etc/init.d/snmptrapd
sudo /sbin/chkconfig snmptrapd on


Cheers Malcolm °¿° (Linux Counter #276890)
SUSE Linux Enterprise Desktop 11 (x86_64) Kernel 2.6.27.23-0.1-default
up 1 day 9:55, 2 users, load average: 0.08, 0.09, 0.03
GPU GeForce 8600 GTS Silent - Driver Version: 185.18.14

Thanks for the help malcolmlewis

in my /etc/snmp/ i’ve snmpd.conf and snmptrapd.conf

Snmpd.conf

Please see /usr/share/doc/packages/net-snmp/EXAMPLE.conf for a

more complete example and snmpd.conf(5).

Writing is disabled by default for security reasons. If you’d like

to enable it uncomment the rwcommunity line and change the community

name to something nominally secure (keeping in mind that this is

transmitted in clear text).

don’t use ’ < > in strings for syslocation or syscontact

Note that if you define the following here you won’t be able to change

them with snmpset

syslocation salleserver
syscontact Sysadmin (root@localhost)

These really aren’t meant for production use. They include all MIBS

and can use considerable resources. See snmpd.conf(5) for information

on setting up groups and limiting MIBS.

rocommunity test 127.0.0.1
rocommunity test 192.168.20.16

rwcommunity mysecret 127.0.0.1

and

snmptrapd.conf

traphandle default /usr/sbin/snmptt
disableAuthorization yes
donotlogtraps yes

i’m going to test with on my hp procurve, i tell you what

hi,

i would like to put that in my nagios file configuration :

define service{
name generic-service
register 0
check_period 24x7
max_check_attempts 3
normal_check_interval 15
retry_check_interval 5
active_checks_enabled 1
passive_checks_enabled 0
parallelize_check 1
obsess_over_service 0
check_freshness 0
event_handler_enabled 0
flap_detection_enabled 0
process_perf_data 1
retain_status_information 1
retain_nonstatus_information 1
notification_interval 60
notification_period 24x7
notification_options w,u,c,r
notifications_enabled 1
}

define service{
name snmptrap-service
use generic-service
register 0
service_description TRAP
is_volatile 1
check_command check-host-alive
max_check_attempts 1
normal_check_interval 1
retry_check_interval 1
passive_checks_enabled 1
check_period none
notification_interval 31536000
contact_groups toutlemonde
}

but i don’t have services file

drwxrwxr-x 2 nagios nagios 4096 juin 15 15:27 ./
drwxrwxr-x 3 nagios nagios 4096 juin 15 15:29 …/
-rw-rw-r-- 1 nagios nagios 7722 juin 15 15:27 commands.cfg
-rw-rw-r-- 1 nagios nagios 7722 juin 15 15:25 commands.cfg~
-rw-rw-r-- 1 nagios nagios 2166 juin 15 15:27 contacts.cfg
-rw-rw-r-- 1 nagios nagios 2166 juin 15 15:25 contacts.cfg~
-rw-rw-r-- 1 nagios nagios 5403 juin 15 15:27 localhost.cfg
-rw-rw-r-- 1 nagios nagios 5403 juin 15 15:25 localhost.cfg~
-rw-rw-r-- 1 nagios nagios 3124 juin 15 15:27 printer.cfg
-rw-rw-r-- 1 nagios nagios 3124 juin 15 15:25 printer.cfg~
-rw-rw-r-- 1 nagios nagios 3293 juin 15 15:27 switch.cfg
-rw-rw-r-- 1 nagios nagios 3293 juin 15 15:25 switch.cfg~
-rw-rw-r-- 1 nagios nagios 10812 juin 15 15:27 templates.cfg
-rw-rw-r-- 1 nagios nagios 10812 juin 15 15:25 templates.cfg~
-rw-rw-r-- 1 nagios nagios 3209 juin 15 15:27 timeperiods.cfg
-rw-rw-r-- 1 nagios nagios 3209 juin 15 15:25 timeperiods.cfg~
-rw-rw-r-- 1 nagios nagios 4007 juin 15 15:27 windows.cfg
-rw-rw-r-- 1 nagios nagios 4007 juin 15 15:25 windows.cfg~

thks

well, i summury what i do :

“trapsnmp for Switch HP procurve”

yast -i snmp snmptt

/etc/snmp/snmptrapd.conf

traphandle default /usr/sbin/snmptthandler
disableAuthorization yes
donotlogtraps yes

/etc/snmp/snmpd.conf

com2sec local localhost test
com2sec local 10.34.44.0/24 test

group rogroup v1 local

view all included .1

access rogroup “” any noauth exact all none none

-----snmptt-----
cp /usr/src/snmptt_1.2/snmptt /usr/sbin/
chmod +x /usr/sbin/
cp /usr/src/snmptt_1.2/snmptthandler /usr/sbin/
chmod +x /usr/sbin/snmptthandler
cp /usr/src/snmptt_1.2/snmptt.ini /etc/snmp/

standlone mode
add this line to “snmptrapd.conf”
traphandle default /usr/sbin/snmptt

after

sudo
cp /usr/share/doc/packages/net-snmp/rc.snmptrapd /etc/init.d/snmptrapd
sudo chmod 755 /etc/init.d/snmptrapd
sudo /sbin/chkconfig snmptrapd on

–snmptt.ini–

SNMPTT v1.2 Configuration File

Linux / Unix

[General]

Name of this system for $H variable. If blank, system name will be the computer’s

hostname via Sys::Hostname.

snmptt_system_name =

Set to either ‘standalone’ or ‘daemon’

standalone: snmptt called from snmptrapd.conf

daemon: snmptrapd.conf calls snmptthandler

Ignored by Windows. See documentation

mode = standalone

Set to 1 to allow multiple trap definitions to be executed for the same trap.

Set to 0 to have it stop after the first match.

This option should normally be set to 1. See the section 'SNMPTT.CONF Configuration

file Notes’ in the SNMPTT documentation for more information.

Note: Wildcard matches are only matched if there are NO exact matches. This takes

into consideration the NODES list. Therefore, if there is a matching trap, but

the NODES list prevents it from being considered a match, the wildcard entry will

only be used if there are no other exact matches.

multiple_event = 1

SNMPTRAPD passes the IP address of device sending the trap, and the IP address of the

actual SNMP agent. These addresses could differ if the trap was sent on behalf of another

device (relay, proxy etc).

If DNS is enabled, the agent IP address is converted to a host name using a DNS lookup

(which includes the local hosts file, depending on how the OS is configured). This name

will be used for: NODES entry matches, hostname field in logged traps (file / database),

and the $A variable. Host names on the NODES line will be resolved and the IP address

will then be used for comparing.

Set to 0 to disable DNS resolution

Set to 1 to enable DNS resolution

dns_enable = 0

Set to 0 to enable the use of FQDN (Fully Qualified Domain Names). If a host name is

passed to SNMPTT that contains a domain name, it will not be altered in any way by

SNMPTT. This also affects resolve_value_ip_addresses.

Set to 1 to have SNMPTT strip the domain name from the host name passed to it. For

example, server01.domain.com would be changed to server01

Set to 2 to have SNMPTT strip the domain name from the host name passed to it

based on the list of domains in strip_domain_list

strip_domain = 0

List of domain names that should be stripped when strip_domain is set to 2.

List can contain one or more domains. For example, if the FQDN of a host is

server01.city.domain.com and the list contains domain.com, the ‘host’ will be

set as server01.city.

strip_domain_list = <<END
domain.com
END

Configures how IP addresses contained in the VALUE of the variable bindings are handled.

This only applies to the values for $n, $+n, $-n, $vn, $+, $-.

Set to 0 to disable resolving ip address to host names

Set to 1 to enable resolving ip address to host names

Note: net_snmp_perl_enable must be enabled. The strip_domain settings influence the

format of the resolved host name. DNS must be enabled (dns_enable)

resolve_value_ip_addresses = 0

Set to 1 to enable the use of the Perl module from the UCD-SNMP / NET-SNMP package.

This is required for $v variable substitution to work, and also for some other options

that are enabled in this .ini file.

Set to 0 to disable the use of the Perl module from the UCD-SNMP / NET-SNMP package.

Note: Enabling this with stand-alone mode can cause SNMPTT to run very slowly due to

the loading of the MIBS at startup.

net_snmp_perl_enable = 1

[Logging]

Set to 1 to enable messages to be sent to standard output, or 0 to disable.

Would normally be disabled unless you are piping this program to another

stdout_enable = 0

Set to 1 to enable text logging of TRAPS. Make sure you specify a log_file

location

log_enable = 1

Log file location. The COMPLETE path and filename. Ex: ‘/var/log/snmptt.log’

log_file = /var/log/snmptt.log

Set to 1 to enable text logging of SNMPTT system errors. Make sure you

specify a log_system_file location

log_system_enable = 1

Log file location. The COMPLETE path and filename.

Ex: ‘/var/log/snmpttsystem.log’

log_system_file = /var/log/snmpttsystem.log

Set to 1 to enable logging of unknown traps. This should normally be left off

as the file could grow large quickly. Used primarily for troubleshooting. If

you have defined a trap in snmptt.conf, but it is not executing, enable this to

see if it is being considered an unknown trap due to an incorrect entry or

simply missing from the snmptt.conf file.

Unknown traps can be logged either a text file, a SQL table or both.

See SQL section to define a SQL table to log unknown traps to.

unknown_trap_log_enable = 1

Unknown trap log file location. The COMPLETE path and filename.

Ex: ‘/var/log/snmpttunknown.log’

Leave blank to disable logging to text file if logging to SQL is enabled

for unknown traps

unknown_trap_log_file = /var/log/snmpttunknown.log

[TrapFiles]

A list of snmptt.conf files (this is NOT the snmptrapd.conf file). The COMPLETE path

and filename. Ex: ‘/etc/snmp/snmptt.conf’

snmptt_conf_files = <<END
/etc/snmp/snmptt.conf

END

after i compile hp mibs:

they say ( This means that for each “MIB” in the first column, the “DEPENDENT MIBs” listed in the second column must be compiled first before the “MIB” can be compiled.)

hpicfLinktest.mib (HP-ICF-LINKTEST)

rfc2578.mib (SNMPv2-SMI)
rfc2579.mib (SNMPv2-TC)
rfc2819.mib (RMON-MIB)
hpicfOid.mib (HP-ICF-OID)

cp rfc2578.mib rfc2579.mib rfc2819.mib hpicfOid.mib /usr/share/snmp/mibs/

ex:

snmpttconvertmib --in=/usr/share/snmp/mibs/rfc2819.mib --out=/etc/snmp/snmptt.conf.procurve --exec=’/usr/local/nagios/libexec/eventhandlers/submit_check_result $r TRAP 1’

exec: /usr/local/nagios/libexec/eventhandlers/submit_check_result $r TRAP 1

i add in my snmptt.ini

[TrapFiles]

A list of snmptt.conf files (this is NOT the snmptrapd.conf file). The COMPLETE path

and filename. Ex: ‘/etc/snmp/snmptt.conf’

snmptt_conf_files = <<END
/etc/snmp/snmptt.conf
/etc/snmp/snmptt.conf.procurve
END

after :

i go to localhost.cfg for configure :

define host{
use linux-server ; Name of host template to use
; This host definition will inherit all variables that are defined
; in (or inherited by) the linux-server host template definition.
host_name linux-fxqr
alias linux-fxqr
address 10.34.44.23
}

SERVICE DEFINITIONS

define service{
name snmptrap-service
use generic-service
register 0
service_description TRAP
is_volatile 1
check_command check-host-alive
max_check_attempts 1
normal_check_interval 1
retry_check_interval 1
passive_checks_enabled 1
check_period none
notification_interval 31536000
contact_groups toutlemonde
}

after

/etc/init.d/nagios restart

Running configuration check…done.
Stopping nagios: done.
Starting nagios: done.

/etc/init.d/snmptrapd restart

Shutting down snmptrapd: done
Starting snmptrapd: done

/etc/init.d/snmpd restart

Shutting down snmpd: done
Starting snmpd done

when i tested with:
snmpwalk -v 1 -c test localhost => ok
snmpwalk -v 1 -c test Myswitch => ok

but i don’t have traps…
thks for your help

hello,
it’s ok

hello

in my services i’ve “Service is not scheduled to be checked…”

thks for help

Hi
So your traps are being generated ok now, but it’s just the nagios
configuration now?

Sorry I may be slow in replying as there are some family matters that
have needed my attention…


Cheers Malcolm °¿° (Linux Counter #276890)
SUSE Linux Enterprise Desktop 11 (x86_64) Kernel 2.6.27.23-0.1-default
up 3 days 1:32, 2 users, load average: 0.14, 0.09, 0.08
GPU GeForce 8600 GTS Silent - Driver Version: 185.18.14

hello,

i don’t know really if all running correctly, when i go to “services detail” on nagios , i see my service TRAP with " Service is not scheduled to be checked" …

thanks for your help

if you want we can talk more quicly on msn or other

Hi
You need to add your snmp trap command in here;
> -rw-rw-r-- 1 nagios nagios 7722 juin 15 15:27 commands.cfg

Then in the service change it to the name you called it in the file
above
> check_command check-host-alive

Can you also use wireshark of aother packet capture to see the snmp
trap is leaving the host and also on the machine that is running nagios
to see it arrive ok.


Cheers Malcolm °¿° (Linux Counter #276890)
SUSE Linux Enterprise Desktop 11 (x86_64) Kernel 2.6.27.23-0.1-default
up 5 days 7:54, 2 users, load average: 0.86, 0.25, 0.08
GPU GeForce 8600 GTS Silent - Driver Version: 185.18.14

hello , i’ve that in commands.cfg

################################################################################

SAMPLE HOST CHECK COMMANDS

################################################################################

This command checks to see if a host is “alive” by pinging it

The check must result in a 100% packet loss or 5 second (5000ms) round trip

average time to produce a critical error.

Note: Five ICMP echo packets are sent (determined by the ‘-p 5’ argument)

‘check-host-alive’ command definition

define command{
command_name check-host-alive
command_line $USER1$/check_ping -H $HOSTADDRESS$ -w 3000.0,80% -c 5000.0,100% -p 5
}

and i’ve this trapsnmp which arrive

  1. E:11268.2.7.4.1 101.50.41.91 enterpriseSpecific s=3 4289 |snmp]
    10:24:06.430636 IP 101.50.41.91.dls-monitor > 101.50.41.61.snmptrap: C=test Trap(456) E:11268.2.7.4.1 101.50.41.91 enterpriseSpecific s=3 4289 |snmp]
    10:24:06.431980 IP 101.50.41.91.dls-monitor > 101.50.41.61.snmptrap: C=test Trap(456) E:11268.2.7.4.1 101.50.41.91 enterpriseSpecific s=3 4290 |snmp]

Hi
So this is where you need to add a new (define) command to send the
trap and then call that command from your service.

Have you looked at http://exchange.nagios.org/


Cheers Malcolm °¿° (Linux Counter #276890)
SUSE Linux Enterprise Desktop 11 (x86_64) Kernel 2.6.27.23-0.1-default
up 9 days 22:43, 2 users, load average: 0.04, 0.06, 0.07
GPU GeForce 8600 GTS Silent - Driver Version: 185.18.14

Hi
You might also look at SEC - simple event correlator
http://kodu.neti.ee/~risto/sec/ I’ve used this in the past to monitor
logs for events and then send an appropriate event.


Cheers Malcolm °¿° (Linux Counter #276890)
SUSE Linux Enterprise Desktop 11 (x86_64) Kernel 2.6.27.23-0.1-default
up 9 days 22:51, 2 users, load average: 0.14, 0.10, 0.08
GPU GeForce 8600 GTS Silent - Driver Version: 185.18.14