last day (15 days later) » 

14:26
2
Q: snmptt not translating traps, even with translate_log_trap_oid=1

mbrownnycI am having some trouble configuring snmptt to properly translate snmp traps. The following is a problem: /etc/snmp/snmptt.conf reflects: EVENT fgFmTrapIfChange .1.3.6.1.4.1.12356.101.6.0.1004 "Status Events" Critical FORMAT $* EXEC /usr/local/nagios/libexec/eventhandlers/submit_check_result $...

Can you post your snmptt.ini? How are you starting snmptt?
original question updated with: snmptt. snmptrapd.conf snmptt.conf, trap MIB and MIB referenced for trap definition.
So, are you using nagios or icinga? I haven't used icinga at all, but does it install utilities in /usr/local/nagios?
What utilities are you concerned with? icinga and nagios are essentially the same thing. My concern isn't with icinga alerting; as the passive services are configured and the pipe is functioning. It is the script that pipes data into the FIFO that is the command pipe for icinga/nagios is not being provided with the correctly translated data. This translated data is a result of snmptt translating the OID of received traps.
directly /usr/local/nagios/libexec/eventhandlers/submit_check_result exists and can be executed by snmptt. See my roll out document.
The submit_check_result utility. Your snmptt.conf is trying to exec /usr/local/nagios/libexec/eventhandlers/submit_check_result. Now, I set up snmptt with nagios back in June, so the details are starting to get fuzzy. Your configs look good (near as I can tell)and your logfiles contain data that is similar enough to mine. I don't think nagios/icinga care about the trap being translated, just that specific oids are handed off to the eventhandler with the proper message.
14:27
howdy
hey, that blog page was the same one I used to get this working with nagios
are any of your traps alerting properly through icinga?
D.F. that's funny, because I wrote it :D
glad you used it
and it worked for you, just not me :D
heh
no I meant the askar ali khan one
ahh okay :D
well, yes, so anyway... snmptt should translate the OID as I tell it to
I am using what... EXEC /usr/local/nagios/libexec/eventhandlers/submit_check_result $r "snmp_traps" 2 "$O: $+*"
I can't remember if I used yours or not, there were two or three in total (I like to try and get multiple views on the same issue) but his good for me
14:31
so, $O should take the OID and return the shortname
which is does in the cases of linkUpand linkDown for instance
the problem seems related to these MIBs that aren't default MIBs
the translation doesn't take place beyond enterprise....
hrm
but the translation should take place for the least common OID qualified
well, my snmptt.log doesn't seem to do any translation --
Tue Sep 4 01:58:54 2012 .1.3.6.1.4.1.2947.1.0.46 Normal "Status Events" parkview-ups - WARNING: The ups has been given shutdown command WARNING: The UPS has been given a shutdown command by the management station.
do you understand what I'm saying? if NO translations were to take place, then there's something wrong with the "dictionary", but since linkUp is working, then the "dictionary" is working
so the "dictionary lookups" for the OIDs from these "proprietary MIBs" is failing
but why?
yeah, I get it
14:33
the snmptt.log may not
but the icinga log will
because the icinga log reflects the actual incoming command into the command pipe
is icinga logging anything about these traps at all?
what does it look like?
icinga logs the traps, and in fact affects the passive service as configured
it's there in the original post, hold on one moment
EXTERNAL COMMAND:
PROCESS_SERVICE_CHECK_RESULT;
192.168.100.2;
snmp_traps;
2;
enterprises.12356.101.6.0.1004: enterprises.12356.100.1.1.1.0:FGTNNNNNNNNN ifName.10:internal4 enterprises.12356.101.6.2.1.0:192.168.65.100 enterprises.12356.101.6.2.2.0:255.255.255.0
I just "new lined" this for flow
you see: $O = enterprises.12356.101.6.0.1004
when $O should be fgFmTrapIfChange
i have to step away for like 3-5 minutes
ok, let me take a look at my nagios.log
14:40
back
thanks for your help!
let me know if you find something interesting
this is such an annoying weird problem
14:55
sorry, I had to wander away for a sec
I know I had some strange revelation about how this all works, but of course that wasn't in any of the notes that I took
the reason I'm wondering about mundane stuff like paths is I did have some stranger errors when I started this, but that was due to migrating nagios off a really ancient sun server
so, 'submit_check_result' had the wrong path to the nagios.cmd file
ahh yes, I correct that as piping the external commands into the command pipe works
(I did have that originally as well)
let me know if you find anything else man
I'm going to test another (third party) MIB
thanks for your help
ok
I'm trying to find all my notes related to this
unfortunately, I finished this just before a long vacation, so some of them are a bit scattered
aha!
What are your snmptrapd options?
/etc/sysconfig/snmptrapd.options
mine were purposefully set to '-On -Lsd -p /var/run/snmptrapd.pid'
ah crap, nevermind
that would allow snmptrapd to do the translation, not snmptt
there was one other thing with snmptt.conf, and I'll see if I can figure out what I had to do there
after that, I'll stop annoying you with unhelpful suggestions
15:46
well, this is the last shot
I think this might actually be it, when checking my snmptt.ini file -- >
grep ^translate snmptt.ini
translate_log_trap_oid = 0
translate_value_oids = 1
translate_enterprise_oid_format = 1
translate_trap_oid_format = 1
translate_varname_oid_format = 1
translate_integers = 1
and yours is -->
grep ^translate snmptt-SF.txt
translate_log_trap_oid = 1
translate_value_oids = 1
translate_enterprise_oid_format = 1
translate_trap_oid_format = 0
translate_varname_oid_format = 0
translate_integers = 1
The big one here is 'translate_trap_oid' which 'Configures how the symbolic trap OID will be displayed for $O.'
values of 0-4 are valid, but at 0 it disables translating OID values, 1 sets it to short text, which appears to be what you want

last day (15 days later) »