I am having some trouble configuring snmptt to properly translate snmp traps.
The following is a problem:
/etc/snmp/snmptt.conf reflects:
EVENT fgFmTrapIfChange .1.3.6.1.4.1.12356.101.6.0.1004 "Status Events" Critical
FORMAT $*
EXEC /usr/local/nagios/libexec/eventhandlers/submit_check_result $r "snmp_traps" 2 "$O: $+*" "$*"
SDESC
Trap is sent to the managing FortiManager if an interface IP is changed
Variables:
1: fnSysSerial
2: ifName
3: fgManIfIp
4: fgManIfMask
EDESC
when a trap is received, /var/log/messages reflects:
Sep 6 12:07:32 SNMPMANAGERHOST snmptrapd[15385]:
2012-09-06 12:07:32 <UNKNOWN>
[UDP:
[192.168.100.2]:162->[192.168.100.31]]:
#012.1.3.6.1.2.1.1.3.0 = Timeticks: (707253943) 81 days, 20:35:39.43
#011.1.3.6.1.6.3.1.1.4.1.0 = OID: .1.3.6.1.4.1.12356.101.6.0.1004
#011.1.3.6.1.4.1.12356.100.1.1.1.0 = STRING: FGTNNNNNNNNN
#011.1.3.6.1.2.1.31.1.1.1.1.10 = STRING: internal4
#011.1.3.6.1.4.1.12356.101.6.2.1.0 = IpAddress: 192.168.65.100
#011.1.3.6.1.4.1.12356.101.6.2.2.0 = IpAddress: 255.255.255.0
Sep 6 12:07:37 SNMPMANAGERHOST icinga:
EXTERNAL COMMAND:
PROCESS_SERVICE_CHECK_RESULT;
192.168.100.2;
snmp_traps;
2;
enterprises.12356.101.6.0.1004: enterprises.12356.100.1.1.1.0:FGTNNNNNNNNN ifName.10:internal4 enterprises.12356.101.6.2.1.0:192.168.65.100 enterprises.12356.101.6.2.2.0:255.255.255.0
Since the icinga entry reflects the EXEC, it's obvious there is no translations occurring by snmptt.
I have verified that translate_log_trap_oid and net_snmp_perl_enable is enabled in snmptt.ini
When using --debug=1 to start snmptt, I see the following in the --debugfile:
********** Net-SNMP version 5.05 Perl module enabled **********
The main NET-SNMP version is reported as NET-SNMP version: 5.5.
What else can be done to verify that snmptt is configured properly to translate traps?
I have run snmptt-net-snmp-test to verify whatever net-snmp-perl version I have installed properly supports translations. The output indicates it does.
/root/snmptt_1.3/snmptt-net-snmp-test --best_guess=2
SNMPTT Net-SNMP Test v1.0
(c) 2003 Alex Burger
http://snmptt.sourceforge.net
MIBS:RFC1213-MIB
best_guess: 2
Testing translateObj
********************
Testing: .1.3.6.1.2.1.1.1, long_names=disabled, include_module=disabled
Test passed. Result: sysDescr
Testing: .1.3.6.1.2.1.1.1, long_names=disabled, include_module=enabled
Test passed. Result: RFC1213-MIB::sysDescr
Testing: .1.3.6.1.2.1.1.1, long_names=enabled, include_module=disabled
Test passed. Result: .iso.org.dod.internet.mgmt.mib-2.system.sysDescr
Testing: .1.3.6.1.2.1.1.1, long_names=enabled, include_module=enabled
Test passed. Result: RFC1213-MIB::.iso.org.dod.internet.mgmt.mib-2.system.sysDescr
Testing: sysDescr, long_names=disabled, include_module=disabled
Test passed. Result: .1.3.6.1.2.1.1.1
Testing: RFC1213-MIB::sysDescr, long_names=disabled, include_module=disabled
Test passed. Result: .1.3.6.1.2.1.1.1
Testing: system.sysDescr, long_names=disabled, include_module=disabled
Test passed. Result: .1.3.6.1.2.1.1.1
Testing: RFC1213-MIB::system.sysDescr, long_names=disabled, include_module=disabled
Test passed. Result: .1.3.6.1.2.1.1.1
Testing: .iso.org.dod.internet.mgmt.mib-2.system.sysDescr, long_names=disabled, include_module=disabled
Test passed. Result: .1.3.6.1.2.1.1.1
Testing getType
***************
Testing: .1.3.6.1.2.1.4.1
Test passed. Result: INTEGER
Testing: ipForwarding
Test passed. Result: INTEGER
Testing Description
*******************
Test passed. Result:
-------------------------------------------------
The indication of whether this entity is acting
as an IP gateway in respect to the forwarding of
datagrams received by, but not addressed to, this
entity. IP gateways forward datagrams. IP hosts
do not (except those source-routed via the host).
Note that for some managed nodes, this object may
take on only a subset of the values possible.
Accordingly, it is appropriate for an agent to
return a `badValue' response if a management
station attempts to change this object to an
inappropriate value.
-------------------------------------------------
I have manually gone through the MIB with the definition that's not resolving, and verified that it is properly linking back to the proper resolved definition. It is:
FORTINET-FORTIGATE-MIB.txt contains:
fgFmTrapIfChange NOTIFICATION-TYPE
OBJECTS { fnSysSerial, ifName, fgManIfIp, fgManIfMask }
STATUS current
DESCRIPTION
"Trap is sent to the managing FortiManager if an interface IP is changed"
::= { fgFmTrapPrefix 1004 }
fgFmTrapPrefix OBJECT IDENTIFIER
::= { fgMgmt 0 }
fgMgmt OBJECT IDENTIFIER
::= { fnFortiGateMib 6 }
fnFortiGateMib
::= { fortinet 101 }
IMPORTS
FnBoolState, FnIndex, fnAdminEntry, fnSysSerial, fortinet
FROM FORTINET-CORE-MIB
fortinet MODULE-IDENTITY
::= { enterprises 12356 }
LOOKS GOOD!!!!!
1.3.6.1.4.1.12356.101.6.0.1004
I've exhausted all the documentation and even posted fruitlessly in the snmptt-users mailing list.
I can not prove it is the MIB.
Why would snmptt fail to translate traps?
Thanks,
Matt
