Re: Help with snmptrap

On Fri, 27 Jul 2007 09:59:32 +0100, Dave Shield wrote:

> On 26/07/07, Mateus Interciso <[email protected]> wrote:
>> Hello, I have this snmpd.conf configuration on one host
>>
>> trapsink  10.0.0.4 test
>> trap2sink  10.0.0.4  test
>> informsink  10.0.0.4 test
> 
> Why do you want to send three copies of every notification to the same
> trap receiver?
> 
> 
> 
> 
>> Now, when I start the snmpd on 10.0.0.1 (the SNMP host), the
>> snmptrapd.log shows this
>     [snip]
>> Does this by any chance means that the snmptrap is working fine?
> 
> It means that the agent and "snmptrapd" are working fine. The
> command-line tool "snmptrap" is not relevant here - that is an
> alternative mechanism for sending traps.
>    But the agent is generating traps quite happily - three at a time!
> 
> 
> 
>> snmptrap -v 2c -c public localhost "" NOTIFICATION-TEST-MIB::demo-notif
>> \
>>          SNMPv2-MIB::sysLocation.0 s "just here"
>> but nothing happens.
> 
> Try with   "localhost:162" instead of just "localhost".
> 
> I presume you are running this on the same machine as the trap receiver
> (10.0.0.4), rather than the system with the SNMP agent (10.0.0.1)
> 
> 
> 
>> Also, let's say I have on the snmpd.conf file this:
>>
>> proc  apache2 100 1
>>
>> And let's say that apache2 has stopped, will this triger a trap to the
>> trapserver?
> 
> Not by itself, no.
> Please see the snmpd.conf(5) man page - in particular, the section
> headed ACTIVE MONITORING.
> 
> Dave
> 
> 
-------------------------------------------------------------------------
> This SF.net email is sponsored by: Splunk Inc. Still grepping through
> log files to find problems?  Stop. Now Search log events and
> configuration files using AJAX and a browser. Download your FREE copy of
> Splunk now >>  http://get.splunk.com/
> _______________________________________________ Net-snmp-users mailing
> list
> [email protected]
> Please see the following page to unsubscribe or change other options:
> https://lists.sourceforge.net/lists/listinfo/net-snmp-users

Ok, thanks a lot for the help.
It worked :D(almost)
This is what I've putted on the snmpd.conf file

rouser  test noauth
agentSecName test
monitor -r 5 -o prNames -o prErrMessage "process table" prErrorFlag != 0

And it sucessfully send the trap, as it shows on the snmptrapd.log

2007-07-27 19:05:58 <UNKNOWN> [UDP: [10.0.0.1]:50031]:
DISMAN-EVENT-MIB::sysUpTimeInstance = Timeticks: (118788) 0:19:47.88    
SNMPv2-MIB::snmpTrapOID.0 = OID: DISMAN-EVENT-MIB::mteTriggerFiredDISMAN-
EVENT-MIB::mteHotTrigger.0 = STRING: process table        DISMAN-EVENT-
MIB::mteHotTargetName.0 = STRING:  DISMAN-EVENT-MIB::mteHotContextName.0 
= STRING:    DISMAN-EVENT-MIB::mteHotOID.0 = OID: UCD-SNMP-
MIB::prErrorFlag.1        DISMAN-EVENT-MIB::mteHotValue.0 = INTEGER: 
1       UCD-SNMP-MIB::prNames.1 = STRING: apache2       UCD-SNMP-
MIB::prErrMessage.1 = STRING: Too few apache2 running (# = 0)

But I also want it to execute the command /bin/sh /tmp/trapTst.sh, how to 
do it?
Here's my snmptrapd.conf file on 10.0.0.1

traphandle prErrorFlag "/bin/sh /tmp/trapTst.sh"
traphandle "default" "/bin/sh /tmp/trapTst.sh"
donotlogtraps  no
printeventnumbers  yes
ignoreauthfailure  yes
authCommunity log,execute public
snmpTrapdAddr 10.0.0.4

Thanks a lot for the help :D


-------------------------------------------------------------------------
This SF.net email is sponsored by: Splunk Inc.
Still grepping through log files to find problems?  Stop.
Now Search log events and configuration files using AJAX and a browser.
Download your FREE copy of Splunk now >>  http://get.splunk.com/
_______________________________________________
Net-snmp-users mailing list
[email protected]
Please see the following page to unsubscribe or change other options:
https://lists.sourceforge.net/lists/listinfo/net-snmp-users