Traps
"Matthew Camilleri" <[email protected]>
| Newsgroups | gmane.network.net-snmp.user |
|---|---|
| Message-ID | <[email protected]> |
Hi all, I am currently doing a project regarding traps and would like to help me in this issue. I am knew to the trap world J and thought that by posting this mail helps me move forward in this project. First of all I will begin exactly from the very beginning, i.e. the net-snmp installation for monitoring. Before setting up traps, I started in installing the SNMP agent on the machines I wanted to monitor. The machines consisted mainly of Solaris 9 and 10 machines. The installation was performed successfully and I managed to be able to monitor these machines via the cacti software ( http://www.cacti.net/). The configuration file for this daemon is the snmpd.conf file (attached). For traps the configuration file snmptrapd.conf was modified as per attached. Now from here the headache starts... I was able to know that traps were being sent since I was generating them (example, bring up the size of a harddisk, as set in the snmpd.conf) and viewing the traps in a WireShark trace. For your perusal I have also attached a trace when a trap was sent, after the size of the harddisk exceeded the size sent in the configuration file. What I would like to understand is the amount of OID shown in the trace: This leads me to the problem I have at the moment, I need that the trap receiver machine senses the trap received and sends an email. In the attached file, snmptrapd.conf I did the traphandle command that it is suppose to handle the selected OID, but if I put the above OID (1.3.6.1.4.1.2021.9.101.1 - HDD size) it trap does not work. It only worked as per below: traphandle DISMAN-EVENT-MIB::mteTriggerFired /usr/local/bin/traptoemail -s "SMTP Server" -f [email protected] Do you have any ideas of how I can set up these default traps to be able to be sent to the trap receiver machine? Is there any other way to configure the trap receiver daemon (snmptrapd.conf). I thank you in advance, Matthew ------------------------------------------------------------------------------ Throughout its 18-year history, RSA Conference consistently attracts the world's best and brightest in the field, creating opportunities for Conference attendees to learn about information security's most important issues through interactions with peers, luminaries and emerging and established companies. http://p.sf.net/sfu/rsaconf-dev2dev _______________________________________________ Net-snmp-users mailing list [email protected] Please see the following page to unsubscribe or change other options: https://lists.sourceforge.net/lists/listinfo/net-snmp-users
image001.png
(image/png, 11.6 KB) - not displayed
snmpd.conf
(application/octet-stream, 5.2 KB)
########################################################################### # # snmpd.conf # # - created by the snmpconf configuration program # ########################################################################### # SECTION: System Information Setup # # This section defines some of the information reported in # the "system" mib group in the mibII tree. # syslocation: The [typically physical] location of the system. # Note that setting this value here means that when trying to # perform an snmp SET operation to the sysLocation.0 variable will make # the agent return the "notWritable" error code. IE, including # this token in the snmpd.conf file will disable write access to # the variable. # arguments: location_string syslocation "Test Room" # syscontact: The contact information for the administrator # Note that setting this value here means that when trying to # perform an snmp SET operation to the sysContact.0 variable will make # the agent return the "notWritable" error code. IE, including # this token in the snmpd.conf file will disable write access to # the variable. # arguments: contact_string syscontact [email protected] # sysservices: The proper value for the sysServices object. # arguments: sysservices_number sysservices 76 ########################################################################### # SECTION: Access Control Setup # # This section defines who is allowed to talk to your running # snmp agent. # rocommunity: a SNMPv1/SNMPv2c read-only access community name # arguments: community [default|hostname|network/bits] [oid] rocommunity public ########################################################################### # SECTION: Trap Destinations # # Here we define who the agent will send traps to. # trapsink: A SNMPv1 trap receiver # arguments: host [community] [portnum] trapsink 212.56.128.132 trust1106 trap2sink: A SNMPv2c trap receiver # arguments: host [community] [portnum] #trap2sink 212.56.128.132 trust1106 162 # informsink: A SNMPv2c inform (acknowledged trap) receiver # arguments: host [community] [portnum] # informsink 212.56.128.132 trust1106 # trapcommunity: Default trap sink community to use # arguments: community-string trapcommunity public # authtrapenable: Should we send traps when authentication failures occur # arguments: 1 | 2 (1 = yes, 2 = no) authtrapenable 1 createUser internal MD5 "Testing" iquerySecName internal rouser internal linkUpDownNotifications yes # defaultMonitors yes monitor -r 10 -o fileName -o fileErrorMsg "fileTable" fileErrorFlag != 0 monitor -r 10 -o prNames -o prErrMessage "process table" prErrorFlag != 0 monitor -r 10 -o memErrorName -o memSwapErrorMsg "memory" memSwapError != 0 monitor -r 10 -o extNames -o extOutput "extTable" extResult != 0 monitor -r 10 -o dskPath -o dskErrorMsg "dskTable" dskErrorFlag != 0 monitor -r 10 -o laNames -o laErrMessage "laTable" laErrorFlag != 0 trap2sink 212.56.128.132 ########################################################################### # SECTION: Monitor Various Aspects of the Running Host # # The following check up on various aspects of a host. # proc: Check for processes that should be running. # proc NAME [MAX=0] [MIN=0] # # NAME: the name of the process to check for. It must match # exactly (ie, http will not find httpd processes). # MAX: the maximum number allowed to be running. Defaults to 0. # MIN: the minimum number to be running. Defaults to 0. # # The results are reported in the prTable section of the UCD-SNMP-MIB tree # Special Case: When the min and max numbers are both 0, it assumes # you want a max of infinity and a min of 1. proc sendmail 1 1 # disk: Check for disk space usage of a partition. # The agent can check the amount of available disk space, and make # sure it is above a set limit. # # disk PATH [MIN=100000] # # PATH: mount path to the disk in question. # MIN: Disks with space below this value will have the Mib's errorFlag set. # Can be a raw byte value or a percentage followed by the % # symbol. Default value = 100000. # # The results are reported in the dskTable section of the UCD-SNMP-MIB tree disk /var 60% # load: Check for unreasonable load average values. # Watch the load average levels on the machine. # # load [1MAX=12.0] [5MAX=12.0] [15MAX=12.0] # # 1MAX: If the 1 minute load average is above this limit at query # time, the errorFlag will be set. # 5MAX: Similar, but for 5 min average. # 15MAX: Similar, but for 15 min average. # # The results are reported in the laTable section of the UCD-SNMP-MIB tree load 0.2 0.2 0.2 # file: Check on the size of a file. # Display a files size statistics. # If it grows to be too large, report an error about it. # # file /path/to/file [maxsize_in_bytes] # # if maxsize is not specified, assume only size reporting is needed. # # The results are reported in the fileTable section of the UCD-SNMP-MIB tree file /test.txt 100 file /testing.txt 100
snmptrapd.conf
(application/octet-stream, 180 B)
authCommunity log,execute,net trust1106 logoption f /tmp/trapd.out traphandle DISMAN-EVENT-MIB::mteTriggerFired /usr/local/bin/traptoemail -s "SMTP Server" -f [email protected]
Matt_HDD full.cap
(application/octet-stream, 656 B) - not displayed