Traps

"Matthew Camilleri" <[email protected]>
Newsgroups gmane.network.net-snmp.user
Message-ID <[email protected]>
Hi all,

 

I am currently doing a project regarding traps and would like to help me
in this issue. I am knew to the trap world J and thought that by posting
this mail helps me move forward in this project.

 

First of all I will begin exactly from the very beginning, i.e. the
net-snmp installation for monitoring.

 

Before setting up traps, I started in installing the SNMP agent on the
machines I wanted to monitor. The machines consisted mainly of Solaris 9
and 10 machines. The installation was performed successfully and I
managed to be able to monitor these machines via the cacti software (
http://www.cacti.net/).

 

The configuration file for this daemon is the snmpd.conf file
(attached). For traps the configuration file snmptrapd.conf was modified
as per attached.

 

Now from here the headache starts...

 

I was able to know that traps were being sent since I was generating
them (example, bring up the size of a harddisk, as set in the
snmpd.conf) and viewing the traps in a WireShark trace. For your perusal
I have also attached a trace when a trap was sent, after the size of the
harddisk exceeded the size sent in the configuration file.

 

What I would like to understand is the amount of OID shown in the trace:

 

 

 

This leads me to the problem I have at the moment, I need that the trap
receiver machine senses the trap received and sends an email. In the
attached file, snmptrapd.conf I did the traphandle command that it is
suppose to handle the selected OID, but if I put the above OID
(1.3.6.1.4.1.2021.9.101.1 - HDD size) it trap does not work. It only
worked as per below:

 

traphandle DISMAN-EVENT-MIB::mteTriggerFired /usr/local/bin/traptoemail
-s "SMTP Server" -f [email protected]

 

Do you have any ideas of how I can set up these default traps to be able
to be sent to the trap receiver machine?

Is there any other way to configure the trap receiver daemon
(snmptrapd.conf).

 

I thank you in advance,

 

Matthew

------------------------------------------------------------------------------
Throughout its 18-year history, RSA Conference consistently attracts the
world's best and brightest in the field, creating opportunities for Conference
attendees to learn about information security's most important issues through
interactions with peers, luminaries and emerging and established companies.
http://p.sf.net/sfu/rsaconf-dev2dev

_______________________________________________
Net-snmp-users mailing list
[email protected]
Please see the following page to unsubscribe or change other options:
https://lists.sourceforge.net/lists/listinfo/net-snmp-users
image001.png (image/png, 11.6 KB) - not displayed
snmpd.conf (application/octet-stream, 5.2 KB)
###########################################################################
#
# snmpd.conf
#
#   - created by the snmpconf configuration program
#
###########################################################################
# SECTION: System Information Setup
#
#   This section defines some of the information reported in
#   the "system" mib group in the mibII tree.

# syslocation: The [typically physical] location of the system.
#   Note that setting this value here means that when trying to
#   perform an snmp SET operation to the sysLocation.0 variable will make
#   the agent return the "notWritable" error code.  IE, including
#   this token in the snmpd.conf file will disable write access to
#   the variable.
#   arguments:  location_string

syslocation  "Test Room"

# syscontact: The contact information for the administrator
#   Note that setting this value here means that when trying to
#   perform an snmp SET operation to the sysContact.0 variable will make
#   the agent return the "notWritable" error code.  IE, including
#   this token in the snmpd.conf file will disable write access to
#   the variable.
#   arguments:  contact_string

syscontact  [email protected]

# sysservices: The proper value for the sysServices object.
#   arguments:  sysservices_number

sysservices 76



###########################################################################
# SECTION: Access Control Setup
#
#   This section defines who is allowed to talk to your running
#   snmp agent.

# rocommunity: a SNMPv1/SNMPv2c read-only access community name
#   arguments:  community [default|hostname|network/bits] [oid]

rocommunity  public  



###########################################################################
# SECTION: Trap Destinations
#
#   Here we define who the agent will send traps to.

# trapsink: A SNMPv1 trap receiver
#   arguments: host [community] [portnum]

trapsink  212.56.128.132 trust1106 

trap2sink: A SNMPv2c trap receiver
#   arguments: host [community] [portnum]

#trap2sink 212.56.128.132 trust1106 162

# informsink: A SNMPv2c inform (acknowledged trap) receiver
#   arguments: host [community] [portnum]

# informsink  212.56.128.132 trust1106 

# trapcommunity: Default trap sink community to use
#   arguments: community-string

trapcommunity  public

# authtrapenable: Should we send traps when authentication failures occur
#   arguments: 1 | 2   (1 = yes, 2 = no)

authtrapenable  1
createUser internal MD5 "Testing"
iquerySecName internal
rouser internal

linkUpDownNotifications yes
# defaultMonitors yes
monitor -r 10 -o fileName -o fileErrorMsg  "fileTable" fileErrorFlag != 0
monitor -r 10 -o prNames -o prErrMessage "process table" prErrorFlag != 0
monitor -r 10 -o memErrorName -o memSwapErrorMsg "memory" memSwapError != 0
monitor -r 10 -o extNames -o extOutput "extTable" extResult != 0
monitor -r 10 -o dskPath -o dskErrorMsg "dskTable" dskErrorFlag != 0
monitor -r 10 -o laNames -o laErrMessage  "laTable" laErrorFlag != 0


 
trap2sink 212.56.128.132

###########################################################################
# SECTION: Monitor Various Aspects of the Running Host
#
#   The following check up on various aspects of a host.

# proc: Check for processes that should be running.
#     proc NAME [MAX=0] [MIN=0]
#   
#     NAME:  the name of the process to check for.  It must match
#            exactly (ie, http will not find httpd processes).
#     MAX:   the maximum number allowed to be running.  Defaults to 0.
#     MIN:   the minimum number to be running.  Defaults to 0.
#   
#   The results are reported in the prTable section of the UCD-SNMP-MIB tree
#   Special Case:  When the min and max numbers are both 0, it assumes
#   you want a max of infinity and a min of 1.

proc  sendmail 1 1

# disk: Check for disk space usage of a partition.
#   The agent can check the amount of available disk space, and make
#   sure it is above a set limit.  
#   
#    disk PATH [MIN=100000]
#   
#    PATH:  mount path to the disk in question.
#    MIN:   Disks with space below this value will have the Mib's errorFlag set.
#           Can be a raw byte value or a percentage followed by the %
#           symbol.  Default value = 100000.
#   
#   The results are reported in the dskTable section of the UCD-SNMP-MIB tree

disk  /var 60%

# load: Check for unreasonable load average values.
#   Watch the load average levels on the machine.
#   
#    load [1MAX=12.0] [5MAX=12.0] [15MAX=12.0]
#   
#    1MAX:   If the 1 minute load average is above this limit at query
#            time, the errorFlag will be set.
#    5MAX:   Similar, but for 5 min average.
#    15MAX:  Similar, but for 15 min average.
#   
#   The results are reported in the laTable section of the UCD-SNMP-MIB tree

load  0.2 0.2 0.2

# file: Check on the size of a file.
#   Display a files size statistics.
#   If it grows to be too large, report an error about it.
#   
#    file /path/to/file [maxsize_in_bytes]
#   
#      if maxsize is not specified, assume only size reporting is needed.
#   
#   The results are reported in the fileTable section of the UCD-SNMP-MIB tree

file  /test.txt 100
file  /testing.txt 100
snmptrapd.conf (application/octet-stream, 180 B)
authCommunity   log,execute,net trust1106

logoption f /tmp/trapd.out
traphandle DISMAN-EVENT-MIB::mteTriggerFired /usr/local/bin/traptoemail -s "SMTP Server" -f [email protected]
Matt_HDD full.cap (application/octet-stream, 656 B) - not displayed
lmpx.com only provides a reader for public news (NNTP) servers. It is not affiliated with the servers or forums shown here and is not responsible for the content of articles, which is written by their respective authors.