[Xymon] SNMP Traps with Xymon

[David Baldwin]

Neil,
>
> Hi all,
>
>  
>
> I’m trying to get SNMP Traps from VMWare showing up in Xymon.
>
>  
>
> I think the issue is with the trap format from VMWare and I suspect I
> may need to tweak my snmptt.conf file for this.
>
>  
>
> I have attached my snmptt.conf file and here is a an example of what I
> am seeing in my /var/log/messages file. (Text in italics has replaced
> what actually shows in the log for security reasons)
>
>  
>
It's not clear that snmptt is actually being invoked.

In my logs I see each trap twice - once the raw snmptrapd log and once
processed by snmptt - note that snmptt can format a message however it
likes, discarding trap params according to the FORMAT statement (which
is static text in the example below - depends what snmpttconvertmib
finds by default)

Jul 10 07:45:45 loghost snmptrapd[5438]: 2011-07-10 07:45:45 tempmon
[10.x.x.x] (via UDP: [10.x.x.x]:51794) TRAP, SNMP v1, community
xxx#012#011PowerNet-MIB::apc Enterprise Specific Trap
(PowerNet-MIB::apcEnvLTIncTempRateViolationCleared) Uptime: 24 days,
18:57:56.83#012#011PowerNet-MIB::mtrapargsString02.0 = STRING:
"XXXXXXXX"#011PowerNet-MIB::mtrapargsString03.0 = STRING: "Main
Module"#011PowerNet-MIB::mtrapargsInteger04.0 = INTEGER:
0#011PowerNet-MIB::mtrapargsInteger.0 = INTEGER:
1#011PowerNet-MIB::mtrapargsString04.0 = STRING: "Temp Sensor
MM:1"#011PowerNet-MIB::mtrapargsString.0 = STRING: "MM: Short-term
increasing temperature rate of change violation cleared for 'Temp Sensor
MM:1' at 'Unknown'."
Jul 10 07:45:46 loghost snmptt[0]:
PowerNet-MIB::apcEnvLTIncTempRateViolationCleared INFORMATIONAL "Status
Events" tempmon - APC ENV: Long-term inc. temp rate violation cleared.

> Jul  8 11:08:02 /hostname/ snmptrapd[7399]: 2011-07-08 11:08:02 /full
> host name/ [/IP ADDRESS/] (via UDP: [/IP ADDRESS/
>
> ]:60701) TRAP, SNMP v1, community public       
> SNMPv2-SMI::enterprises.6876.50 Enterprise Specific Trap (201) Uptime:
> 28 days, 20:3
>
> 3:40.64         SNMPv2-SMI::enterprises.6876.50.301 = STRING: "At
> vm"   SNMPv2-SMI::enterprises.6876.50.302 = STRING: " "       SNMP
>
> v2-SMI::enterprises.6876.50.303 = STRING: "/host name/"
> SNMPv2-SMI::enterprises.6876.50.304 = STRING: "Error (Red)"    
> SNMPv2-SMI::
>
> enterprises.6876.50.305 = STRING: "Error (Red)"
> SNMPv2-SMI::enterprises.6876.50.306 = STRING: "Heartbeat is missing
> for VM - (Heartb
>
> eat stopped)"
>
>  
>
>  
>
The trap above is a vpxdTrap which according to the definition has 6
parameters - they seem to match your trap above.
#
EVENT vpxdTrap .1.3.6.1.4.1.6876.50.0.201 "Status Events" Normal
FORMAT $*
SDESC

This trap is sent when entity status changed.
Variables:
  1: vpxdTrapType
  2: vpxdHostName
  3: vpxdVMName
  4: vpxdNewStatus
  5: vpxdOldStatus
  6: vpxdObjValue
EDESC
>
> From what I can see it appears that VMWare sends multiple OID’s in the
> same trap.
>
>  
>
> Has anybody got this working or can suggest a solution?
>
>  
>
For a start, verify that snmptt is actually working.

David.

-- 
David Baldwin - IT Unit
Australian Sports Commission          www.ausport.gov.au
Tel 02 62147830 Fax 02 62141830       PO Box 176 Belconnen ACT 2616
david.baldwin at ausport.gov.au          Leverrier Street Bruce ACT 2617


-------------------------------------------------------------------------------------
Keep up to date with what's happening in Australian sport visit http://www.ausport.gov.au

This message is intended for the addressee named and may contain confidential and privileged information. If you are not the intended recipient please note that any form of distribution, copying or use of this communication or the information in it is strictly prohibited and may be unlawful. If you receive this message in error, please delete it and notify the sender.
-------------------------------------------------------------------------------------
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.xymon.com/pipermail/xymon/attachments/20110711/9d1f83a1/attachment.html>