Hi all,
I'm trying to get SNMP Traps from VMWare showing up in Xymon.
I think the issue is with the trap format from VMWare and I suspect I may need to tweak my snmptt.conf file for this.
I have attached my snmptt.conf file and here is a an example of what I am seeing in my /var/log/messages file. (Text in italics has replaced what actually shows in the log for security reasons)
Jul 8 11:08:02 hostname snmptrapd[7399]: 2011-07-08 11:08:02 full host name [IP ADDRESS] (via UDP: [IP ADDRESS
]:60701) TRAP, SNMP v1, community public SNMPv2-SMI::enterprises.6876.50 Enterprise Specific Trap (201) Uptime: 28 days, 20:3
3:40.64 SNMPv2-SMI::enterprises.6876.50.301 = STRING: "At vm" SNMPv2-SMI::enterprises.6876.50.302 = STRING: " " SNMP
v2-SMI::enterprises.6876.50.303 = STRING: "host name" SNMPv2-SMI::enterprises.6876.50.304 = STRING: "Error (Red)" SNMPv2-SMI::
enterprises.6876.50.305 = STRING: "Error (Red)" SNMPv2-SMI::enterprises.6876.50.306 = STRING: "Heartbeat is missing for VM - (Heartb
eat stopped)"
From what I can see it appears that VMWare sends multiple OID's in the same trap.
Has anybody got this working or can suggest a solution?
Thanks,
Neil Simmonds Operations Analyst Operations Support Group Express Gifts Ltd. neil.simmonds at express-gifts.co.uk
Tel :- 01254 303092 Fax :- 01254 303100
Name & Registered Office: EXPRESS GIFTS LIMITED, 2 GREGORY ST, HYDE, CHESHIRE, ENGLAND, SK14 4TH, Company No. 00718151. Express Gifts Limited is authorised and regulated by the Financial Services Authority
NOTE: This email and any information contained within or attached in a separate file is confidential and intended solely for the Individual to whom it is addressed. The information or data included is solely for the purpose indicated or previously agreed. Any information or data included with this e-mail remains the property of Findel PLC and the recipient will refrain from utilising the information for any purpose other than that indicated and upon request will destroy the information and remove it from their records. Any views or opinions presented are solely those of the author and do not necessarily represent those of Findel PLC. If you are not the intended recipient, be advised that you have received this email in error and that any use, dissemination, forwarding, printing, or copying of this email is strictly prohibited. No warranties or assurances are made in relation to the safety and content of this e-mail and any attachments. No liability is accepted for any consequences arising from it. Findel Plc reserves the right to monitor all e-mail communications through its internal and external networks. If you have received this email in error please notify our IT helpdesk on +44(0) 1254 303030
Neil,
Hi all,
I’m trying to get SNMP Traps from VMWare showing up in Xymon.
I think the issue is with the trap format from VMWare and I suspect I may need to tweak my snmptt.conf file for this.
I have attached my snmptt.conf file and here is a an example of what I am seeing in my /var/log/messages file. (Text in italics has replaced what actually shows in the log for security reasons)
It's not clear that snmptt is actually being invoked.
In my logs I see each trap twice - once the raw snmptrapd log and once processed by snmptt - note that snmptt can format a message however it likes, discarding trap params according to the FORMAT statement (which is static text in the example below - depends what snmpttconvertmib finds by default)
Jul 10 07:45:45 loghost snmptrapd[5438]: 2011-07-10 07:45:45 tempmon [10.x.x.x] (via UDP: [10.x.x.x]:51794) TRAP, SNMP v1, community xxx#012#011PowerNet-MIB::apc Enterprise Specific Trap (PowerNet-MIB::apcEnvLTIncTempRateViolationCleared) Uptime: 24 days, 18:57:56.83#012#011PowerNet-MIB::mtrapargsString02.0 = STRING: "XXXXXXXX"#011PowerNet-MIB::mtrapargsString03.0 = STRING: "Main Module"#011PowerNet-MIB::mtrapargsInteger04.0 = INTEGER: 0#011PowerNet-MIB::mtrapargsInteger.0 = INTEGER: 1#011PowerNet-MIB::mtrapargsString04.0 = STRING: "Temp Sensor MM:1"#011PowerNet-MIB::mtrapargsString.0 = STRING: "MM: Short-term increasing temperature rate of change violation cleared for 'Temp Sensor MM:1' at 'Unknown'." Jul 10 07:45:46 loghost snmptt[0]: PowerNet-MIB::apcEnvLTIncTempRateViolationCleared INFORMATIONAL "Status Events" tempmon - APC ENV: Long-term inc. temp rate violation cleared.
Jul 8 11:08:02 /hostname/ snmptrapd[7399]: 2011-07-08 11:08:02 /full host name/ [/IP ADDRESS/] (via UDP: [/IP ADDRESS/
]:60701) TRAP, SNMP v1, community public
SNMPv2-SMI::enterprises.6876.50 Enterprise Specific Trap (201) Uptime: 28 days, 20:33:40.64 SNMPv2-SMI::enterprises.6876.50.301 = STRING: "At vm" SNMPv2-SMI::enterprises.6876.50.302 = STRING: " " SNMP
v2-SMI::enterprises.6876.50.303 = STRING: "/host name/" SNMPv2-SMI::enterprises.6876.50.304 = STRING: "Error (Red)"
SNMPv2-SMI::enterprises.6876.50.305 = STRING: "Error (Red)" SNMPv2-SMI::enterprises.6876.50.306 = STRING: "Heartbeat is missing for VM - (Heartb
eat stopped)"
The trap above is a vpxdTrap which according to the definition has 6 parameters - they seem to match your trap above.
EVENT vpxdTrap .1.3.6.1.4.1.6876.50.0.201 "Status Events" Normal FORMAT $* SDESC
This trap is sent when entity status changed. Variables: 1: vpxdTrapType 2: vpxdHostName 3: vpxdVMName 4: vpxdNewStatus 5: vpxdOldStatus 6: vpxdObjValue EDESC
From what I can see it appears that VMWare sends multiple OID’s in the same trap.
Has anybody got this working or can suggest a solution?
For a start, verify that snmptt is actually working.
David.
-- David Baldwin - IT Unit Australian Sports Commission www.ausport.gov.au Tel 02 62147830 Fax 02 62141830 PO Box 176 Belconnen ACT 2616 david.baldwin at ausport.gov.au Leverrier Street Bruce ACT 2617
Keep up to date with what's happening in Australian sport visit http://www.ausport.gov.au
This message is intended for the addressee named and may contain confidential and privileged information. If you are not the intended recipient please note that any form of distribution, copying or use of this communication or the information in it is strictly prohibited and may be unlawful. If you receive this message in error, please delete it and notify the sender.
participants (2)
-
david.baldwin＠ausport.gov.au
-
Neil.Simmonds＠express-gifts.co.uk