Forward SNMP Trap to HP OVO

[farhan]

Hi,

I have been using cacti for a long time. And it is awsome.

Ii it possible to forward snmp trap from cacti to HP OVO in near future . If

it happens then it would be great.

Thanks,

[rony]

What traps, cacti doesn't generate traps....

What are you looking for?

[farhan]

Hi,

Thanks for reply. I have been using thold, nagios and Syslog-ng plugins

under cacti. Suppose if there is cisco interface down in syslog, how can

we forward trap to HP OVO. Any idea to forward these alerts to HP OVO?

Might be it is irrelevant to cacti development. But I need this

Thanks,

[cigamit]

Hi,

Thanks for reply. I have been using thold, nagios and Syslog-ng plugins

under cacti. Suppose if there is cisco interface down in syslog, how can

we forward trap to HP OVO. Any idea to forward these alerts to HP OVO?

Might be it is irrelevant to cacti development. But I need this

Thanks,

I am not sure about forwarding traps, but it would be fairly simple to allow you to forward a syslog message to a remote host if a threshold is tripped. Actually, I think I will definitely add that in as an option in the future if you want it.

[rony]

Why not configure the device to send traps to OVO and then configure OVO to correctly alert on them?

[Exo7]

Hi

it would be fairly simple to allow you to forward a syslog message to a remote host if a threshold is tripped

I could also use this feature. Something like launching a third party program with arguments (hostname, IP, threshold name) :

/usr/bin/logger local7.info "threshold $name tripped on host $host"

=> allow for syslog events to be send to another management server
You can use another program to generate a SNMP trap.

Is it possible, as an option, to trigger an event when the data come back to a normal status ?

[cigamit]

Hi

it would be fairly simple to allow you to forward a syslog message to a remote host if a threshold is tripped

I could also use this feature. Something like launching a third party program with arguments (hostname, IP, threshold name) :

/usr/bin/logger local7.info "threshold $name tripped on host $host"

=> allow for syslog events to be send to another management server
You can use another program to generate a SNMP trap.

Is it possible, as an option, to trigger an event when the data come back to a normal status ?

I had already created a php script to send remote syslog alerts, just simply creates the proper packet and sends it udp. I am sure it wouldn't be hard to do the same thing with traps, I will just have to find the RFC and write a quick script.

It would have the basic functionality of thresholds, just with syslog/traps instead of emails. So yes, it would send one out when it returned to normal.

[farhan]

Thats great. When you complete your script please let us know.

Thanks

[kbartoletta]

I would be interested in similiar functionality. This is one of the things that is holding us up from going completely to cacti for network/server reporting and alerting. I am hoping to be able to send threshold traps to our nerve center servers. I am currently, using log file scanning to scan logs in order to generate alarms but it is kind of messy. I would also be interested in continuous alerting if possible. I am not sure about the rest of the industry but our monitoring really depends on continuous alert as it is easy to miss a clear trap given the nature of UDP

[chadd]

oddly enough, I have just received the same request from my company. They use an SNMP manager to monitor the network, and though they find the Thold alerts useful, they do not want to get emails or have to look at the web page. They want the alerts forwarded to the SNMP manager, which is a centralized point for all network alarms. So, I setup Cigamit's Thold module to log thold alerts to it's own syslog (in /var/log/CactiThold.log) and now I am in the process of writing a little perl script to parse that file and send SNMP traps to the SNMP manager. It is pretty convoluted, and it would be great to get that functionality right in the Thold module (SNMP traps), but for now that is what I am doing. When I am done, I will post the info to this thread. The right thing to do would be to write the functionality into the Thold module, but I unfortunately don't have the time, or PHP expertise to do a good job of it.

[chadd]

Ok, here is the script I promised. Like I said before, it is that the best solution to the problem, but it works . Just edit the config file to suit your needs, and make sure you edit the "path to the config file" at the top of the script to where ever you decide to put it on your system.

It was written for UNIX, so I am not sure if it will work on a Windows server, but if it doesn't, it shouldn't take much work to fix it for Windows.

It is designed to run as a Cron job, and write after your Cacti poller. So, you will need to add a line to your Cron tab (or whatever the equiv is in Windows), something like the following:

# Production Cacti Poller
*/3 * * * * cactiuser /usr/local/bin/php /cacti/prod/cacti-0.8.6g/poller.php > /dev/null
2>&1
#
# Sends Cacti Threshold Alerts found in the Cacti Threshold syslog to an SNMP Manager via SNMP traps
*/3 * * * * root /usr/local/bin/perl /usr/local/bin/script_box/syslog2snmp.pl

In case you are wondering why I run the poller every 3min instead of the "normal" 5min, it is because devices which only have a 32 bit counter, and exceed 100mg tend to roll their counters when the polling cycle is 5min. That results in really spiky graphs, and you never get a true "current" value. Changing the poller interval to 3min has fixed that on my system.

This script uses Net SNMP to send traps, so if you don't have that you will have to change the section of the script that uses that utility to use another, but again, not a show stopper.

This script also assumes you have already set up a syslog server on your machine and have the syslog messages going to their own file. Here is what you have to add (in UNIX) to your syslog.conf file to make this happen. You can use whatever name and path you want for that syslog file, just remember to change it in your syslog2snmp.conf file. Also, check the box in your Thold module settings to tell the Thold module to send your threshold alerts to syslog:

# Cacti's Thold Syslog
!CactiTholdLog
*.* /var/log/CactiThold.log



That is about it. Hope this helps someone.

[farhan]

Thanks a lot mate. I will try and then let you know

Regards,

Farhan

[tclark]

Is there a specific MIB needed to be loaded on the NMS to be able to receive these traps?

[lard]

Hi,

I would assume that it will come in with the net-snmp oid - if using openview you'll see them in the status alarms section or trapd.log file if unrecognised

I'm in need of this functionality so will check this script out on our windows servers - many thanks!

[karias]

I've got this setup after a little work. The problem I'm having is the debug log has all configured thresholds coming through whether they're breached or not, so a trap is sent for each one of them. Anyone have advice on how to get around this as I'm only interested in the true threshold breaches?