SNMP traps made easy

[automaticserver]

Hi all,

we had the problem to handle SNMP traps with zabbix and we studied several solutions but none of the met our requirements.

We have a environment with a lot of snmp enabled devices and wanted to migrate this to another monitoring systems. Because we didn't have much time to configure every snmp device inside zabbix, add items and so on, we choosed a simpler approach:

1) snmptrapd gets the traps
2) snmptrapd calls a ruby script "zabbix_snmp_trapper.rb" to handle it (ruby because I can write it a lot faster than perl and python and cause of puppet it's everywhere in our environment)
3) API calls to zabbix to create
a) a host if non existent
b) an item for this host, if non existent
c) an trigger, if non existent
d) an event through zabbix_sender

So the process is in short:
snmptrapd -> zabbix_snmp_trapper -> zabbix_sender->zabbix

With additional API call from zabbix_snmp_trapper to zabbix.

In the current state, this solution works but it is not very comfortable to install, some debugging stuff should be better - but we have a small log. You should calculate 1 or 2 hours for install. Most stuff described for RedHat/CentOS only, some steps for Debian too but you can adapt that easily.

[automaticserver]

Part2

You need at first ruby and rubygems:

Debian:

apt-get install ruby rubygems

RedHat/CentOS:

yum install ruby rubygems ruby-devel make gcc binutils

Install Zabbix-Api-Library for Ruby

gem install zbxapi

Patch gem for Zabbix 2.x
-

-- /usr/lib/ruby/gems/1.8/gems/zbxapi-0.2.415/zbxapi.rb.old
2013-05-02 13:59:00.517566061 +0200
+++ /usr/lib/ruby/gems/1.8/gems/zbxapi-0.2.415/zbxapi.rb
2013-03-26 15:25:06.726081295 +0100 @@ -283,7 +283,7 @@
debug(6,:var=>params,:msg=>"Parameters")   
     checkauth
-    checkversion(1,1)
+    checkversion(2,0)
     params={} if params==nil
 
     obj=do_request(json_obj(method,params))

[automaticserver]

Part3

Install snmptrapd

yum install net-snmp
chkconfig snmptrapd on

Config snmptrapd in /etc/snmp/snmptrapd.conf

authCommunity   log,execute,net public
traphandle default /usr/local/bin/zabbix_snmp_trapper.rb

Place /usr/local/bin/zabbix_snmp_trapper.rb

wget www.automatic-server.com/zabbix/zabbix_snmp_trapper.rb -O \
/usr/local/bin/zabbix_snmp_trapper.rb

Place /etc/zabbix/snmp_trapper.conf

LOG_FILE = '/var/log/zabbix/snmp_trapper.log'
DEFAULT_ZABBIX_GROUP = 'snmp_tmp'
ZABBIX_URL = 'http://127.0.0.1/zabbix'
ZABBIX_SERVER = '127.0.0.1'
ZABBIX_USER = 'zabbixadmin'
ZABBIX_PASS = 'mysecretpassword'

You should have an zabbix user present which can access the API. Please
config this according to your config above or vice versa

Start snmptrapd

/etc/init.d/snmptrapd start

Debug

tail -f /var/log/zabbix/snmp_trapper.log /var/log/messages

[automaticserver]

Credentials

Sponsored by ricardo.ch, Switzerland

Written by Oliver Schad, Automatic Server AG

[automaticserver]

Part4

For proper MIB handling (decode OID numbers to human readable strings), you can place your mib files in RedHat/CentOS in /usr/share/snmp/mibs

Change your snmp config to use them in /etc/snmp/snmp.conf:

mibs +ALL

[Ishan]

Hello

Hello,

I am using zabbix 2.0.6 version on cent os box and now i am trying to configure the snmptraps as you mentioned in this document. I have doubt about part 2

Can you please kindly let me know how did you Patch gem for Zabbix 2.x. If you can please let me know step by step, because i am confuse with this code. Please clarify me kindly.

Thanks in advance

Ishan

[automaticserver]

Hello,

I am using zabbix 2.0.6 version on cent os box and now i am trying to configure the snmptraps as you mentioned in this document. I have doubt about part 2

Ishan

You should interpret the patch manually, because pathes could be wrong if you have other versions of the gem or another linux distribution.

Find the file "zbxapi.rb", edit it with your favorite editor, find the line with "checkversion" inside, change it

original: checkversion(1,1)
new: checkversion(2,0)

save the file, that's it.

[Ishan]

Hi

Thanks for your super fast reply, but i am unable to find the file called zbxapi.rb in the system, what do i need to do?

Thanks
Ishan

[automaticserver]

Thanks for your super fast reply, but i am unable to find the file called zbxapi.rb in the system, what do i need to do?

You have to install ruby and the Zabbix-Gem:

yum -y install ruby rubygems
gem install zbxapi

[Ishan]

output of them

Thanks again ...

Here is the result

[root@zabbix /]# yum -y install ruby rubygems
Loaded plugins: fastestmirror, refresh-packagekit, security
Loading mirror speeds from cached hostfile
* base: centos.fastbull.org
* extras: mirror.vit.com.tr
* updates: mirror.vit.com.tr
Setting up Install Process
Package ruby-1.8.7.352-10.el6_4.i686 already installed and latest version
Package rubygems-1.3.7-1.el6.noarch already installed and latest version
Nothing to do
[root@zabbix /]# gem install zbxapi
Building native extensions. This could take a while...
ERROR: Error installing zbxapi:
ERROR: Failed to build gem native extension.

/usr/bin/ruby extconf.rb
mkmf.rb can't find header files for ruby at /usr/lib/ruby/ruby.h


Gem files will remain installed in /usr/lib/ruby/gems/1.8/gems/json-1.8.0 for inspection.
Results logged to /usr/lib/ruby/gems/1.8/gems/json-1.8.0/ext/json/ext/generator/gem_make.out

[automaticserver]

Thanks again ...

Here is the result

[root@zabbix /]# gem install zbxapi
Building native extensions. This could take a while...
ERROR: Error installing zbxapi:
ERROR: Failed to build gem native extension.

/usr/bin/ruby extconf.rb
mkmf.rb can't find header files for ruby at /usr/lib/ruby/ruby.h

Ok, forgot to install devel stuff:

yum -y install ruby-devel gcc make binutils
gem install zbxapi

[Ishan]

Thanks

Hi Oliver Schad,

Thanks you, i was installed successfully..

In part 3 you are instructing to Place /etc/zabbix/snmp_trapper.conf,
Question 1: that means i need to create a new file?

LOG_FILE = '/var/log/zabbix/snmp_trapper.log'
Question 2: that means i need to create a file manually?

DEFAULT_ZABBIX_GROUP = 'snmp_tmp'
Question 3: do i need to create a group in zabbix web interface?


Please kindly help me to figure out this..

Ishan

[automaticserver]

Hi Oliver Schad,

Thanks you, i was installed successfully..

In part 3 you are instructing to Place /etc/zabbix/snmp_trapper.conf,
Question 1: that means i need to create a new file?

Yes.

LOG_FILE = '/var/log/zabbix/snmp_trapper.log'
Question 2: that means i need to create a file manually?

No, don't think so. The Script creates that file, but not that directory.

Question 3: do i need to create a group in zabbix web interface?

Yes.

Best regards
Oli

[Ishan]

Hi Oli

Thanks for your help its working now..Thumbs UP......

But i am not able to see the snmp_trapper.log file in the directory..but these logs are coming through messages log in log directory. as per your instruction i had run the tail command to get the snmptraps log but it was showing me messages log.

Other issue is i am testing with testing server which is connected to the internet, but my production server was not connected to the internet
How do i find through the exact RPM package for below commands to run in my production server..
yum -y install ruby-devel gcc make binutils
gem install zbxapi

AND

Where is the exactly in snmp.conf to put this code? (mibs +ALL)


In zabbix we are receiving these traps as strings right?
Those are showing in UP time graphs?
Basically how can i give proper graph or report for linkup and link down in interface wise as monthly? (WAN links)

I know these are lots of questions, but take your time and give me some help..

Your previous answers are all straight forward and correct, that is really appreciated..!!!

Ishan

[automaticserver]

Thanks for your help its working now..Thumbs UP......

NP

But i am not able to see the snmp_trapper.log file in the directory..but these logs are coming through messages log in log directory.

Mmh, this should be the logs of the snmptrapd, not the ruby script. Maybe there are some permissions wrong or you have a wrong path inside your config? Could you check the settings of "LOG_FILE" and create the log file manually with "touch" or so?

as per your instruction i had run the tail command to get the snmptraps log but it was showing me messages log.

Don't get this what you mean. Could you explain it a little more?

Other issue is i am testing with testing server which is connected to the internet, but my production server was not connected to the internet
How do i find through the exact RPM package for below commands to run in my production server..
yum -y install ruby-devel gcc make binutils

You could copy the compiled gem, so you would only need "ruby" and "rubygems". Gems are located in /usr/lib/ruby/gems/ - you can copy the whole tree, you you don't need to do the following:

gem install zbxapi

Where is the exactly in snmp.conf to put this code? (mibs +ALL)

/etc/snmp/snmp.conf

In zabbix we are receiving these traps as strings right?

No, the key is of course a string, but the value is just a numeric 1.

Those are showing in UP time graphs?

No, you don't get a graph, because a graph means you have values with a given frequency, i.e. 1 value per minute. With traps you can't have this behaviour because they appear in sometime or never.

What you could do is change the ruby trapper to generate virtual traps with a value of numeric 0 if no real traps arive any minute. But this would be much more effort because you have to fetch all configured traps from the zabbix API and create those virtual traps.

Basically how can i give proper graph or report for linkup and link down in interface wise as monthly? (WAN links)

In zabbix, you can filter through events per device, but you have to do this on your own. Of course you could make script for it with API calls. But SNMP traps are really strange designed, you have no real relation between interface up and down, you have to know the SNMP OIDs of both events (yes, they are different) and correlate them manually. I don't know any full automatic way for it. Maybe somebody can correct me, if I'm wrong.

Best Regards
Oli