Some traps run properly but some dont even write into /tmp/zabbix_traps.tmp

[FildaSmile]

Hello, te

i have issue with recieving trap, some traps are correctly recieved (server,storage) wrote to /tmp/zabbix_traps.tmp and after that collected by item and represented by trigger.

example of traps without problems (it fire trigger and alarm)

15:16:56.802027 IP 172.25.2.21.51951 > zabbix-virtual-machine.snmp-trap: C="Hu@wei123" V2Trap(372) system.sysUpTime.0=78124029 S:1.1.4.1.0=E:2011.2.235.1.1.500.10.256.1 E:2011.2.235.1.1.500.1.1=4 E:2011.2.235.1.1.500.1.2="test sensor" E:2011.2.235.1.1.500.1.3="test event" E:2011.2.235.1.1.500.1.4=1 E:2011.2.235.1.1.500.1.5="0x00000001" E:2011.2.235.1.1.500.1.6=0 E:2011.2.235.1.1.500.1.7=0 E:2011.2.235.1.1.500.1.8="sever identity test" E:2011.2.235.1.1.500.1.9="server room" E:2011.2.235.1.1.500.1.10="1970-01-01 00:00:00"

15:20:11.158301 IP 172.25.2.17.33803 > zabbix-virtual-machine.snmp-trap: C="storage_public" V2Trap(301) system.sysUpTime.0=367778320 S:1.1.4.1.0=E:34774.4.1.4.2 E:34774.4.1.3.3.1.0=1 E:34774.4.1.3.3.2.0=2305843009213693950 E:34774.4.1.3.3.3.0=6 E:34774.4.1.3.3.4.0=4294967295 E:34774.4.1.3.3.5.0=1589462199 E:34774.4.1.3.3.6.0=0 E:34774.4.1.3.3.7.0="" E:34774.4.1.3.3.8.0=4294967294 E:34774.4.1.3.3.9.0=07_e4_05_0e_0f_10_27_00 E:34774.4.1.3.3.10.0=07_b2_01_01_01_00_00_00

But in case of firewall and switches the trap dont even write to /tmp/zabbix_traps.tmp

example of issue trap:

10:25:43.051465 IP 172.25.2.2.49350 > zabbix-virtual-machine.snmp-trap: C="public" V2Trap(124) system.sysUpTime.0=3737368311 S:1.1.4.1.0=E:2011.5.25.191.3.1 E:2011.5.25.191.1.1.0=1266 E:2011.5.25.191.1.2.0=0 E:2011.5.25.191.1.3.0=4095

I have same items and trigger like on storage and server where they works perfectly, i also have community "public" in /etc/snmp/snmptrapd.conf

I dont undrstand what could be wrong, can anyone try to advice me ?

thank you in advance

[Evgeniy]

i also have community "public" in /etc/snmp/snmptrapd.conf

Try to change in snmptrapd.conf

disableAuthorization yes

[FildaSmile]

hello and thank you for response, i uncommented this line "disableAuthorization yes" and also do "service zabbix-server restart" command but still i dont have this trap (now i used tcpdump -n 162 so now i can see ip adress, linux itself translated this IP to gateway, probably because it has same gateway)

15:38:58.099765 IP 172.25.2.2.49350 > 10.0.0.125.162: C="altepro" V2Trap(265) .1.3.6.1.2.1.1.3.0=3765167833 .1.3.6.1.6.3.1.1.4.1.0=.1.3.6.1.4.1.2011.5.25.129. 2.1.9 .1.3.6.1.4.1.2011.5.25.129.1.1.0=3 .1.3.6.1.4.1.2011.5.25.129.1.2.0=67966 .1.3.6.1.4.1.2011.5.25.129.1.3.0=5 .1.3.6.1.2.1.47.1.1.1.1.4.67108873=5 .1.3.6.1.2.1.47.1.1.1.1.7.67108873="MPU Board 0" .1.3.6.1.4.1.2011.5.25.129.1.4.0="SubCard #5 POWER" .1.3.6.1.4.1.2011.5.25.129.1.5.0="SubCard #5 POWER is abnormal"

You can compare with server trap which run correctly:

15:47:06.643619 IP 10.0.0.214.51675 > 10.0.0.125.162: C="Hu@wei123" V2Trap(372) .1.3.6.1.2.1.1.3.0=699540819 .1.3.6.1.6.3.1.1.4.1.0=.1.3.6.1.4.1.2011.2.235.1.1 .500.10.256.1 .1.3.6.1.4.1.2011.2.235.1.1.500.1.1=70 .1.3.6.1.4.1.2011.2.235.1.1.500.1.2="test sensor" .1.3.6.1.4.1.2011.2.235.1.1.500.1.3="test event" .1.3.6.1.4.1.2011.2.235.1.1.500.1.4=1 .1.3.6.1.4.1.2011.2.235.1.1.500.1.5="0x00000001" .1.3.6.1.4.1.2011.2.235.1.1.500.1.6=0 .1.3.6.1.4.1.2011.2.235.1.1.500.1.7=0 .1.3.6.1.4.1.2011.2.235.1.1.500.1.8="sever identity test" .1.3.6.1.4.1.2011.2.235.1.1.500.1.9="server room" .1.3.6.1.4.1.2011.2.235.1.1.500.1.10="1970-01-01 00:00:00"

I still dont have this (upper) trap in /tmp/zabbix_traps.tmp file and also no trigger was fired.

my snmptrapd.conf file:

#
# EXAMPLE-trap.conf:
# An example configuration file for configuring the Net-SNMP snmptrapd agent.
#
################################################## #############################
#
# This file is intended to only be an example.
# When the snmptrapd agent starts up, this is where it will look for it.
#
# All lines beginning with a '#' are comments and are intended for you
# to read. All other lines are configuration commands for the agent.

#
# PLEASE: read the snmptrapd.conf(5) manual page as well!
#
#authCommunity log,execute,net private
#authCommunity log,execute,net public
#
## send mail when get any events
#traphandle default /usr/bin/traptoemail -s smtp.example.org [email protected]
#
## send mail when get linkDown
#traphandle .1.3.6.1.6.3.1.1.5.3 /usr/bin/traptoemail -s smtp.example.org [email protected]

disableAuthorization yes
#traphandle default /usr/sbin/snmptthandler

authCommunity execute altepro
authCommunity execute Hu@wei123

Both items in zabbix hosts are same,

Type of item: SNMP Trap
key: snmptrap.fallback
Type of information: i tried Text and also Log but without success

[Evgeniy]

After the change, you must restart snmptrapd. Please note that for some reason there is no line in your file "perl do..." or "traphandle default..."
You can add a line:

logoption f  /tmp/snmptrapd.log

and see what snmptrapd receives traps and passes on.

[FildaSmile]

Sorry my mistake i didnt copy all text , under communities i have:

perl do "/home/zabbix/zabbix_trap_receiver.pl"; (extracted script from zabbix sources)

i did reset of snmptrapd and also add line "logoption f /tmp/snmptrapd.log" but still without success