SNMP Traps - Standard Handler vs Embedded Handler

Overview

This KB article explains the differences between the Standard and Embedded handler for processing SNMP Traps.

Detailed steps are provided to configure Nagios xi to use either method (the standard handler is the default used).

Nagios xi 5.5 comes with SNMP Traps enabled by default. If you have an earlier version of Nagios xi SNMP Traps needs to be installed by following this guide:

How to Integrate SNMP Traps With Nagios xi

Editing Files

In many steps of this article you will be required to edit files. This documentation will use the vi text editor. When using the vi
editor:

• To make changes press i on the keyboard first to enter insert mode
• Press Esc to exit insert mode
• When you have finished, save the changes in vi by typing :wq and press Enter

SNMPTRAPD and SNMPTT

SNMPTRAPD (Simple Network Management Protocol Trap Daemon)

Receives the SNMP Traps from the network

It can accept or reject the traps depending on it's configuration

Nagios xi accepts v1 & v2c traps from any source by default

v3 traps require additional configuration due to the security nature of v3 traps

Spools the traps so SNMPTT can process them

SNMPTT (Simple Network Management Protocol Trap Translator)

Processes the spooled traps from SNMPTRAPD

Responsible for filtering the types of traps that are forwarded to Nagios xi

Allows Nagios to receive send alerts based on the trap states received from SNMPTT

Both of these components are used to receive and process SNMP Traps sent to the Nagios xi server.

Standard vs Embedded Handler

The handler is the program used by SNMPTRAPD to spool the trap for SNMPTT.

The difference between the two is as follows:

Standard

Each time a trap is received, a process must be created to run the snmptthandler program

SNMPv3 EngineID and names are not passed by SNMPTRAPD to snmptthandler (SNMP v3 traps will still be processed correctly)

Suitable for most standard installations

Embedded

The handler is loaded and initialized when SNMPTRAPD is started, so there is less overhead as a new process does not need to be created and initialization is done only once

SNMPv3 EngineID and names variables are available in SNMPTT (B* variables)

Recommended if there is a high volume of traps being received

Standard Handler Configuration

The standard handler is enabled by default on Nagios xi. This is configured with the following line in the /etc/snmp/snmptrapd.conf file:

traphandle default /usr/sbin/snmptthandler

Enhanced Handler Configuration

The enhanced handler can be enabled by making the following configuration changes.

Edit the /etc/snmp/snmptrapd.conf file:

Remove this line:

traphandle default /usr/sbin/snmptthandler

Add this line (as per your operating system distribution):

RHEL | CentOS | Oracle Linux

perl do "/usr/share/snmptt/snmptthandler-embedded";

Debian | Ubuntu

perl do "/usr/lib/snmptt/snmptthandler-embedded";

You also need to edit the INIT script to add an extra option. The steps are slightly different depending on the operating system version being used.

RHEL 7+| CentOS 7+ | Oracle Linux 7+

Edit the /etc/sysconfig/snmptrapd file:

Add this line:

OPTIONS="-Lsd -On"

Now restart the SNMPTRAPD service:

systemctl daemon-reload
systemctl restart snmptrapd.service

Debian

Edit the /etc/default/snmptrapd file:

Find this line:

TRAPDOPTS='-Lsd -p /run/snmptrapd.pid'

Add -On to the line:

TRAPDOPTS='-Lsd -On -p /run/snmptrapd.pid'

Now restart the SNMPTRAPD service:

systemctl daemon-reload
systemctl restart snmptrapd.service

Ubuntu 16/18/20

Edit the /etc/default/snmptrapd file:

Find this line:

TRAPDOPTS='-Ln -p /run/snmptrapd.pid'

Add -On to the line:

TRAPDOPTS='-Ln -On -p /run/snmptrapd.pid'

Now restart the SNMPTRAPD service:

systemctl daemon-reload
systemctl restart snmptrapd.service

Test

If you changed the handler method above you can test it's working by sending a test trap. Please refer to this article:

How To Send A Test Trap

Resources

The SNMPTT documentation was the basis for this KB article and is a very handy for understanding how SNMPTT works.

SNMP Trap Translator

Final Thoughts

For any support related questions please visit the Nagios Support Forums at:

http://support.nagios.com/forum/