How do I change trap alert from unknown to critical in Icinga 1?

Question

I have a trap being sent by a device showing up as UNKNOWN in Icinga 1.13 because the MIB expects an integer but the trap sends:

Failed to connect to SIP registrar Can not establish connection with SIP registrar 12848-49-55,45:52:45.50,044:4956585254584953464844485848 203 Active Alarm Table Wrong Type (should be INTEGER): 2

I can't modify the MIB on the device so I'm left thinking I should make Icinga treat any trap as critical, whether it conforms to the MIB or not. How can I do this?

You should probably specify a bit more, how you delivered SNMP traps to your Icinga. Icinga usually uses some add-ons to process SNMP tracts. — Věroš K., Apr 21 '17 at 15:11
Hmm. snmptrapd catches the trap, snmptt translates it and . . . — mr.zog, Apr 21 '17 at 16:40
We have a script /etc/icinga/scripts/submit_check_result.sh that contains `/usr/bin/printf "%s\t%s\t%s\t%s\n" "$1" "$2" "$return_code" "$4" | /usr/sbin/send_nsca -H 143.24.219.31 -c /etc/nagios/send_nsca.cfg &` — mr.zog, Apr 21 '17 at 20:24

score 1 · Answer 1 · answered Apr 23 '17 at 14:11

TL;DR: Update your script to set $return_code to 2.

Thank you for your clarification. You mentioned you're using combination of ncsa and send_ncsa.

/usr/bin/printf "%s\t%s\t%s\t%s\n" "$1" "$2" "$return_code" "$4" | \
/usr/sbin/send_nsca -H XXX.XXX.219.31 -c /etc/nagios/send_nsca.cfg

Icinga 1 and Nagios can use ncsa on Icinga server side for (passive) accepting results of checks. It means, that NCSA just listens on some TCP socket, receives results over the socket and pushes received data to Icinga (Nagios).

send_ncsa script on your machine then accepts parameters which would be fed into Nagios/Icinga (AFAIK the parameters are host_name, service_name, service_result, service_message).

The part you want to change in your script is setting of $return_code - it follows standard Icinga/Nagios behaviour - where 0 is for OK, 1 for WARNING, 2 for CRITICAL and 3 means UNKNOWN.

So in order to send CRITICAL as check result to Icinga, update your script to set $return_code to 2.

Wondering if I should write a separate script just for traps. Hmm. — mr.zog, Apr 25 '17 at 16:23

score 0 · Accepted Answer · answered May 06 '17 at 21:09

#!/bin/sh

# Arguments:
#  $1 = host_name (Short name of host that the service is
#       associated with)
#  $2 = svc_description (Description of the service)
#  $3 = state_string (A string representing the status of
#       the given service - "OK", "WARNING", "CRITICAL"
#       or "UNKNOWN")
#  $4 = plugin_output (A text string that should be used
#       as the plugin output for the service checks)
#  $5 = Performance data
#  $6 = Service Check Commands
#

LOGFILE=/var/log/icinga/submit_check_result.log
# Convert the state string to the corresponding return code
return_code=2

case "$3" in
    OK)
        return_code=0
        ;;
    WARNING)
        return_code=1
        ;;
    CRITICAL)
        return_code=2
        ;;
    UNKNOWN)
        return_code=2
        ;;
esac

# pipe the service check info into the send_nsca program, which
# in turn transmits the data to the nsca daemon on the central
# monitoring server

# submit to Cleveland Icinga Master
/usr/bin/printf "%s\t%s\t%s\t%s\n" "$1" "$2" "$return_code" "$4" | /usr/sbin/send_nsca -H 111.222.333.44 -c /etc/nagios/send_nsca.cfg &

How do I change trap alert from unknown to critical in Icinga 1?

2 Answers2