snmptrapd ignoring/dropping traps (performance issues?)

[Ricardo Oliveira]

Hi,



I'm using snmptrapd v5.1.2 on CentOS 5.2, and I'm having some issues with traps being ignored or dropped.

I have several devices logging to the server, so I'm concerned this could be a performance issue of snmptrapd.

Otherwise, it could very well be some kind of configuration issue on my part, and that's why I'm asking for your help.

My startup options are:



-Ls6 -p /var/run/snmptrapd.pid



My snmptrapd.conf has the following:



--- start ---

disableAuthorization yes

traphandle SNMPv2-SMI::enterprises.9.9.41.2.0.1 /usr/local/bin/TrapHandler

--- end ---



The TrapHandler is a C++ executable I made which basically receives a trap, forks and dumps the trap to a file, to try and return to the snmptrapd as fast as possible (before, I had a perl script, but it was way too slow).



The symptoms I have are:



- The trap is generated on the device

- The trap is received at the interface (seen by tcpdump)

- The traps never shows on any log file.



I tried:



- Adding -d to the options: successfully logs the number of bytes received from each host. The lost traps do NOT show on this log.

- Adding -D ALL to the options: snmptrapd inexplicably crashes/dies after a few seconds and logs nothing.

- Running snmptrapd logging to stdout in a shell: again, the traps never show on the log



I'm not sure how many traps per second this should be able to handle, but right now I consider I'm way bellow the number I will need to handle (I'm only receiving from less than 10 devices, although some generate a large amount of traps) and I'm concerned this daemon will not be enough for my requirements.



Can anyone give me any help/tips with this one?



Thanks in advance,

Ricardo Oliveira.

_________________________________________________________________
Show them the way! Add maps and directions to your party invites.
http://www.microsoft.com/windows/windowslive/products/events.aspx

[Thomas Anders]

Post by Ricardo Oliveira
traphandle SNMPv2-SMI::enterprises.9.9.41.2.0.1 /usr/local/bin/TrapHandler
--- end ---
The TrapHandler is a C++ executable I made which basically receives a
trap, forks and dumps the trap to a file, to try and return to the
snmptrapd as fast as possible (before, I had a perl script, but it was
way too slow).
- The trap is generated on the device
- The trap is received at the interface (seen by tcpdump)
- The traps never shows on any log file.

On the receiving side: consider switching to an embedded Perl trap handler which saves snmptrapd from forking on every notification. Depending on your package, you may need to rebuild net-snmp with embedded Perl support. Run "snmptrapd -H 2>&1 | grep -i perl" to find out if snmptrapd supports the "perl" config token.

On the sender side: switch to SNMP INFORM instead of SNMP TRAP. The sender is expected to re-transmit the notification if it doesn't get a response, then.


+Thomas