RHEL SNMP

[Hinux]

Hi

I monitor my Linux servers via snmp with a third party tool.
The problem is every sunday at Time: 4:14:40, it seems that the snmpd agent dies or restarts, im not sure.
This is the output of messages around that time
May 20 04:03:19 my-lnx2 snmpd[28405]: NET-SNMP version 5.1.2
May 20 04:03:19 my-lnx2 snmpd[28405]: cmaX: subMIB 16 handler has disconnected
May 20 04:03:19 my-lnx2 snmpd[28405]: cmaX: subMIB 21 handler has disconnected
May 20 04:03:19 my-lnx2 snmpd[28405]: cmaX: subMIB 22 handler has disconnected
May 20 04:03:19 my-lnx2 snmpd[28405]: cmaX: subMIB 23 handler has disconnected
May 20 04:03:19 my-lnx2 crond(pam_unix)[27797]: session closed for user root
May 20 04:03:19 my-lnx2 snmpd[28405]: cmaX: subMIB 1 will be sent on port 25376 to hp Advanced Server Management_Peer
May 20 04:03:19 my-lnx2 snmpd[28405]: cmaX: subMIB 2 will be sent on port 25376 to hp Advanced Server Management_Peer
May 20 04:03:19 my-lnx2 snmpd[28405]: cmaX: subMIB 3 will be sent on port 25376 to hp Advanced Server Management_Peer
May 20 04:03:19 my-lnx2 snmpd[28405]: cmaX: subMIB 5 will be sent on port 25376 to hp Advanced Server Management_Peer
May 20 04:03:19 my-lnx2 snmpd[28405]: cmaX: subMIB 6 will be sent on port 25376 to hp Advanced Server Management_Peer
May 20 04:03:19 my-lnx2 snmpd[28405]: cmaX: subMIB 8 will be sent on port 25376 to hp Advanced Server Management_Peer
May 20 04:03:19 my-lnx2 snmpd[28405]: cmaX: subMIB 9 will be sent on port 25376 to hp Advanced Server Management_Peer
May 20 04:03:19 my-lnx2 snmpd[28405]: cmaX: subMIB 10 will be sent on port 25376 to hp Advanced Server Management_Peer
May 20 04:03:19 my-lnx2 snmpd[28405]: cmaX: subMIB 11 will be sent on port 25376 to hp Advanced Server Management_Peer
May 20 04:03:19 my-lnx2 snmpd[28405]: cmaX: subMIB 14 will be sent on port 25376 to hp Advanced Server Management_Peer
May 20 04:03:19 my-lnx2 snmpd[28405]: cmaX: subMIB 15 will be sent on port 25376 to hp Advanced Server Management_Peer
May 20 04:03:19 my-lnx2 snmpd[28405]: cmaX: subMIB 16 will be sent on port 25376 to hp Advanced Server Management_Peer
May 20 04:03:19 my-lnx2 snmpd[28405]: cmaX: subMIB 21 will be sent on port 25376 to hp Advanced Server Management_Peer
May 20 04:03:19 my-lnx2 snmpd[28405]: cmaX: subMIB 22 will be sent on port 25376 to hp Advanced Server Management_Peer
May 20 04:03:19 my-lnx2 snmpd[28405]: cmaX: subMIB 23 will be sent on port 25376 to hp Advanced Server Management_Peer
May 20 04:03:19 my-lnx2 snmpd[28405]: cmaX: subMIB 18 handler has disconnected
May 20 04:03:19 my-lnx2 snmpd[28405]: cmaX: subMIB 18 will be sent on port 25393 to cpqnicd
May 20 04:05:54 my-lnx2 snmpd[28405]: Received SNMP packet(s) from 127.0.0.1
May 20 04:05:54 my-lnx2 snmpd[28405]: Received SNMP packet(s) from "IP"
May 20 04:06:48 my-lnx2 snmpd[28405]: Received SNMP packet(s) from "IP"


I make use HP's PSP 7.4.0 aswell
Any advise or help would be apprecaited.

 

[Annihilannic]

Sunday 4am is when the weekly cron jobs and log rotation scripts run; I'd guess logrotate is probably killing and restarting the snmpd to force it to re-open its log file or something? Try looking for an SNMP related file in /etc/logrotate.d.

Annihilannic.

 

[Hinux]

Hi Annihilannic

You seem to be right!!
this is in /etc/logrotate.d/snmpd

/var/log/snmpd.log {
notifempty
missingok
postrotate
/sbin/service snmpd condrestart 2> /dev/null > /dev/null || true
endscript
}

How can i change this? Can I change "condrestart" to "status" maybe?...or just wipe the snmpd script in /etc/logrotate.d
What would you recommend?
If i dont fix this, it will seem as if i had downtime or a boot every sunday on my graphs.
Thanks for your help!!!
Hinux

 

[Annihilannic]

Well there is no point in changing it to 'status' because that would defeat the purpose of rotating the log at all... the snmpd would keep the original log file open and keep writing to it, eventually filling the filesystem.

I find it odd that your monitoring complains so much since snmpd should restart fairly quickly.. can you put in a 'blackout' for your monitoring for that period or something?

Failing that you could configure snmpd not to do any logging perhaps, and simply remove the /etc/logrotate.d/snmpd file completely.

Annihilannic.

 

[gdvissch]

It could be that the SNMP server sends a trap (coldstart/warmstart) when it start/stops.

If this is the case, even if the start/stop lasts only a millisecond, the management server will react on the traps and register a downtime for the monitored server

Maybe you can change the behaviour of the service and make it not sends traps?

CU
G.