PDA

View Full Version : snmptrap.sh does not handle multiple params


hjort
05-02-2010, 13:56
SNMP traps are prepared to carry multiple items on a single UDP request, as illustrated in the snmptrap instruction below:

$ snmptrap -v 1 -c public localhost .1.3.6.1.4.1.24.0 localhost 6 12345678 7 .1.3.6.1.4.1.24.12.10.22.64 s "2010-02-04 17:20:51,664,FATAL,main,SimpleTest,Here's an Exception" .1.3.6.1.4.1.24.12.10.22.64 s "java.lang.Exception: Exception message" .1.3.6.1.4.1.24.12.10.22.64 s " at SimpleTest.execute(SimpleTest.java:35)" .1.3.6.1.4.1.24.12.10.22.64 s " at SimpleTest.main(SimpleTest.java:18)"

On Net-SNMP's snmptrapd service LOG, that command produces this output:

2010-02-05 12:21:39 localhost [127.0.0.1] (via UDP: [127.0.0.1]:33208) TRAP, SNMP v1, community public
SNMPv2-SMI::enterprises.24.0 Enterprise Specific Trap (12345678) Uptime: 0:00:00.07
SNMPv2-SMI::enterprises.24.12.10.22.64 = STRING: "2010-02-04 17:20:51,664,FATAL,main,SimpleTest,Here's an Exception" SNMPv2-SMI::enterprises.24.12.10.22.64 = STRING: "java.lang.Exception: Exception message" SNMPv2-SMI::enterprises.24.12.10.22.64 = STRING: "at SimpleTest.execute(SimpleTest.java:35)" SNMPv2-SMI::enterprises.24.12.10.22.64 = STRING: "at SimpleTest.main(SimpleTest.java:18)"

This given trap was supposed to be forwarded to a ZABBIX server through snmptrap.sh shell script, but apparently the latter is not prepared for parsing requests using multiple parameters.

Here's the actual list of argument values, passed in the form of standard input (see [1]) during script invocation:

--------------------------------------------------
localhost
UDP: [127.0.0.1]:33208
DISMAN-EVENT-MIB::sysUpTimeInstance 0:0:00:00.07
SNMPv2-MIB::snmpTrapOID.0 SNMPv2-SMI::enterprises.24.0.0.12345678
SNMPv2-SMI::enterprises.24.12.10.22.64 "2010-02-04 17:20:51,664,FATAL,main,SimpleTest,Here's an Exception"
SNMPv2-SMI::enterprises.24.12.10.22.64 "java.lang.Exception: Exception message"
SNMPv2-SMI::enterprises.24.12.10.22.64 "at SimpleTest.execute(SimpleTest.java:35)"
SNMPv2-SMI::enterprises.24.12.10.22.64 "at SimpleTest.main(SimpleTest.java:18)"
SNMP-COMMUNITY-MIB::snmpTrapAddress.0 127.0.0.1
SNMP-COMMUNITY-MIB::snmpTrapCommunity.0 "public"
SNMPv2-MIB::snmpTrapEnterprise.0 SNMPv2-SMI::enterprises.24.0
--------------------------------------------------

Is there any other script (perhaps in other language) capable of properly forwarding multiple parametered SNMP traps to zabbix_sender command?

PS: I'm aiming at sending error stack traces from a Java application.

References:
[1] http://agajorte.blogspot.com/2010/02/reading-stdin-on-scripts-for-handling.html

CeeEss
05-03-2010, 13:59
This is typical of the traps i'm trying to parse, too, and probably most or all traps. Data is presented as multiple OIDs (sometimes the same one repeated with different data) so you will have to predict the position of each piece of the trap. snmptrap.sh isn't really up to this job. You might want to look at "snmptt" or write your own stripper/parser. There are a few examples out there - check the Nagios forums. What's more, you will then need to use the trap description data to query the Zabbix db for the Item Description (which must match the textual trap description exactly) to obtain the key_ that you'll need to submit the trap - it is not easy by any means. I personally think trap processing should be incorporated into Zabbix - processing traps externally is a royal pain.