SNMP-Trap Handling Howto

[ploeger]

Hi there!

I've struggled with configuring zabbix 1.4.4 for snmp trap handling. For all you out there dealing with the same thoughts, have a look at this brand-new documentation in the wiki:

http://www.zabbix.com/wiki/doku.php?id=howto:snmptraps

Have fun.

Dennis

[fredfire]

Thanks for the info!

[DeXTeR-ITA]

Hi ploeger,
I follow your wiki, and after one little issues, I've got the message in zabbix but the messages is every time the same:

(<UNKNOWN>, 10.2.34.215) DISMAN-EVENT-MIB::sysUpTimeInstance: 0:0:00:00.00

I think the <UNKNOWN> is because the mapping are not configured, but the string with real message where is??

This is my configuration:

use constant TRUE => 1;
use constant FALSE => 0;

# configuration part

# SNMP-Parsing

$onlyinteresting = TRUE;         # Only send interesting trap informations
                                  # (the host's uptime, the trap's oid, community and SMI-information)

# Zabbix-Server

$zabbix_server = "localhost";    # Hostname/IP-Address of zabbix-server
$zabbix_port = 10051;            # Port of zabbix-server (Default: 10051)
$item = "snmptraps";             # Item to save snmptraps to

# Wildcard-Host

$wildcard_host = "Default_Trapper";   # Hostname or IP-Adress of wildcard-host within zabbix
$alltowildcard = FALSE;           # Send all traps to wildcard host

I try to set the "$onlyinteresting" in TRUE or FALSE, but nothing happens.
I receive the messages from a IBM DS4300 Storage System, and is:

Mar  3 14:32:11 zabbixsrv snmptrapd[4781]: 2008-03-03 14:32:11 10.2.34.215(via UDP: [10.2.34.215]:3312) TRAP, SNMP v1, community public ^ISNMPv2-SMI::enterprises.1123.4.300 Enterprise Specific Trap (1) Uptime: 0:00:00.00 ^ISNMPv2-SMI::enterprises.1123.4.300.1.1.1 = IpAddress: 0.0.0.0^ISNMPv2-SMI::enterprises.1123.4.300.1.1.2 = STRING: "Out-of-Band       "^ISNMPv2-SMI::enterprises.1123.4.300.1.1.3 = STRING: "ds4300_rsard                  "^ISNMPv2-SMI::enterprises.1123.4.300.1.1.4 = STRING: "4011                "^ISNMPv2-SMI::enterprises.1123.4.300.1.1.5 = STRING: "3-mar-2008 14.30.02                     "^ISNMPv2-SMI::enterprises.1123.4.300.1.1.6 = STRING: "Logical Drive not on preferred path due to ADT/RDAC failover          "^ISNMPv2-SMI::enterprises.1123.4.300.1.1.7 = STRING: "Controller                                                  "^ISNMPv2-SMI::enterprises.1123.4.300.1.1.8 = STRING: "Controller in slot A                    "

Any idea?
Thank you for your guide, finaly I understand snmptrap, unfortunaly I'am not a programmaer...

[ploeger]

Hi!

Hi ploeger,

(<UNKNOWN>, 10.2.34.215) DISMAN-EVENT-MIB::sysUpTimeInstance: 0:0:00:00.00

I think the <UNKNOWN> is because the mapping are not configured, but the string with real message where is??

No, the <UNKNOWN> comes from the hostname. Your host 10.2.34.215 simply doesn't know itself's hostname. Perhaps you'll have to configure it somewhere there.

Hope that helps.

Regards,
Dennis

[DeXTeR-ITA]

Ahh ok... so this is not a problem, but the real message (STRING: "Logical Drive not on preferred path due to ADT/RDAC failover ") where is?

Can we view in zabbix?

[ploeger]

Hi again!

You should set "only_interesting" to False to test properly. Then all traps should come up in zabbix under your host "Default_Trapper" (the wildcard host) as the value of "snmptraps". How did you set up your mapping? Please include "mapping_method" and "mapping_option" from your configuration part here.

Thanks.

Regards,
Dennis

[pierre-hoffmann]

Hi,

I've some question:
I've successful configure my snmptrapper with perl script
and values go on my Zabbix snmptrap' item; but how you create
a trigger to redirect message item to trigger ??

Regards,
Pierre.

[AndreyHammer]

How check what data from script sended to zabbix_sender?

[xs-]

you can copy the sender command int he script and echo it to a file?

[pierre-hoffmann]

How check what data from script sended to zabbix_sender?

I've make some modification in 'Dennis Ploeger' Perl script to generate a debug file
and correction in final <STDIN> loop to handle all OID :

So we can see data sended to the zabbix_sender command.

[Wed Mar 12 15:35:39 2008] command= /softs/zabbix/bin/zabbix_sender --zabbix-server 128.128.12.50 --port 10051
[Wed Mar 12 15:35:39 2008] Sendind using command /softs/zabbix/bin/zabbix_sender --zabbix-server 128.128.12.50 --port 10051 --host cxhost --key snmptraps --value "DISMAN-EVENT-MIB::sysUpTimeInstance: 12:8:04:54.54
SNMPv2-MIB::snmpTrapOID.0: SNMPv2-SMI::enterprises.1981.0.3
SNMPv2-SMI::enterprises.1981.1.4.3: \\\\\\"CXHOST\\\\\\"
SNMPv2-SMI::enterprises.1981.1.4.4: \\\\\"\\\\\"
SNMPv2-SMI::enterprises.1981.1.4.5: \\\\"2002\\\\"
SNMPv2-SMI::enterprises.1981.1.4.6: \\\"This confirms that events will be sent from the storage system to the destination you specified.\\\"
SNMPv2-SMI::enterprises.1981.1.4.7: \\"N/A\\"
SNMP-COMMUNITY-MIB::snmpTrapCommunity.0: \"public\"
" was OK :!
[Wed Mar 12 15:35:39 2008] Exiting ...

Regards,
Pierre.

#!/usr/bin/perl
############################################
#
# snmptrap.pl
# Version 1.0
# Author: Dennis Ploeger <[email protected]>
#
# 2008-03-12 P.Hoffmann : Add debugging Log
############################################
#
# This Script has been designed for Zabbix 1.4.4
# I don't know, if it's working with older versions, but I don't suppose so.
#
# Description:
# A better snmp trap-handler for zabbix. To use it, add a SNMP Trapper item
# (character) to any host you would like to receive traps for.
# After that, create a wildcard-host with a trapper item that will receive
# all snmptraps for non-existent hosts.
#
# To use it, add this script to the snmptrapd.conf:
#
# traphandle default /bin/bash {zabbix-bin-path}/snmptrap.pl

use constant TRUE => 1;
use constant FALSE => 0;

# configuration part

# SNMP-Parsing

$onlyinteresting = TRUE;          # Only send interesting trap informations
                                  # (the host's uptime, the trap's oid, community and SMI-information)

# Zabbix-Server

$zabbix_server = "zabbixserver";    # Hostname/IP-Address of zabbix-server
$zabbix_port = 10051;            # Port of zabbix-server (Default: 10051)
$item = "snmptraps";             # Item to save snmptraps to

# Wildcard-Host

$wildcard_host = "defaultTrapperHost"; # Hostname or IP-Adress of wildcard-host within zabbix
$alltowildcard = FALSE;           # Send all traps to wildcard host

# Mapping of hostname/ip-address to zabbix hostname
# Configure, how the hostname or ipaddress from the trap should be mapped to your zabbix host
# Sadly, zabbix_sender only accept the configured name of the host in zabbix, not it's hostname
# or ipaddress. Hopefully this will change in future versions.
# For now, you have the following possibilities to map the real hostname or the ip address gathered
# from the trap to your zabbix host by configuring "mapping_method" and possibly the "mapping_option":
#
# mapping_method:
# "hostname" - just use the received hostname from the trap
# "ip" - just use the received ip address from the trap
# "hostname_nonfqdn" - extract the hostname from the fqdn hostname from the trap and use that one
# "mapfile" - use the contents of the mapfile given in "mapping_option" as a "<hostname>:<zabbix-host>"-map
# "mapfile_ip" - same as "mapfile", but use a "<ip-address>:<zabbix-host>"-map
# "regexp" - use the first group of the regexp in "mapping_option" as the zabbix-host
# "regexp_ip" - like "regexp", but use the ipaddress information

$mapping_method = "hostname_nonfqdn";
$mapping_option = "";

# Zabbix-Programs

$path_to_zabbix = "/softs/zabbix";                     # Path to your zabbix-installation
$zabbix_sender = $path_to_zabbix."/bin/zabbix_sender";    # Zabbix-Sender-prog
$log = "/exploit/log/snmptraper.log";

# End of configuration section

# main()

# creating the log file
open(LOG,">>".$log) || die("Log file openning error !");
print LOG "snmptraphandler for Zabbix (". localtime(time).")\n";

# hostname_nonfqdn is basically a simple regexp
if ($mapping_method eq "hostname_nonfqdn") {
        $mapping_method = "regexp";
        $mapping_option = qr/^([^\.]*)\..*$/i;
}

# gather hostname and ip address
$hostname = <STDIN>;
chomp($hostname);
$ipaddress = <STDIN>;
chomp($ipaddress);

# map the hostname or the ip address to the zabbix host
if (!$alltowildcard) {
        if ($mapping_method eq "hostname") {
                $zabbix_host = $hostname;
        } elsif ($mapping_method eq "ip") {
                $zabbix_host = $ipaddress;
        } elsif ($mapping_method eq "regexp") {
                $hostname =~ $mapping_option;
                $zabbix_host = $1;
        } elsif ($mapping_method eq "regexp_ip") {
        $ipaddress =~ $mapping_option;
        $zabbix_host = $1;
    } elsif ($mapping_method =~ /^mapfile/) {
        # Load mapping file
        if (! -r $mapping_option) {
            print STDERR "Mapping file ($mapping_option) is not readable. Quitting.\n";
            exit 1;
        }

        open (MAP, "<$mapping_option");
        $map = join("\n",<MAP>);
        close(MAP);

        if ($mapping_method eq "mapfile") {
            $map =~ /^($hostname:[^$]*)\n/gi;
            $zabbix_host = $1;
        } elsif ($mapping_method eq "mapfile_ip") {
            $map =~ /($ipaddress:[^$]*)$/gi;
            $zabbix_host = $1;
        }
    }
} else {
        $zabbix_host = $wildcard_host;
}

print LOG "[". localtime(time)."] zabbix_host= $zabbix_host\n";

$ipaddress =~ /.*\[([^]]*)\].*/;
$ipaddress = $1;

$command = $zabbix_sender." --zabbix-server ".$zabbix_server." --port ".$zabbix_port;

# Get the snmp trap message
while(<STDIN>) {
    ($oid, $value) = /([^\s]+)\s+(.*)/;
        print LOG "[". localtime(time)."] OID: $oid\n";

    if ($onlyinteresting) {
        # Filter out uninteresting trap informations
        if (($oid !~ /sysuptimeinstance/i) &&
            ($oid !~ /snmpv2-smi/i) &&
            ($oid !~ /snmptrapoid/i) &&
            ($oid !~ /snmptrapcommunity/i)
            ) {
                next;
        }
    }

    $str = $str."$oid: $value\n";
    $str =~ s/"/\\"/gi;
 }

    print LOG "[". localtime(time)."] str= $str\n";
    print LOG "[". localtime(time)."] command= $command\n";

    while(1) {
        if ($zabbix_host eq $wildcard_host) {
            $str = "($hostname, $ipaddress) ".$str;
        }

        $mycommand = $command." --host $zabbix_host --key $item --value \"$str\"";
        $return = `$mycommand`;

        $return =~ /.*failed: ([0-9]*);.*/gi;

        if ($1 > 0) {
            if ($zabbix_host ne $wildcard_host) {
                #print STDERR "Failed to send item to host. Sending it to wildcard host instead.\n";
                print LOG "[". localtime(time)."] ERROR: Failed to send item to host ($zabbix_host). Sending it to wildcard host instead.\n";
                $zabbix_host = $wildcard_host;

            } else {

                #print STDERR "Failed to send item $str using command $mycommand\n";
                print LOG "[". localtime(time)."] ERROR: Failed to send item $str using command $mycommand\n";
                print LOG "[". localtime(time)."] Exiting ...\n";
                close LOG;
                exit 1;
            }
        } else {
                print LOG "[". localtime(time)."] Sendind using command $mycommand was OK :!\n";
                print LOG "[". localtime(time)."] Exiting ...\n";
                close LOG;
                exit 0;
        }
    }

[pierre-hoffmann]

The test command:

 snmptrap -v1 -c public localhost .1.3.6.1.6.3.1.1.5.2 0 0 "" "" .1.3.6.1.4.1 s "hello"

The result in log

snmptraphandler for Zabbix (Wed Mar 12 15:38:11 2008)
[Wed Mar 12 15:38:11 2008] zabbix_host=
[Wed Mar 12 15:38:11 2008] OID: DISMAN-EVENT-MIB::sysUpTimeInstance
[Wed Mar 12 15:38:11 2008] OID: SNMPv2-MIB::snmpTrapOID.0
[Wed Mar 12 15:38:11 2008] OID: SNMPv2-SMI::enterprises
[Wed Mar 12 15:38:11 2008] OID: SNMP-COMMUNITY-MIB::snmpTrapCommunity.0
[Wed Mar 12 15:38:11 2008] OID: SNMPv2-MIB::snmpTrapEnterprise.0
[Wed Mar 12 15:38:11 2008] str= DISMAN-EVENT-MIB::sysUpTimeInstance: 0:2:25:15.67
SNMPv2-MIB::snmpTrapOID.0: SNMPv2-MIB::coldStart
SNMPv2-SMI::enterprises: \\"hello\\"
SNMP-COMMUNITY-MIB::snmpTrapCommunity.0: \"public\"

[Wed Mar 12 15:38:11 2008] command= /softs/zabbix/bin/zabbix_sender --zabbix-server 128.128.12.50 --port 10051
[Wed Mar 12 15:38:11 2008] ERROR: Failed to send item to host (). Sending it to wildcard host instead.
[Wed Mar 12 15:38:11 2008] Sendind using command /softs/zabbix/bin/zabbix_sender --zabbix-server 128.128.12.50 --port 10051 --host twiki --key snmptraps --value "(localhost, 127.0.0.1) DISMAN-EVENT-MIB::sysUpTimeInstance: 0:2:25:15.67
SNMPv2-MIB::snmpTrapOID.0: SNMPv2-MIB::coldStart
SNMPv2-SMI::enterprises: \\"hello\\"
SNMP-COMMUNITY-MIB::snmpTrapCommunity.0: \"public\"
" was OK :!
[Wed Mar 12 15:38:11 2008] Exiting ...

Result in Zabbix


But now i'm trying to find a good solution to redirect trap message to a Zabbix Trigger like "Disk XXX is DEAD".

Regards,
Pierre.

[pierre-hoffmann]

Hi,

I've found a tool to convert SNMP trap to "comprehensive" language

SNMP Trap Translator : http://www.snmptt.org/


Any 'SNMP Traps' native support in future Zabbix 1.6 ??

Regards,
Pierre.

[pierre-hoffmann]

A begin of response for simple trigger, ... but y search for a specific OID, perhaps with regexp() ?

Creating Triggers:

Create a new trigger on the trap item, using an expression like:

({HOSTNAME:some.long.oid.str(sometext)}=1) & ({HOSTNAME:some.long.oid.nodata(60)}=0)

This will look for (sometext) in the string sent for the item having key=(some.long.oid). The nodata(60)=0 is required to make the trigger go false. Change the 60 to however many seconds you wish.

Come from here : http://www.zabbix.com/forum/showthread.php?p=13574.

[xs-]

The working of the default / mofied .sh and perl scripts posted on thus forum greatly depend on the output format of snmptrapd.
All these scripts are based on the default output of, i think, redhat. If you are using debian / ubuntu, this format is different.
I am also struggling to get this working, and so far i bumped into the above problem. Does anyone know more about these output formats and which is the 'default' used for the .sh / .pl scripts?

Thanks

[szettervall]

Problem seeing data in Zabbix

System: Ubuntu 7.04. Running Zabbix 1.4.5

Problem: I am seeing traps in my /var/log/daemon.log but I am not seeing anything in the Zabbix interface. I am looking under Monitoring -> Latest Data -> Select Host -> History.

I implemented the previously mentioned logging in attempts to get an idea what might be happening however I am not getting logger there either.

Here is my configuration information:

/etc/snmp/snmptrapd.conf

$ sudo cat /etc/snmp/snmptrapd.conf
###############################################################################
#
# EXAMPLE-trap.conf:
#   An example configuration file for configuring the Net-SNMP snmptrapd agent.
#
###############################################################################
#
# This file is intended to only be an example.  If, however, you want
# to use it, it should be placed in /etc/snmp/snmptrapd.conf.
# When the snmptrapd agent starts up, this is where it will look for it.
#
# All lines beginning with a '#' are comments and are intended for you
# to read.  All other lines are configuration commands for the agent.

#
# PLEASE: read the snmptrapd.conf(5) manual page as well!
#
traphandle default /bin/bash /home/zabbix/bin/snmptraper.pl

snmptrapd.conf

$ cat /home/zabbix/bin/snmptraper.pl
#!/usr/bin/perl
use constant TRUE => 1;
use constant FALSE => 0;
# configuration part
# SNMP-Parsing
$onlyinteresting = FALSE;          # Only send interesting trap informations # (the host's uptime, the trap's oid, community and SMI-information)
$zabbix_server = "localhost";    # Hostname/IP-Address of zabbix-server
$zabbix_port = 10051;            # Port of zabbix-server (Default: 10051)
$item = "snmptraps";             # Item to save snmptraps to
$wildcard_host = "snmptrap-catchall"; # Hostname or IP-Adress of wildcard-host within zabbix
$alltowildcard = FALSE;           # Send all traps to wildcard host

$mapping_method = "hostname_nonfqdn";
$mapping_option = "";

# Zabbix-Programs
$path_to_zabbix = "/usr/local/sbin";                     # Path to your zabbix-installation
$zabbix_sender = "/usr/local/sbin/zabbix_sender";    # Zabbix-Sender-prog
$log = "/home/zabbix/bin/snmptraper.log";
# End of configuration section

# main()

# creating the log file
open(LOG,">>".$log) || die("Log file openning error !");
print LOG "snmptraphandler for Zabbix (". localtime(time).")\n";

# hostname_nonfqdn is basically a simple regexp
if ($mapping_method eq "hostname_nonfqdn") {
        $mapping_method = "regexp";
        $mapping_option = qr/^([^\.]*)\..*$/i;
}

# gather hostname and ip address
$hostname = <STDIN>;
chomp($hostname);
$ipaddress = <STDIN>;
chomp($ipaddress);

# map the hostname or the ip address to the zabbix host
if (!$alltowildcard) {
        if ($mapping_method eq "hostname") {
                $zabbix_host = $hostname;
        } elsif ($mapping_method eq "ip") {
                $zabbix_host = $ipaddress;
        } elsif ($mapping_method eq "regexp") {
                $hostname =~ $mapping_option;
                $zabbix_host = $1;
        } elsif ($mapping_method eq "regexp_ip") {
        $ipaddress =~ $mapping_option;
        $zabbix_host = $1;
    } elsif ($mapping_method =~ /^mapfile/) {
        # Load mapping file
        if (! -r $mapping_option) {
            print STDERR "Mapping file ($mapping_option) is not readable. Quitting.\n";
            exit 1;
        }

        open (MAP, "<$mapping_option");
        $map = join("\n",<MAP>);
        close(MAP);

        if ($mapping_method eq "mapfile") {
            $map =~ /^($hostname:[^$]*)\n/gi;
            $zabbix_host = $1;
        } elsif ($mapping_method eq "mapfile_ip") {
            $map =~ /($ipaddress:[^$]*)$/gi;
            $zabbix_host = $1;
        }
    }
} else {
        $zabbix_host = $wildcard_host;
}
print LOG "[". localtime(time)."] zabbix_host= $zabbix_host\n";
$ipaddress =~ /.*\[([^]]*)\].*/;
$ipaddress = $1;
$command = $zabbix_sender." --zabbix-server ".$zabbix_server." --port ".$zabbix_port;

# Get the snmp trap message
while(<STDIN>) {
    ($oid, $value) = /([^\s]+)\s+(.*)/;
        print LOG "[". localtime(time)."] OID: $oid\n";
    if ($onlyinteresting) {
        # Filter out uninteresting trap informations
        if (($oid !~ /sysuptimeinstance/i) &&
            ($oid !~ /snmpv2-smi/i) &&
            ($oid !~ /snmptrapoid/i) &&
            ($oid !~ /snmptrapcommunity/i)
            ) {
                next;
        }
    }
    $str = $str."$oid: $value\n";
    $str =~ s/"/\\"/gi;
 }
    print LOG "[". localtime(time)."] str= $str\n";
    print LOG "[". localtime(time)."] command= $command\n";
    while(1) {
        if ($zabbix_host eq $wildcard_host) {
            $str = "($hostname, $ipaddress) ".$str;
        }
        $mycommand = $command." --host $zabbix_host --key $item --value \"$str\"";
        $return = `$mycommand`;
        $return =~ /.*failed: ([0-9]*);.*/gi;
        if ($1 > 0) {
            if ($zabbix_host ne $wildcard_host) {
                #print STDERR "Failed to send item to host. Sending it to wildcard host instead.\n";
                print LOG "[". localtime(time)."] ERROR: Failed to send item to host ($zabbix_host). Sending it to wildcard host instead.\n";
                $zabbix_host = $wildcard_host;
            } else {
                #print STDERR "Failed to send item $str using command $mycommand\n";
                print LOG "[". localtime(time)."] ERROR: Failed to send item $str using command $mycommand\n";
                print LOG "[". localtime(time)."] Exiting ...\n";
                close LOG;
                exit 1;
            }
        } else {
                print LOG "[". localtime(time)."] Sendind using command $mycommand was OK :!\n";
                print LOG "[". localtime(time)."] Exiting ...\n";
                close LOG;
                exit 0;
        }
    }

In Zabbix:

Created host "snmptrap-catchall"
Added item to above host "snmptraps"

Type: Zabbix Trapper
Key: snmptraps
Type of Information: Character

Anyone have advise?