Zabbix Documentation 2.0

3.04.04.4 (current)| In development:5.0 (devel)| Unsupported:1.82.02.22.43.23.44.2Guidelines

User Tools

Site Tools


manual:config:items:itemtypes:snmptrap

Differences

This shows you the differences between two versions of the page.

Link to this comparison view

Both sides previous revision Previous revision
Next revision
Previous revision
manual:config:items:itemtypes:snmptrap [2013/01/18 15:16]
martins-v usermacros and global regexps supported in snmp trap item key parameter
manual:config:items:itemtypes:snmptrap [2015/11/02 13:52] (current)
richlv zabbix uses 'regexp' almost everywhere, change a few exceptions
Line 17: Line 17:
   - SNMPTT or Perl trap receiver parses, formats and writes the trap to a file   - SNMPTT or Perl trap receiver parses, formats and writes the trap to a file
   - Zabbix SNMP trapper reads and parses the trap file   - Zabbix SNMP trapper reads and parses the trap file
-  - For each trap Zabbix finds all corresponding ​SNMP interfaces ​on hosts for the received IP or DNS address +  - For each trap Zabbix finds all "SNMP trapper"​ items with host interfaces ​matching ​the received ​trap address. Note that only the selected "IP" ​or "DNS" in host interface is used during the matching. 
-  - For each found SNMP interface, the trap is compared to all regexes ​in "​snmptrap[regex]" ​itemsIf found, the trap is set as the value of **all** ​matching ​items. If no match is found but there exists ​an "​snmptrap.fallback"​ item, the trap is set as the value of that item+  - For each found item, the trap is compared to regexp ​in "​snmptrap[regexp]"​. ​The trap is set as the value of **all** ​matched ​items. If no matching item is found and there is an "​snmptrap.fallback"​ item, the trap is set as the value of that. 
-  - If no match has been found for any of the corresponding SNMP interfaces, Zabbix by default logs the unmatched trap. (This is configured by "Log unmatched SNMP traps" in Administration -> General -> Other).+  - If the trap was not set as the value of any item, Zabbix by default logs the unmatched trap. (This is configured by "Log unmatched SNMP traps" in Administration -> General -> Other.)
  
 === - Configuring SNMP traps === === - Configuring SNMP traps ===
Line 36: Line 36:
 ^  Description ​ ^  Return value  ^  Comments ​ ^ ^  Description ​ ^  Return value  ^  Comments ​ ^
 | ||| | |||
-^snmptrap[regex] ||| +^snmptrap[regexp] ||| 
-| Catches all SNMP traps from a corresponding address that match **regex** | SNMP trap | This item can be set only for SNMP interfaces.\\ **This item is supported starting from version 2.0.0.**\\ //Note//: Starting with Zabbix 2.0.5, user macros and global regular expressions are supported in the parameter of this item key.  |+| Catches all SNMP traps from a corresponding address that match the [[:​manual/​regular_expressions|regular expression]] specified in **regexp** | SNMP trap | This item can be set only for SNMP interfaces.\\ **This item is supported starting from version 2.0.0.**\\ //Note//: Starting with Zabbix 2.0.5, user macros and global regular expressions are supported in the parameter of this item key.  |
 | ||| | |||
 ^snmptrap.fallback ||| ^snmptrap.fallback |||
 | Catches all SNMP traps from a corresponding address that were not caught by any of the snmptrap[] items for that interface | SNMP trap | This item can be set only for SNMP interfaces.\\ **This item is supported starting from version 2.0.0.** ​ | | Catches all SNMP traps from a corresponding address that were not caught by any of the snmptrap[] items for that interface | SNMP trap | This item can be set only for SNMP interfaces.\\ **This item is supported starting from version 2.0.0.** ​ |
 +
 +<​note>​Multi-line regexp matching is not supported at this time.</​note>​
  
 Set the **Type of information** to be '​Log'​ for the timestamps to be parsed. Note that other formats such as '​Numeric'​ are also acceptable but might require a custom trap handler. Set the **Type of information** to be '​Log'​ for the timestamps to be parsed. Note that other formats such as '​Numeric'​ are also acceptable but might require a custom trap handler.
Line 50: Line 52:
 == Configuring Zabbix server/​proxy == == Configuring Zabbix server/​proxy ==
  
-To read the traps, Zabbix server or proxy must be configured to start the SNMP trapper process and point to the trap file that is being written by SNMPTT or a perl trap receiver. To do that, edit the configuration file ([[:2.0/manual/appendix/config/zabbix_server|zabbix_server.conf]] or [[:2.0/manual/appendix/config/zabbix_proxy|zabbix_proxy.conf]]):​+To read the traps, Zabbix server or proxy must be configured to start the SNMP trapper process and point to the trap file that is being written by SNMPTT or a perl trap receiver. To do that, edit the configuration file ([[manual:appendix:config:zabbix_server|zabbix_server.conf]] or [[manual:appendix:config:zabbix_proxy|zabbix_proxy.conf]]):​
   - StartSNMPTrapper=1   - StartSNMPTrapper=1
   - SNMPTrapperFile=[TRAP FILE]   - SNMPTrapperFile=[TRAP FILE]
  
 +<note warning>​If systemd parameter **[[http://​www.freedesktop.org/​software/​systemd/​man/​systemd.exec.html#​PrivateTmp=|PrivateTmp]]** is used, this file is unlikely to work in ///​tmp//​.</​note>​
 == Configuring SNMPTT == == Configuring SNMPTT ==
  
Line 73: Line 76:
   * configure the receiver, e.g:\\ $SNMPTrapperFile = '[TRAP FILE]';​\\ $DateTimeFormat = '[DATE TIME FORMAT]';​   * configure the receiver, e.g:\\ $SNMPTrapperFile = '[TRAP FILE]';​\\ $DateTimeFormat = '[DATE TIME FORMAT]';​
  
 +<note tip>If script name is not quoted, snmptrapd will refuse to start up with messages, similar to these:
 +  Regexp modifiers "/​l"​ and "/​a"​ are mutually exclusive at (eval 2) line 1, at end of line
 +  Regexp modifier "/​l"​ may not appear twice at (eval 2) line 1, at end of line
 +</​note>​
 +  ​
 == SNMP trap format == == SNMP trap format ==
  
Line 104: Line 112:
   - The new data are parsed. If this was the rotated file, the file is closed and goes back to step 2.   - The new data are parsed. If this was the rotated file, the file is closed and goes back to step 2.
   - If there was no new data, Zabbix sleeps for 1 second and goes back to step 2.   - If there was no new data, Zabbix sleeps for 1 second and goes back to step 2.
 +
 +<note important>​The maximum log file size supported by Zabbix is 2 gigabytes. The log file must be rotated before reaching this limit.</​note>​
  
 == File system == == File system ==
Line 114: Line 124:
   - **snmptt.ini** - configure output file and time format:\\ log_file = /​tmp/​my_zabbix_traps.tmp\\ date_time_format = %H:%M:%S %Y/%m/%d   - **snmptt.ini** - configure output file and time format:\\ log_file = /​tmp/​my_zabbix_traps.tmp\\ date_time_format = %H:%M:%S %Y/%m/%d
   - **snmptt.conf** - define a default trap format: \\ EVENT general .* %%"​General event"​%% Normal\\ FORMAT ZBXTRAP $aA $ar   - **snmptt.conf** - define a default trap format: \\ EVENT general .* %%"​General event"​%% Normal\\ FORMAT ZBXTRAP $aA $ar
-  - Create an SNMP item TEST:\\ Host's SNMP interface IP: 127.0.0.1\\ Key: %%snmptrap["​general"]%%\\ Log time format: hh:mm:ss yyyy/MM/dd+  - Create an SNMP item TEST:\\ Host's SNMP interface IP: 127.0.0.1\\ Key: %%snmptrap["​General"]%%\\ Log time format: hh:mm:ss yyyy/MM/dd
 This results in: This results in:
   - Command used to send a trap:\\ snmptrap -v 1 -c public 127.0.0.1 '​.1.3.6.1.6.3.1.1.5.3'​ '​0.0.0.0'​ 6 33 '​55'​ .1.3.6.1.6.3.1.1.5.3 ​ s "​teststring000"​   - Command used to send a trap:\\ snmptrap -v 1 -c public 127.0.0.1 '​.1.3.6.1.6.3.1.1.5.3'​ '​0.0.0.0'​ 6 33 '​55'​ .1.3.6.1.6.3.1.1.5.3 ​ s "​teststring000"​
   - The received trap:\\ 15:48:18 2011/07/26 .1.3.6.1.6.3.1.1.5.3.0.33 Normal %%"​General event"​%% localhost - ZBXTRAP 127.0.0.1 127.0.0.1   - The received trap:\\ 15:48:18 2011/07/26 .1.3.6.1.6.3.1.1.5.3.0.33 Normal %%"​General event"​%% localhost - ZBXTRAP 127.0.0.1 127.0.0.1
   - Value for item TEST:\\ 15:48:18 2011/07/26 .1.3.6.1.6.3.1.1.5.3.0.33 Normal %%"​General event"​%% localhost - 127.0.0.1   - Value for item TEST:\\ 15:48:18 2011/07/26 .1.3.6.1.6.3.1.1.5.3.0.33 Normal %%"​General event"​%% localhost - 127.0.0.1
-<note tip>This simple example uses SNMPTT as **traphandle**. For better performance on production systems, use embedded Perl to pass traps from snmptrapd to SNMPTT or directly to Zabbix.</​note> ​Normal\\ FORMAT ZBXTRAP $aA $ar +<note tip>This simple example uses SNMPTT as **traphandle**. For better performance on production systems, use embedded Perl to pass traps from snmptrapd to SNMPTT or directly to Zabbix.</​note>​
-  - Create an SNMP item TEST:\\ Host's SNMP interface IP: 127.0.0.1\\ Key: snmptrap[+