After reading several threads and tinkering a bit I had not found solutions to the following two problems:
1. How to make a reasonable trigger based on traps that doesn't either get stuck ON or possibly miss some traps during some "nodata" period.
2. How to send incoming traps directly to the correct zabbix host (if configured) without knowing what the OIDs will be while sending traps from unconfigured hosts to a default trap host for examination.
I wanted to be able to add a standardized item and trigger to an arbitrary number of hosts and have the snmptrap.sh script forward traps to these items based on the sender hostname. I also wanted to be able to create a trigger which would go off if *any* trap came in on a host in addition to triggers for specific traps.
Below are the basic steps I went through to get this working:
In Zabbix:
1. Create a Default_Trapper host (no IP needed).
2. Add the following item:
name: SNMP_Trapper_Item
type: ZABBIX trapper
key: snmptraps
Type of information: Character
3. Add the following trigger for any received trap (note the expression is true *unless* a trap is received, hence the comparison with 0).
name: {HOSTNAME} Trap Received
expr: {Default_Trapper:snmptraps.str(NO_NEW_DATA)}=0
4. Add any additional triggers for specific traps (these expressions compare with 1 since they will be true when the trap comes in)
name: {HOSTNAME} Specific Trap Received
expression: {Default_Trapper:snmptraps.str(word_to_match)}=1
(For workaround notes on matching more than just one word see this thread)
5. Add the same items and triggers from above to any other hosts that you will be getting traps from. Any host with the above item will be able to have it's own trap history log and it's own triggers. (I used a template with the items & triggers and then applied the template to a number of hosts to make things a bit easier)
snmptrapd:
1. Get snmptrapd itself working (see the first part of this thread for instructions on getting that going)
2. Edit the included snmptrap.sh script as follows:
replace:
with:
replace:
with:
Basically I modified the script to send an extra trap to zabbix after each real trap to reset the item to the "NO_NEW_DATA" state. It also now tries to send the traps to specific hosts matching the trap source and then falls back to the default host if that doesn't work.
Hopefully this is clear enough and helpful for others trying to use zabbix to log and alert on snmptraps.
Andrew
1. How to make a reasonable trigger based on traps that doesn't either get stuck ON or possibly miss some traps during some "nodata" period.
2. How to send incoming traps directly to the correct zabbix host (if configured) without knowing what the OIDs will be while sending traps from unconfigured hosts to a default trap host for examination.
I wanted to be able to add a standardized item and trigger to an arbitrary number of hosts and have the snmptrap.sh script forward traps to these items based on the sender hostname. I also wanted to be able to create a trigger which would go off if *any* trap came in on a host in addition to triggers for specific traps.
Below are the basic steps I went through to get this working:
In Zabbix:
1. Create a Default_Trapper host (no IP needed).
2. Add the following item:
name: SNMP_Trapper_Item
type: ZABBIX trapper
key: snmptraps
Type of information: Character
3. Add the following trigger for any received trap (note the expression is true *unless* a trap is received, hence the comparison with 0).
name: {HOSTNAME} Trap Received
expr: {Default_Trapper:snmptraps.str(NO_NEW_DATA)}=0
4. Add any additional triggers for specific traps (these expressions compare with 1 since they will be true when the trap comes in)
name: {HOSTNAME} Specific Trap Received
expression: {Default_Trapper:snmptraps.str(word_to_match)}=1
(For workaround notes on matching more than just one word see this thread)
5. Add the same items and triggers from above to any other hosts that you will be getting traps from. Any host with the above item will be able to have it's own trap history log and it's own triggers. (I used a template with the items & triggers and then applied the template to a number of hosts to make things a bit easier)
snmptrapd:
1. Get snmptrapd itself working (see the first part of this thread for instructions on getting that going)
2. Edit the included snmptrap.sh script as follows:
replace:
Code:
HOST="snmptraps";
Code:
DEFAULTHOST="Default_Trapper"; NODATASTRING="NO_NEW_DATA"
Code:
$ZABBIX_SENDER $ZABBIX_SERVER $ZABBIX_PORT $HOST $KEY "$str"
Code:
result=`$ZABBIX_SENDER $ZABBIX_SERVER $ZABBIX_PORT $hostname $KEY "$str"` echo result is: $result if [ "$result" = "OK" ]; then $ZABBIX_SENDER $ZABBIX_SERVER $ZABBIX_PORT $hostname $KEY "$NODATASTRING" else $ZABBIX_SENDER $ZABBIX_SERVER $ZABBIX_PORT $DEFAULTHOST $KEY "$str" $ZABBIX_SENDER $ZABBIX_SERVER $ZABBIX_PORT $DEFAULTHOST $KEY "$NODATASTRING" fi
Hopefully this is clear enough and helpful for others trying to use zabbix to log and alert on snmptraps.
Andrew
)
Comment