SNMP Traps

[k3lly]

Hi,

I am running zabbix 2.0.0 and I need help with snmp traps. I have searched around but have not been able to figure it out. My setup is I have a zabbix proxy on site and the zabbix server is remote. What do I need to do to get snmp traps working?

Thanks,

Kelly

[BDiE8VNy]

You need to prepare the Zabbix proxy to accept SNMP traps.
Follow the instructions in the documentation about SNMP traps

[zabbn00b]

i hear you on this one.

i've been trying to setup snmp taps as well.

there is a bit of documentation out there so very old.

i have't been successful yet.

i got as far as receiving snmp traps on the server log and zabbix server log but they were unmatched and i got stuck from there.

if anyone has done this i'd to would like some pointers.

the link you listed is the guide i followed but the bottom section is confusing they talk about maybe using a perl script but its unclear if you really need it.

[BDiE8VNy]

Example configuration for CentOS that should work:

--- BEGIN /etc/sysconfig/snmptrapd ---
OPTIONS="-Lsd -p /var/run/snmptrapd.pid -On"
--- END /etc/sysconfig/snmptrapd ---

--- BEGIN /etc/snmp/snmptrapd.conf ---
doNotLogTraps yes
disableauthorization yes
perl do "/usr/sbin/snmptthandler-embedded";
--- END /etc/snmp/snmptrapd.conf ---

--- BEGIN /etc/snmp/snmptt.conf.general ---
#
#
#
EVENT general .* "General event" Normal
FORMAT ZBXTRAP $ar $*
--- END /etc/snmpsnmptt.conf.general ---

--- SNIP /etc/snmp/snmptt.ini ---
mode = daemon
--- SNAP ---
date_format = %Y/%m/%d
--- SNIP ---
date_time_format = %H:%M:%S %Y/%m/%d
--- SNAP ---
syslog_enable = 0
--- SNIP ---
snmptt_conf_files = <<END
/etc/snmp/snmptt.conf
/etc/snmp/snmptt.conf.general
END
--- END /etc/snmp/snmptt.ini ---

--- SNIP  /etc/zabbix/zabbix_proxy.conf ---
SNMPTrapperFile=/var/log/snmptt/snmptt.log
--- SNAP ---
StartSNMPTrapper=1
--- SNIP /etc/zabbix/zabbix_proxy.conf

[BDiE8VNy]

i got as far as receiving snmp traps on the server log and zabbix server log but they were unmatched and i got stuck from there.

Do you already tried to catch them by 'snmptrap.fallback' item key?
Such an item schould get all unmatched traps.

[BDiE8VNy]

[...] they talk about maybe using a perl script but its unclear if you really need it.

I suggest to use snmptt (snmptthandler-embedded, perl script). It's not mandatory but one can do cool stuff with it.
A simple purpose of using snmptt could be replacing the trap by a selection of trap values.
Anotehr more sophisticated example could be preparing an IBM SAN Volume Controller trap to fit into a SMS text message.

--- SNIP /etc/snmp/snmptt.conf.ibm.svc2145 ---
EVENT tsveWTrap .1.3.6.1.4.1.2.6.190.2  "Error event" Minor
#FORMAT ZBXTRAP $ar $7 $8 $4 $3
EXEC echo '$X $x $s ZBXTRAP $ar $7 $8 $4 $3 (ibm2145TSVE)' >> /var/log/snmptt/snmptt.log
REGEX (# Cluster Name =)(Cluster/Node)
REGEX ( # Node ID = )(/)
REGEX ( # Error Code =)(, Error/ID)
REGEX ( # Error ID = )(/)
REGEX ( : )(, )
MATCH $4: ([0-9]{6})
--- SNAP /etc/snmp/snmptt.conf.ibm.svc2145 ---

This configuration would convert the trap:

09:48:11 2012/11/19 .1.3.6.1.4.1.2.6.190.2 Normal "General event" 192.0.43.10 - # Machine Type = 2145CG8 # Serial Number = VHZM6N9 # Error ID = 10003 : Number of Device paths has reduced # Error Code = 1630 : Number of device logins reduced # Software Version = 6.4.0.3 (build 65.2.1209010000) # FRU = None # Cluster Name = svc-cluster-13 # Node ID = 6 # Error Sequence Number = 30365 # Timestamp = Mon Nov 19 09:48:11 2012 # Object Type = device # Object ID = 0 # Copy ID = # Additional Data (0 -> 63) = CB0KJSJ48IMH8UWPEB0CNT21TOCJD13113J3CFD3EMBMSXFODX49FH2VEU1ZUFOQJIRUPIYZI2GTN5YGF3HDMVZZ968X80PY1R6EW9GLS9I1ONQ3FOPJNGSQYLSY0TR3 # Additional Data (64 -> 127) = ATBRTAZ1GUKNHAHL4KWQGUKMB2XXDOAESSIOX8L5TPMR58S2SF6AC2P22EJAS9FMIO7MVU4DN9JDV63R5IHF32HUSA93YA0WZHK2FQMAAJYF3W9GZYILFZE48RG64P14

to a much shorter log message:

09:48:11 2012/11/19 Minor Cluster/Node svc-cluster-13/6, Error/ID 10003/1630 , Number of Device paths has reduced (ibm2145TSVE)

[zabbn00b]

hey guys,

sorry its taken me a while to reply been caught up.

I've just started going over my config again. i've added the embedded handler as recommended.

still not working.

do i need to create an item to received traps on or tell zabbix_sender to do something? i think this is the part im missing.

[BDiE8VNy]

do i need to create an item to received traps on[...]?

Yes, an item is mandatory. (see: #5 and SNMP traps :: 3.1 Configuring SNMP traps)