Cannot get SNMP trap working

[maerengi]

Hi,

I found a few related Topics but no (helpful) answer.

Goal:
Receive Zabbix alert in the case the VPN of my Firewall is down. So I need to differ general traps from particular traps. This can be done when item key value is set to snmptrap[<regex>] .

What is working:
In General Zabbix Traps are working. This means I can receive SNMP Traps in Trapper file. OID's are currently not translated but that should not matter.
In the configured item the key value is set to snmptrap.fallback. If VPN of the Firewall goes down I receive the expected alert in Zabbix.

What is not working:
As mentioned in Goal section the Trigger does not alert if item key value is set to snmptrap[<regex>]. Because I got it working whith snmptrap.fallback, I believe it has to do with
specified regex and/or snmptt.conf.

Question:
Why I am not able to be triggered via snmptrap[<regex>]? To which part of the trap does Zabbix apply the regex?

Please find an example below:


The trap I receive:

23:28:52 2018/07/09 .1.3.6.1.4.1.12356.101.2.0.301 event“ "„General" - ZBXTRAP ipaddress ipaddress severity:event“
.1.3.6.1.4.1.12356.100.1.1.1.0:serial .1.3.6.1.2.1.1.5.0:hostname .1.3.6.1.4.1.12356.101.12.3.2.0:91.217.214.116 .1.3.6.1.4.1.12356.101.12.3.3.0:91.217.214.81 .1.3.6.1.4.1.12356.101.12.3.4.0:vpn

I tried item keyvalue

1. snmptrap["1.3.6.1.4.1.12356.101.2.0.301"]
2. snmptrap["General"]
3. snmptrap["ipaddress"]

Trigger Expression with item key value #1:

{hostname:snmptrap["1.3.6.1.4.1.12356.101.2.0.301"].diff(0)}>0 and {hostname:snmptrap["1.3.6.1.4.1.12356.101.2.0.301"].nodata(600)}=0

snmptt.conf:

EVENT general .* „General event“ Normal
FORMAT ZBXTRAP $aA $ar severity:$s $Fn$+*

Many thanks in advance
maerengi