Zabbix SNMPTrapper regexp item

[jrosetto]

I have Zabbix 3.4 setup with SNMPTT and snmptrapd using the perl script to pass trap events to zabbix. Everything is logging to snmptrap.failback as expected except the host that is sending the traps sends the previous 20 events. How can I parse this to only get the current event?

snmptrap.failback example
---------------------------------------
11:11:34 2018/08/20 ZBXTRAP 192.168.5.55
PDU INFO:
transactionid 6
requestid 6437
errorstatus 0
notificationtype TRAP
receivedfrom UDP: [192.168.5.55]:54628->[192.168.5.20]:162
messageid 0
version 1
errorindex 0
community private
VARBINDS:
.1.3.6.1.2.1.1.3.0 type=67 value=Timeticks: (139225507) 16 days, 2:44:15.07
.1.3.6.1.6.3.1.1.4.1.0 type=6 value=OID: .2.41.6
.2.41.5 type=4 value=STRING: "[Connect Lost] IP Cam Num=14 Time=2018-8-18 23:23:4
"
.2.41.6 type=4 value=STRING: "[Connect Resume] IP Cam Num=14 Time=2018-8-18 23:23:59
"
.2.41.5 type=4 value=STRING: "[Connect Lost] IP Cam Num=9 Time=2018-8-19 10:40:27
"
.2.41.6 type=4 value=STRING: "[Connect Resume] IP Cam Num=9 Time=2018-8-19 10:41:20
"
.2.41.5 type=4 value=STRING: "[Connect Lost] IP Cam Num=9 Time=2018-8-19 10:41:22
"
.2.41.6 type=4 value=STRING: "[Connect Resume] IP Cam Num=9 Time=2018-8-19 10:41:29
"
.2.41.5 type=4 value=STRING: "[Connect Lost] IP Cam Num=9 Time=2018-8-20 8:50:10
"
.2.41.6 type=4 value=STRING: "[Connect Resume] IP Cam Num=9 Time=2018-8-20 9:3:18
"
.2.41.5 type=4 value=STRING: "[Connect Lost] IP Cam Num=9 Time=2018-8-20 9:3:19
"
.2.41.6 type=4 value=STRING: "[Connect Resume] IP Cam Num=9 Time=2018-8-20 9:3:20
"
.2.41.5 type=4 value=STRING: "[Connect Lost] IP Cam Num=9 Time=2018-8-20 10:0:59
"
.2.41.6 type=4 value=STRING: "[Connect Resume] IP Cam Num=9 Time=2018-8-20 10:5:48
"
.2.41.5 type=4 value=STRING: "[Connect Lost] IP Cam Num=9 Time=2018-8-20 10:10:44
"
.2.41.6 type=4 value=STRING: "[Connect Resume] IP Cam Num=9 Time=2018-8-20 10:12:24
"
.2.41.5 type=4 value=STRING: "[Connect Lost] IP Cam Num=9 Time=2018-8-20 10:13:56
"
.2.41.6 type=4 value=STRING: "[Connect Resume] IP Cam Num=9 Time=2018-8-20 10:14:50
"
.2.41.5 type=4 value=STRING: "[Connect Lost] IP Cam Num=9 Time=2018-8-20 10:14:50
"
.2.41.6 type=4 value=STRING: "[Connect Resume] IP Cam Num=9 Time=2018-8-20 10:14:50
"
.2.41.5 type=4 value=STRING: "[Connect Lost] IP Cam Num=9 Time=2018-8-20 11:11:28
"
.2.41.6 type=4 value=STRING: "[Connect Resume] IP Cam Num=9 Time=2018-8-20 11:11:34
-------------------------------------

I have a trap item setup (snmptrap[.2.41.6]) which is "video restore" but since it is outputting the last 20 events I end up with zabbix dropping it into that item reguardless of if the event was current or not.

Help is greatly appreciated,

Thanks.

[m_d_c13]

Hi Jrosetto,
If you create item with key snmptrap["IP Cam Num=9"] it will collect all traps for cam 9. After that create trigger with expression like Hostname:snmptrap["IP Cam Num=9"].str("Connect Lost")=1 . This trigger will raise alarm when you loss connection with cam 9. Switch OK event generation to: Recovery expression and you can use: Hostname:snmptrap["IP Cam Num=9"].str("Connect Resume")=1 - this will close the problem.

Hope this will help you

[jrosetto]

Hi Jrosetto,
If you create item with key snmptrap["IP Cam Num=9"] it will collect all traps for cam 9. After that create trigger with expression like Hostname:snmptrap["IP Cam Num=9"].str("Connect Lost")=1 . This trigger will raise alarm when you loss connection with cam 9. Switch OK event generation to: Recovery expression and you can use: Hostname:snmptrap["IP Cam Num=9"].str("Connect Resume")=1 - this will close the problem.

Hope this will help you

Wow I was going about this all wrong. Thank you for the easy walk through.
Seems to work great for triggering the event, but for the life of me I can't get it to resolve. Any suggestions?

[jrosetto]

Hi Jrosetto,
If you create item with key snmptrap["IP Cam Num=9"] it will collect all traps for cam 9. After that create trigger with expression like Hostname:snmptrap["IP Cam Num=9"].str("Connect Lost")=1 . This trigger will raise alarm when you loss connection with cam 9. Switch OK event generation to: Recovery expression and you can use: Hostname:snmptrap["IP Cam Num=9"].str("Connect Resume")=1 - this will close the problem.

Hope this will help you

Here is the last SNMP Trap log if that is helpful too.
---------------
11:36:53 2018/08/21 ZBXTRAP 192.168.5.55
PDU INFO:
version 1
messageid 0
errorindex 0
notificationtype TRAP
community private
transactionid 16
errorstatus 0
requestid 20913
receivedfrom UDP: [192.168.5.55]:58093->[192.168.5.20]:162
VARBINDS:
.1.3.6.1.2.1.1.3.0 type=67 value=Timeticks: (139225507) 16 days, 2:44:15.07
.1.3.6.1.6.3.1.1.4.1.0 type=6 value=OID: .2.41.6
.2.41.5 type=4 value=STRING: "[Connect Lost] IP Cam Num=14 Time=2018-8-18 23:23:4
"
.2.41.6 type=4 value=STRING: "[Connect Resume] IP Cam Num=14 Time=2018-8-18 23:23:59
"
.2.41.5 type=4 value=STRING: "[Connect Lost] IP Cam Num=9 Time=2018-8-19 10:40:27
"
.2.41.6 type=4 value=STRING: "[Connect Resume] IP Cam Num=9 Time=2018-8-19 10:41:20
"
.2.41.5 type=4 value=STRING: "[Connect Lost] IP Cam Num=9 Time=2018-8-19 10:41:22
"
.2.41.6 type=4 value=STRING: "[Connect Resume] IP Cam Num=9 Time=2018-8-19 10:41:29
"
.2.41.5 type=4 value=STRING: "[Connect Lost] IP Cam Num=9 Time=2018-8-20 8:50:10
"
.2.41.6 type=4 value=STRING: "[Connect Resume] IP Cam Num=9 Time=2018-8-20 9:3:18
"
.2.41.5 type=4 value=STRING: "[Connect Lost] IP Cam Num=9 Time=2018-8-20 9:3:19
"
.2.41.6 type=4 value=STRING: "[Connect Resume] IP Cam Num=9 Time=2018-8-20 9:3:20
"
.2.41.5 type=4 value=STRING: "[Connect Lost] IP Cam Num=9 Time=2018-8-20 10:0:59
"
.2.41.6 type=4 value=STRING: "[Connect Resume] IP Cam Num=9 Time=2018-8-20 10:5:48
"
.2.41.5 type=4 value=STRING: "[Connect Lost] IP Cam Num=9 Time=2018-8-20 10:10:44
"
.2.41.6 type=4 value=STRING: "[Connect Resume] IP Cam Num=9 Time=2018-8-20 10:12:24
"
.2.41.5 type=4 value=STRING: "[Connect Lost] IP Cam Num=9 Time=2018-8-20 10:13:56
"
.2.41.6 type=4 value=STRING: "[Connect Resume] IP Cam Num=9 Time=2018-8-20 10:14:50
"
.2.41.5 type=4 value=STRING: "[Connect Lost] IP Cam Num=9 Time=2018-8-20 10:14:50
"
.2.41.6 type=4 value=STRING: "[Connect Resume] IP Cam Num=9 Time=2018-8-20 10:14:50
"
.2.41.5 type=4 value=STRING: "[Connect Lost] IP Cam Num=9 Time=2018-8-20 11:11:28
"
.2.41.6 type=4 value=STRING: "[Connect Resume] IP Cam Num=9 Time=2018-8-20 11:11:34
"
.2.41.5 type=4 value=STRING: "[Connect Lost] IP Cam Num=9 Time=2018-8-21 11:1:1
"
.2.41.6 type=4 value=STRING: "[Connect Resume] IP Cam Num=9 Time=2018-8-21 11:1:8
"
.2.41.5 type=4 value=STRING: "[Connect Lost] IP Cam Num=9 Time=2018-8-21 11:1:8
"
.2.41.6 type=4 value=STRING: "[Connect Resume] IP Cam Num=9 Time=2018-8-21 11:1:9
"
.2.41.5 type=4 value=STRING: "[Connect Lost] IP Cam Num=9 Time=2018-8-21 11:8:28
"
.2.41.6 type=4 value=STRING: "[Connect Resume] IP Cam Num=9 Time=2018-8-21 11:8:33
"
.2.41.5 type=4 value=STRING: "[Connect Lost] IP Cam Num=9 Time=2018-8-21 11:8:39
"
.2.41.6 type=4 value=STRING: "[Connect Resume] IP Cam Num=9 Time=2018-8-21 11:8:44
"
.2.41.5 type=4 value=STRING: "[Connect Lost] IP Cam Num=9 Time=2018-8-21 11:16:34
"
.2.41.6 type=4 value=STRING: "[Connect Resume] IP Cam Num=9 Time=2018-8-21 11:16:39
"
.2.41.5 type=4 value=STRING: "[Connect Lost] IP Cam Num=9 Time=2018-8-21 11:16:39
"
.2.41.6 type=4 value=STRING: "[Connect Resume] IP Cam Num=9 Time=2018-8-21 11:16:49
"
.2.41.5 type=4 value=STRING: "[Connect Lost] IP Cam Num=9 Time=2018-8-21 11:16:49
"
.2.41.6 type=4 value=STRING: "[Connect Resume] IP Cam Num=9 Time=2018-8-21 11:16:51
"
.2.41.5 type=4 value=STRING: "[Connect Lost] IP Cam Num=9 Time=2018-8-21 11:36:46
"
.2.41.6 type=4 value=STRING: "[Connect Resume] IP Cam Num=9 Time=2018-8-21 11:36:55
"

---------------

[m_d_c13]

Hi,
I was wrong - this recovery expression will not clear the problem. And what will happen if you switch OK event generation to Expression and try the trigger how it work. The meaning of this trigger will be that when arrives trap "Connect Lost" it will raise the alarm and any other trap will clear it. This will work if you receive in this item only connection traps. The other solution is to put in the problem expression field this: {Template Geovision NVR:snmptrap["IP Cam Num=9"].str("Connect Lost")}=1 and {Template Geovision NVR:snmptrap["IP Cam Num=9"].str("Connect Resume")}=0 .
Sorry for my English (in fact this is Bulgarian English )

[jrosetto]

Hi,
I was wrong - this recovery expression will not clear the problem. And what will happen if you switch OK event generation to Expression and try the trigger how it work. The meaning of this trigger will be that when arrives trap "Connect Lost" it will raise the alarm and any other trap will clear it. This will work if you receive in this item only connection traps. The other solution is to put in the problem expression field this: {Template Geovision NVR:snmptrap["IP Cam Num=9"].str("Connect Lost")}=1 and {Template Geovision NVR:snmptrap["IP Cam Num=9"].str("Connect Resume")}=0 .
Sorry for my English (in fact this is Bulgarian English )

I'd say you are doing quite well with your English .

I have tried both options you suggested to no avail. I set the trigger back to Expression but the trigger doesn't clear when I get "Connect Resume". The second solution doesn't trigger at all whether "Connect Lost" or "Connect Resume" is at the end of the SNMP trap log.

Any other suggestions?

If nothing else at least I am able to trigger an event and will have to manually clear it once the problem is resolved.