Help with snmptrap, extracting value from the trap

[mattmunro]

I'm working on making alerts for AP Disassocated traps for a Cisco WLC. I've managed to get the trap in using the key of

snmptrap["(AIRESPACE-WIRELESS-MIB::bsnAPDisassociated)"]

This results in the following data

20190227.143224 AIRESPACE-WIRELESS-MIB::bsnAPDisassociated 0 (null) AIRESPACE-WIRELESS-MIB::bsnAPMacAddrTrapVariable.0 f4:db:e6:41:c3:e0 AIRESPACE-WIRELESS-MIB::bsnAPName.0 APF4DB.E639.B958

What I'd like is to just be returning the AP name, in this case APF4DB.E639.B958, seems no matter what I do the full line is the value every time
Is there a method of just extracting part of this
Thanks

[mikes2277]

This took me a while to figure out, so happy to save you the pain I went through

My traps come in to SNMPTT as:
10:46:20 2019/02/27 SNMPv2-MIB::warmStart Normal "Status Events" 10.255.16.12 - ZBXTRAP 10.255.16.12 Device reinitialized (warmStart)

Which Zabbix converts to:
10:46:20 2019/02/27 SNMPv2-MIB::warmStart Normal "Status Events" 10.255.16.12 - Device reinitialized (warmStart)

Using the setup below I end up with:
Device reinitialized (warmStart)


Create an item:

• Type: SNMP Trap
• Key: snmptrap["SNMPv2-MIB::warmStart"] (or whatever regex you want)
• Type of Information: Text or Log (Text should be good enough as long as your trap text is under 65k chars)

Preprocessing:

• Name: Regular Expression
• Pattern: ^.* - (.*)$ (this will look for the dash with a space before and after it, and then return everything after)
• Output: \1 (this tells Zabbix to use the matched output group 1)

Whatever you put in () will be what Zabbix's output can use. You can test your match at https://regex101.com/

See the regex section of the preprocessing at https://www.zabbix.com/documentation...fig/items/item for more info

Hope that helps!
Mike

[mattmunro]

Thanks Mike, that actually gave me motivation to finally upgrade as 3.0 didn't have the preprocessing option, got it working now