Using message from SNMP Trap for Trigger name

[Shahoff]

I do not want to bother much anyone. But I hope somebody can just give me a link to the topic/howto where this is already sorted.

What I have:
Zabbix 4.4
SNMP Traps are configured.
Sample Trap is:

===========================================
16:06:43 2020/01/22 ZBXTRAP x.x.x.x
PDU INFO:
notificationtype TRAP
version 1
receivedfrom UDP: [x.x.x.x]:38068->[y.y.y.y]:162
errorstatus 0
messageid 0
community speed
transactionid 13
errorindex 0
requestid 1226521381
VARBINDS:
DISMAN-EVENT-MIB::sysUpTimeInstance type=67 value=Timeticks: (434401) 1:12:24.01
SNMPv2-MIB::snmpTrapOID.0 type=6 value=OID: SNMPv2-SMI::enterprises.1139.103.1.18.2.6
SNMPv2-SMI::enterprises.1139.103.1.18.1.1 type=4 value=STRING: "spb"
SNMPv2-SMI::enterprises.1139.103.1.18.1.2 type=4 value=STRING: "AlertServicesSnmpTest"
SNMPv2-SMI::enterprises.1139.103.1.18.1.3 type=4 value=STRING: "14:100001"
SNMPv2-SMI::enterprises.1139.103.1.18.1.4 type=4 value=STRING: "This is a test message to be sent in an SNMP trap."
===========================================

I want the message from the last string to be shown as "Problem" on dashboard. Currently my trigger expression is {TestHostname:snmptrap.fallback.strlen()}>1 just to raise the problem to the dashboard.


Thank you in advance
/Andrew

[gert.derouck]

Hi,
you could use the regsub item function:
e.g. Trigger Name:
Trap received: {{ITEM.VALUE}.regsub("1139\.103\.1\.18\.1\.4\stype =4\svalue=STRING:\s"(.*)"", "\1")}

[Shahoff]

Thank you for respond.
I modified regular expression to match the pattern and now I have my string in Group1 , but trigger name still returning entire trap. What exactly regsub doing here what is replacing ?

[gert.derouck]

I don't understand exactly what you mean.
Use following as the name of your trigger:
Trap received: {{ITEM.VALUE}.regsub("1139\.103\.1\.18\.1\.4\stype =4\svalue=STRING:\s"(.*)"", "\1")}

[Shahoff]

Sorry for confusing , this is what the trigger name on dashboard looks like :
Trap received:{11:20:32 2020/01/23 PDU INFO: notificationtype TRAP version 1 receivedfrom UDP: [x.x.x.x]:53103->[y.y.y.y]:162 errorstatus 0 messageid 0 community speed transactionid 20 errorindex 0 requestid 1481759497 VARBINDS: DISMAN-EVENT-MIB::sysUpTimeInstance type=67 value=Timeticks: (363814) 1:00:38.14 SNMPv2-MIB::snmpTrapOID.0 type=6 value=OID: SNMPv2-SMI::enterprises.1139.103.1.18.2.6 SNMPv2-SMI::enterprises.1139.103.1.18.1.1 type=4 value=STRING: "spb" SNMPv2-SMI::enterprises.1139.103.1.18.1.2 type=4 value=STRING: "AlertServicesSnmpTest" SNMPv2-SMI::enterprises.1139.103.1.18.1.3 type=4 value=STRING: "14:100001" SNMPv2-SMI::enterprises.1139.103.1.18.1.4 type=4 value=STRING: "This is a test message to be sent in an SNMP trap." perl callback function 0x55e39067c278 returns 1.regsub(1139\.103\.1\.18\.1\.4\stype=4\s*value=ST RING:\s"(.*)", "\1")}

[gert.derouck]

Can you post a screenshot of your trigger config.

[Shahoff]

Here it is:

[Shahoff]

Here is an alert

[gert.derouck]

Ah. this forum tool is skipping some chars... There are some slashes lost:

Trap received: {{ITEM.VALUE}.regsub("1139\.103\.1\.18\.1\.4\stype=4\svalue=STRING:\s\"(.*)\"", "\1")}

[gert.derouck]

[Shahoff]

I used this site as well to fix regex , but trigger name is not working anyway

[gert.derouck]

Bizar. I have several similar triggers configured in my setup..
Can you post your Trigger Name here as 'Code', since it's not completely visible in the screenshot.
Maybe insert a space after the colon (

Trap received:

), although i don't think it matters.

[Shahoff]

Reading here: https://www.zabbix.com/documentation...n/known_issues
And looks like double quote on my PHP is not working properly.

[root@db2-zibbexcore01 conf.d]# php -v
PHP 5.4.16 (cli) (built: Nov 1 2019 16:04:20)
Copyright (c) 1997-2013 The PHP Group
Zend Engine v2.4.0, Copyright (c) 1998-2013 Zend Technologies

Looks like I have to upgrade to v 7.x

Will keep you posted

[gert.derouck]

I have same version... and no issue...
# php -v
PHP 5.4.16 (cli) (built: Oct 29 2019 10:01:20)
Copyright (c) 1997-2013 The PHP Group
Zend Engine v2.4.0, Copyright (c) 1998-2013 Zend Technologies

[Shahoff]

PHP 7.4 installed , but still the same issue

created python and perl scripts on 101regex and output of the file is good

root@db2-zibbexcore01 Downloads]# python test.py
Match 1 was found at 1422-1514: 1139.103.1.18.1.4 type=4 value=STRING: "This is a test message to be sent in an SNMP trap."
Group 1 found at 1463-1513: This is a test message to be sent in an SNMP trap.

So regex is working , something wrong with macro

[gert.derouck]

did you escape the double quotes in your regex?

[Shahoff]

Standard escaping did not work, however \x22 worked !!!


So here is syntax: {{ITEM.VALUE}.regsub("\.4\stype=4\s*value=STRING:\ s\x22(.*)\x22", "Trap Received: \1")}