SNMP trap to trigger - HPE stack

[hemh]

Hi guys!

I need some help to build a trigger from a SNMP trap.
My goal is to detect an IRF topology change on a HPE switches stack.
I made an item snmptrap[<regex>] with expression hh3cStackPortLinkStatusChange that work fine, and I receive this kind of trap:

20:41:54 2021/10/25 ZBXTRAP 10.X.X.1
PDU INFO:
notificationtype TRAP
version 1
receivedfrom UDP: [10.X.X.1]:8514->[172.X.X.253]:162
errorstatus 0
messageid 0
community mycommunity
transactionid 15185
errorindex 0
requestid 449115569
VARBINDS:
DISMAN-EVENT-MIB::sysUpTimeInstance type=67 value=Timeticks: (68454740) 7 days, 22:09:07.40
SNMPv2-MIB::snmpTrapOID.0 type=6 value=OID: HH3C-STACK-MIB::hh3cStackPortLinkStatusChange
HH3C-STACK-MIB::hh3cStackMemberID.2 type=2 value=INTEGER: 1
HH3C-STACK-MIB::hh3cStackPortIndex.1.2 type=2 value=INTEGER: 2
HH3C-STACK-MIB::hh3cStackPortStatus.1.2 type=2 value=INTEGER: 1




I want to be abble to trigger when:
HH3C-STACK-MIB::hh3cStackPortStatus.1.2 type=2 value=INTEGER: =1

And I would like to close the trigger when:
HH3C-STACK-MIB::hh3cStackPortStatus.1.2 type=2 value=INTEGER:=2

But the value .1.2 (HH3C-STACK-MIB::hh3cStackPortStatus.1.2) do no have to be taken into consideration in the trigger, depending on the stack, the value can be diferent

You help would be very appreciated, thanks in advance.

Henri

[hemh]

I tried to make a SNMP item like this: snmptrap[(hh3cStackPortStatus.(1-9).(1-9) type=2 value=INTEGER: 2)]
but it doesn't work

[hemh]

Ok, I gonna reply to myself, guess it could help HPE switches admin.
So to make it work, I followed the SNMP trap procedure here: https://blog.zabbix.com/snmp-traps-in-zabbix/8210/ and here: https://majornetwork.net/2021/05/con...bix-on-debian/

SNMP trap items took me a few days to set up, so here is the solution I made up:
I created 2 items:

SNMP traps (IRF Link DOWN) with key: snmptrap["hh3cStackPortStatus(.*)type=2(.*)value=INTEGE R.*)2"]
SNMP traps (IRF Link UP) with key: snmptrap["hh3cStackPortStatus(.*)type=2(.*)value=INTEGE R.*)1"]

Then I created 2 triggers:

{HOST.NAME} IRF Link Down with this expression: {Template Module Generic SNMPv2:snmptrap["hh3cStackPortStatus(.*)type=2(.*)value=INTEGE R.*)2"].strlen()}>1 and {Template Module Generic SNMPv2:snmptrap["hh3cStackPortStatus(.*)type=2(.*)value=INTEGE R.*)2"].nodata(20)}=0
{HOST.NAME} IRF Link is back UP with this expression: {Template Module Generic SNMPv2:snmptrap["hh3cStackPortStatus(.*)type=2(.*)value=INTEGE R.*)1"].strlen()}>1 and {Template Module Generic SNMPv2:snmptrap["hh3cStackPortStatus(.*)type=2(.*)value=INTEGE R.*)1"].nodata(20)}=0

So the trigger close by themselves after 20s

Then I created 2 actions:

IRF Link DOWN with condition: Trigger name contains IRF Link Down and then send mail to network admins
IRF Link is back UP with condition: Trigger name contains IRF Link is back UP and then send mail to network admins

An it work fine

[hemh]

Ok, I gonna reply to myself, guess it could help HPE switches admin.
So to make it work, I followed the SNMP trap procedure here: https://blog.zabbix.com/snmp-traps-in-zabbix/8210/ and here: https://majornetwork.net/2021/05/con...bix-on-debian/

SNMP trap items took me a few days to set up, so here is the solution I made up:
I created 2 items:

SNMP traps (IRF Link DOWN) with key: snmptrap["hh3cStackPortStatus(.*)type=2(.*)value=INTEGER:(.*)2"]
SNMP traps (IRF Link UP) with key: snmptrap["hh3cStackPortStatus(.*)type=2(.*)value=INTEGER:(.*)1"] 

Then I created 2 triggers:

{HOST.NAME} IRF Link Down with this expression: {Template Module Generic SNMPv2:snmptrap["hh3cStackPortStatus(.*)type=2(.*)value=INTEGER:(.*)2"].strlen()}>1 and {Template Module Generic SNMPv2:snmptrap["hh3cStackPortStatus(.*)type=2(.*)value=INTEGER:(.*)2"].nodata(20)}=0
{HOST.NAME} IRF Link is back UP with this expression: {Template Module Generic SNMPv2:snmptrap["hh3cStackPortStatus(.*)type=2(.*)value=INTEGER:(.*)1"].strlen()}>1 and {Template Module Generic SNMPv2:snmptrap["hh3cStackPortStatus(.*)type=2(.*)value=INTEGER:(.*)1"].nodata(20)}=0 

So the trigger close by themselves after 20s

Then I created 2 actions:

IRF Link DOWN with condition: Trigger name contains IRF Link Down and then send mail to network admins
IRF Link is back UP with condition: Trigger name contains IRF Link is back UP and then send mail to network admins

An it work fine

Modified the post to get it mor readable.

[dararg]

Hello hemh! I have the same scenario at my work and your solution is very useful to me. Could you tell me how you configured the HPE switch to send the trap to the zabbix server?