LLD rule with SNMPTRAP / Logfile

[Syl20]

Hello,

I'm encountering issues about creation of low-level-discovery rule with SnmpTrap/logfiles. I don't know if I have the good method.
I work in Zabbix 3.0

First of all I followed the tuto https://www.zabbix.org/wiki/Start_wi...raps_in_Zabbix in order to implement snmp trap reception.
A server send different traps to my Zabbix server in zabbix_traps.tmp file as followed :

DISMAN-EVENT-MIB::sysUpTimeInstance type=67 value=Timeticks: (59672942) 6 days, 21:45:29.42
  SNMPv2-MIB::snmpTrapOID.0      type=6  value=OID: SNMPv2-SMI::enterprises.3279.1.1.8.2.0.32
  SNMPv2-SMI::enterprises.3279.1.1.8.1.9999999.1 type=4  value=STRING: "TRANSMETRIC_ALM_10011"
  SNMPv2-SMI::enterprises.3279.1.1.8.1.9999999.2 type=2  value=INTEGER: 1
  SNMPv2-SMI::enterprises.3279.1.1.8.1.9999999.3 type=4  value=STRING: "ROBOT-DISPO-APP-N06-MYAPPLICATION-SEUIL-<=100%-VALEUR-100%"
  SNMPv2-SMI::enterprises.3279.1.1.8.1.32.1 type=4  value=STRING: "N06-MYAPPLICATION"
  SNMPv2-SMI::enterprises.3279.1.1.8.1.32.2 type=4  value=STRING: "*"
  SNMPv2-SMI::enterprises.3279.1.1.8.1.32.3 type=4  value=STRING: "Transactions (Active Monitoring)"
  SNMPv2-SMI::enterprises.3279.1.1.8.1.32.4 type=4  value=STRING: "*"
  SNMPv2-SMI::enterprises.3279.1.1.8.1.32.5 type=4  value=STRING: "*"
  SNMPv2-SMI::enterprises.3279.1.1.8.1.32.6 type=4  value=STRING: "*"
  SNMPv2-SMI::enterprises.3279.1.1.8.1.32.7 type=2  value=INTEGER: 1000
  SNMPv2-SMI::enterprises.3279.1.1.8.1.32.8 type=4  value=STRING: "<=100"

Now I want to treat this trap, so I created an item to check the parameters I want to know :

log[/var/log/zabbix/zabbix_traps.tmp,"ROBOT-DISPO-APP-N06_MYAPPLICATION-SEUIL-<=100%-VALEUR-(.*)%",ASCII,,skip,\1]

Then I retrieves the name of the application (MYAPPLICATION is variable) and the number I want (include in (.*) )

I have a lot of application so I want to make a dynamic discovery but
I do not know how to operate it.

I created a discovery rule like this :
name : DISPO-APPLICATION
type : Zabbix agent Active
key : log.myapplication (not sure if the key is important)

Then I created Filters:

Label MACRO REGULAR EXPRESSION
A=>{#APPLICATION} MYAPPLICATION1
B=>{#APPLICATION} MYAPPLICATION2
C=>{#APPLICATION} MYAPPLICATION3
D=>{#APPLICATION} MYAPPLICATION4
etc....

Then I created an Item prototype like this :

log[/var/log/zabbix/zabbix_traps.tmp,"ROBOT-DISPO-APP-{#APPLICATION}",ASCII,,skip,\2]

The goal is to create one item for each application.
Currently it doesn't works and I don't know if this method (without scripting) might work.


Every recommendation is welcome. thanks in advance

[abevern]

Welcome to LLD

It's really very powerful, but can be frustrating as hell too.

The LLD examples using snmptrap where piggybacking off the regular snmp discovery builtin. You're not going to be able to use that unless you can find the application names via an snmpwalk. (may be possible)

Alternative is to parse your snmp trap file with something (I'd use perl) to extract your applications and return them in a JSON format. You then build your LLD elements on the back of that.

You'll need to read this bit:

https://www.zabbix.com/documentation/3.0/manual/discovery/low_level_discovery#creating_custom_lld_rules

[Syl20]

I finally made a script

Thanks for your reply abevern, but I finally found a solution I wrote a shell script. It gave me the value of the line I want to analyse.
But it's more complicated and it's not created natively in Zabbix. I hope there will be a system on zabbix in order to make an easy check on SNMPTRAP.