snmp traps - Item key regex is failing to match

[XynchroSTL]

I'm using the following command to generate an snmp trap: snmptrap -v 1 -c public 127.0.0.1 '.1.3.6.1.6.3.1.1.5.4' '0.0.0.0' 6 33 '55' .1.3.6.1.6.3.1.1.5.4 s "eth0"

I have an SNMP Trap Item created with the key: "snmptrap[]". Its type is 'Text' and it's a template Item. The template is associated with a host and when I generate the trap, the result shows up in the Host's data. So far, so good.

Next, I create a dependent Item within the same Template, using the key : "snmptrap[IF-MIB::linkUp]". It's type is also 'Text' and it has the above Item set as its Master. There are no pre-processing rules involved. This dependent Item never generates any data. What might I be doing wrong?

For reference, here is what the full trap looks like:

20230524.160752 ZBXTRAP 172.16.238.1
DISMAN-EVENT-MIB::sysUpTimeInstance = 55
SNMPv2-MIB::snmpTrapOID.0 = IF-MIB::linkUp.0.33
IF-MIB::linkUp = "eth0"
SNMP-COMMUNITY-MIB::snmpTrapCommunity.0 = "public"
SNMPv2-MIB::snmpTrapEnterprise.0 = IF-MIB::linkUp

[ISiroshtan]

Hey there,

I'm not exactly see right away why dependent item fails in described scenario. But at the same time I fail to understand why would you go for dependent item in the first place.

I would use available functionality of SNMP Trapper items. You an try do the following:
Remove the 'snmptrap[]' item and create the fallback snmp trapp item with key like 'snmptrap.fallback'. This one will be collecting all the traps for this hosts that were not handled by other items.
Then create 2nd snmp trapper item with key "snmptrap[IF-MIB::linkUp]".

Now traps containing 'IF-MIB::linkUp' should end up in 2nd item while all the rest of the traps would fall in fallback item.

[XynchroSTL]

Thanks for the suggestion. The configuration that you suggested is actually how I'd first set it up. While researching the issue, someone suggested that creating a master Item to catch all traps and then handling specific ones as dependent is a good way to preserve the original full trap if it's ever needed for reference. That seemed logical so I went with it. For what it's worth, I just tried putting things back the way that you suggested with no change in results.

[XynchroSTL]

I found that it was interpreting the whole trap is a single line. If I add .* before and after the expression, it catches it. I'm able to then clean it up in preprocessing.