SNMP Trap notifications

[jcrowe-idgroup]

I'm currently using Zabbix version 3.4.15 on CentOS 7. I inherited this server, and will be migrating to an LTS Ubuntu in the near future.
For now, I need to receive email notifications for SNMP Traps received in Zabbix for a particular host. The host is an iDRAC 9 interface. SNMP traps are currently being received as viewable from Monitoring > Latest Data.

My next issue is the configuration of the Trap under the Item I created for this. My expression in the trap is: {Saladfingers - idrac:snmptrap.fallback.last()}=1

The expression seems to be sufficient enough for the expression constructor test, but the trap itself has an error. The error message is listed below:

What would be the cause of this or what could be missing in my expression? I removed the IP, host, and domain names from a couple of fields in the message.

Cannot evaluate expression: expected closing parenthesis at ":20:05 2023/08/04 PDU INFO:
notificationtype TRAP
version 1
receivedfrom UDP: [x.x.x.x]:46142->[x.x.x.x]:162
errorstatus 0
messageid 0
community public
transactionid 28
errorindex 0
requestid 2110047442
VARBINDS:
DISMAN-EVENT-MIB::sysUpTimeInstance type=67 value=Timeticks: (60992763) 7 days, 1:25:27.63
SNMPv2-MIB::snmpTrapOID.0 type=6 value=OID: SNMPv2-SMI::enterprises.674.10892.5.3.2.5.0.10395
SNMPv2-SMI::enterprises.674.10892.5.3.1.1.0 type=4 value=STRING: "TST001"
SNMPv2-SMI::enterprises.674.10892.5.3.1.2.0 type=4 value=STRING: "The iDRAC generated a test trap event in response to a user request."
SNMPv2-SMI::enterprises.674.10892.5.3.1.3.0 type=2 value=INTEGER: 3
SNMPv2-SMI::enterprises.674.10892.5.3.1.4.0 type=4 value=STRING: "4RYG5S3"
SNMPv2-SMI::enterprises.674.10892.5.3.1.5.0 type=4 value=STRING: "[host.domainname]"
SNMPv2-SMI::enterprises.674.10892.5.3.1.6.0 type=4 value=""
SNMPv2-SMI::enterprises.674.10892.5.3.1.7.0 type=4 value=STRING: "N/A"
SNMPv2-SMI::enterprises.674.10892.5.3.1.8.0 type=4 value=""
SNMPv2-SMI::enterprises.674.10892.5.3.1.9.0 type=4 value=STRING: "4RYG5S3"
SNMPv2-SMI::enterprises.674.10892.5.3.1.10.0 type=4 value=STRING: "Main System Chassis"
SNMPv2-SMI::enterprises.674.10892.5.3.1.11.0 type=4 value=STRING: "[host.domainname]")=1". zz0.is5h4aeuxhazz

[tim.mooney]

the trap itself has an error. The error message is listed below:

Cannot evaluate expression: expected closing parenthesis at

snmptrapd accepts the trap, calls a script or tool to write it to an intermediary file, and Zabbix reads that file and ingests it as a trap. What script or tool are you using to write the trap to the file that Zabbix reads?

It looks like there's a portion of the trap that is not being displayed, because it's part of the error:

SNMPv2-SMI::enterprises.674.10892.5.3.1.1.0 type=4 value=STRING: "TST001"
SNMPv2-SMI::enterprises.674.10892.5.3.1.2.0 type=4 value=STRING: "The iDRAC generated a test trap event in response to a user request."
SNMPv2-SMI::enterprises.674.10892.5.3.1.3.0 type=2 value=INTEGER: 3
SNMPv2-SMI::enterprises.674.10892.5.3.1.4.0 type=4 value=STRING: "4RYG5S3"
SNMPv2-SMI::enterprises.674.10892.5.3.1.5.0 type=4 value=STRING: "[host.domainname]"
SNMPv2-SMI::enterprises.674.10892.5.3.1.6.0 type=4 value=""
SNMPv2-SMI::enterprises.674.10892.5.3.1.7.0 type=4 value=STRING: "N/A"
SNMPv2-SMI::enterprises.674.10892.5.3.1.8.0 type=4 value=""
SNMPv2-SMI::enterprises.674.10892.5.3.1.9.0 type=4 value=STRING: "4RYG5S3"
SNMPv2-SMI::enterprises.674.10892.5.3.1.10.0 type=4 value=STRING: "Main System Chassis"
SNMPv2-SMI::enterprises.674.10892.5.3.1.11.0 type=4 value=STRING: "[host.domainname]"

Right after that 2nd instance of "[host.domainname]", I think there's something additional that's being written to the trap file, that's not showing up here. Can you investigate the intermediate file and see if there is more that's not being displayed?

)=1". zz0.is5h4aeuxhazz

If my guess is correct, that ")=1" and the remaining bit is the part after the chunk with the expression error.