Question about SNMP traps

[SBO]

Hi folks,

I'm trying to create a template for a IBM SVC, which only sends SNMP traps (classic SAN hardware).

Here's the trap I received during my test :

20:09:58 2016/12/27 ZBXTRAP x.x.x.x
PDU INFO:
version 1
community xxxxxxx
errorstatus 0
notificationtype TRAP
errorindex 0
messageid 0
requestid 92544141
transactionid 4
receivedfrom UDP: [x.x.x.x]:54600->[x.x.x.x]:162
VARBINDS:
DISMAN-EVENT-MIB::sysUpTimeInstance type=67 value=Timeticks: (0) 0:00:00.00
SNMPv2-MIB::snmpTrapOID.0 type=6 value=OID: IBM-SVC-MIB::tsveITrap
IBM-SVC-MIB::tsveMACH type=4 value=STRING: "# Machine Type = 2145DH8"
IBM-SVC-MIB::tsveSERI type=4 value=STRING: "# Serial Number = xxxxxxx"
IBM-SVC-MIB::tsveERRI type=4 value=STRING: "# Error ID = 984515 : Node battery conditioning completed"
IBM-SVC-MIB::tsveERRC type=4 value=STRING: "# Error Code = "
IBM-SVC-MIB::tsveSWVE type=4 value=STRING: "# System Version = 7.6.1.4 (build 125.0.1605241053000)"
IBM-SVC-MIB::tsveFRUP type=4 value=STRING: "# FRU = None "
IBM-SVC-MIB::tsveCLUS type=4 value=STRING: "# System Name = xxxxxxxx"
IBM-SVC-MIB::tsveNODE type=4 value=STRING: "# Node ID = 0"
IBM-SVC-MIB::tsveERRS type=4 value=STRING: "# Error Sequence Number = 1565"
IBM-SVC-MIB::tsveTIME type=4 value=STRING: "# Timestamp = Tue Dec 27 20:14:45 2016"
IBM-SVC-MIB::tsveOBJT type=4 value=STRING: "# Object Type = node"
IBM-SVC-MIB::tsveOBJI type=4 value=STRING: "# Object ID = 1"
IBM-SVC-MIB::tsveOBJN type=4 value=STRING: "# Object Name = xxxxxxxx"
IBM-SVC-MIB::tsveCOPY type=4 value=STRING: "# Copy ID = "
IBM-SVC-MIB::tsveMPNO type=4 value=STRING: "# Machine Part Number = "
IBM-SVC-MIB::tsveADD1 type=4 value=STRING: "# Additional Data (0 -> 63) = 01000000000000000000000000000000000000000000000002 00000000000064013030415232363000000000000000000000 0000000000313153303041523035"
IBM-SVC-MIB::tsveADD2 type=4 value=STRING: "# Additional Data (64 -> 127) = 36594D31304247353950304131363A312D3000000000000000 00000000000000000000000000000000000000000000000000 0000000000000000000000000000"

I've created the following item in my template :

Name : SNMP TSVE Errors
Type : SNMP Trap
Key : snmptrap["IBM-SVC-MIB::tsveERRI"]
Type of information : Log

So I wanted to catch only this part of the message (and ideally, only the part in red) :

IBM-SVC-MIB::tsveERRI type=4 value=STRING: "# Error ID = 984515 : Node battery conditioning completed"

However, in the latest data section, I see all the data sent, not only the tsveERRI part. What should I do do get only this line ?

[SBO]

I didn't find a workaround yet for this, so I made a new key with all the error codes I need to be reported :

snmptrap["Error ID =\ (12345|11223|54321|13131|53135)"]

The storage team just need to know if there's something wrong, they'll get the details when they do their checks on their side, so the lack of details is not important here.

New challenge tho !

In each trap, I have an event ID.
In case the issue shown by the trap isn't resolved, the trap is sent again, every 24h, with of course the same event id as the original trap.

Example :
First trap received about a disk problem :

13:37:47 2017/01/09 ZBXTRAP x.x.x.x
PDU INFO:
  errorindex                     0
  notificationtype               TRAP
  errorstatus                    0
  community                      xxx
  version                        1
  receivedfrom                   UDP: [x.x.x.x]:43304->[y.y.y.y]:162
  transactionid                  98
  requestid                      608360514
  messageid                      0
VARBINDS:
  DISMAN-EVENT-MIB::sysUpTimeInstance type=67 value=Timeticks: (0) 0:00:00.00
  SNMPv2-MIB::snmpTrapOID.0      type=6  value=OID: IBM-SVC-MIB::tsveETrap
  IBM-SVC-MIB::tsveMACH          type=4  value=STRING: "# Machine Type = xxxxx*»
  IBM-SVC-MIB::tsveSERI          type=4  value=STRING: "# Serial Number = xxxxxx*»
  IBM-SVC-MIB::tsveERRI          type=4  value=STRING: "# Error ID = 10084 : Drive SAS error counts exceeded warning thresholds"
  IBM-SVC-MIB::tsveERRC          type=4  value=STRING: "# Error Code = 1285 : Drive SAS error counts exceeded warning thresholds"
  IBM-SVC-MIB::tsveSWVE          type=4  value=STRING: "# System Version = 6.4.1.2 (build 75.0.1211301000)"
  IBM-SVC-MIB::tsveFRUP          type=4  value=STRING: "# FRU = Hard Disk Drive: Vendor Id: IBM-207x Product Id: ST9300653SS      Part Number 85Y6185"
  IBM-SVC-MIB::tsveCLUS          type=4  value=STRING: "# System Name = V7Uxxxxx*»
  IBM-SVC-MIB::tsveNODE          type=4  value=STRING: "# Node ID = 6"
[B]  IBM-SVC-MIB::tsveERRS          type=4  value=STRING: "# Error Sequence Number = 1857"[/B]
  IBM-SVC-MIB::tsveTIME          type=4  value=STRING: "# Timestamp = Mon Jan  9 13:37:31 2017"
  IBM-SVC-MIB::tsveOBJT          type=4  value=STRING: "# Object Type = drive"
  IBM-SVC-MIB::tsveOBJI          type=4  value=STRING: "# Object ID = 32"
  IBM-SVC-MIB::tsveCOPY          type=4  value=STRING: "# Copy ID =  "
  IBM-SVC-MIB::tsveMPNO          type=4  value=STRING: "# Machine Part Number = "
  IBM-SVC-MIB::tsveADD1          type=4  value=STRING: "# Additional Data (0 -> 63) = 00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"
  IBM-SVC-MIB::tsveADD2          type=4  value=STRING: "# Additional Data (64 -> 127) = 00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"

Trap received the next day, because the issue is not fixed yet :

23:53:32 2017/01/10 ZBXTRAP x.x.x.x
PDU INFO:
  requestid                      91006974
  transactionid                  120
  messageid                      0
  receivedfrom                   UDP: [x.x.x.x]:33053->[y.y.y.y]:162
  version                        1
  errorstatus                    0
  notificationtype               TRAP
  errorindex                     0
  community                      xxx
VARBINDS:
  DISMAN-EVENT-MIB::sysUpTimeInstance type=67 value=Timeticks: (0) 0:00:00.00
  SNMPv2-MIB::snmpTrapOID.0      type=6  value=OID: IBM-SVC-MIB::tsveETrap
  IBM-SVC-MIB::tsveMACH          type=4  value=STRING: "# Machine Type = xxxxx*»
  IBM-SVC-MIB::tsveSERI          type=4  value=STRING: "# Serial Number = xxxxxx*»
  IBM-SVC-MIB::tsveERRI          type=4  value=STRING: "# Error ID = 10084 : Drive SAS error counts exceeded warning thresholds"
  IBM-SVC-MIB::tsveERRC          type=4  value=STRING: "# Error Code = 1285 : Drive SAS error counts exceeded warning thresholds"
  IBM-SVC-MIB::tsveSWVE          type=4  value=STRING: "# System Version = 6.4.1.2 (build 75.0.1211301000)"
  IBM-SVC-MIB::tsveFRUP          type=4  value=STRING: "# FRU = Hard Disk Drive: Vendor Id: IBM-207x Product Id: ST9300653SS      Part Number 85Y6185"
  IBM-SVC-MIB::tsveCLUS          type=4  value=STRING: "# System Name = V7Uxxxxxxx*»
  IBM-SVC-MIB::tsveNODE          type=4  value=STRING: "# Node ID = 6"
[B]  IBM-SVC-MIB::tsveERRS          type=4  value=STRING: "# Error Sequence Number = 1857"[/B]
  IBM-SVC-MIB::tsveTIME          type=4  value=STRING: "# Timestamp = Mon Jan  9 13:37:31 2017"
  IBM-SVC-MIB::tsveOBJT          type=4  value=STRING: "# Object Type = drive"
  IBM-SVC-MIB::tsveOBJI          type=4  value=STRING: "# Object ID = 32"
  IBM-SVC-MIB::tsveCOPY          type=4  value=STRING: "# Copy ID =  "
  IBM-SVC-MIB::tsveMPNO          type=4  value=STRING: "# Machine Part Number = "
  IBM-SVC-MIB::tsveADD1          type=4  value=STRING: "# Additional Data (0 -> 63) = 00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"
  IBM-SVC-MIB::tsveADD2          type=4  value=STRING: "# Additional Data (64 -> 127) = 00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"

As you can see, the Error Sequence Number is the same.
Is there any way to make a trigger that would take this in consideration and not send a new alarm if the value is the same as the precedent value ?