Room Alert 12S SNMPtrap[regex] I cannot figure this out, zero experience on this...

[EdgarLoya]

Hey Zabbix forums,

I've been at this for a few hours, and I can't figure out why the snmptrap item I created isn't capturing any information from our Room Alert 12s & 3s sensors is not being logged. The snmptrap.fallback is logging the following history from the sensors:

20:18:16 2024/08/22 PDU INFO:
errorstatus 0
transactionid 20
version 1
notificationtype TRAP
receivedfrom UDP: [192.168.0.123]:57381->[192.168.1.200]:162
messageid 0
requestid 1
community ultra_violet
errorindex 0
VARBINDS:
iso.3.6.1.2.1.1.3.0 type=67 value=Timeticks: (2341303) 6:30:13.03
iso.3.6.1.6.3.1.1.4.1.0 type=6 value=OID: iso.3.6.1.4.1.20916.1.12.2.1
iso.3.6.1.4.1.20916.1.12.2.1.0 type=4 value=STRING: "ALARM: Switch Open Alarm on Sensor 'Switch Sensor 2'"

I setup the item in the room alert 12s host as snmptrap it doesn't log any history. See screenshot. I've tried so many different variations for the regex, none of it works. Our old Room Alert 3E devices have a similar snmptrap setup that works. I've confirmed the sensor names are correct in the Room Alert web interface. I tried to look for any templates and I've not found any. The only difference I've noticed is the Room Alert 3E is using a template.

Room Alert 12s: snmptrap[ALARM.*Switch Sensor 2 \(*'Switch Sensor 2'\)*]

Room Alert 3E: snmptrap[Alarm.*Sensor \(*'Door'\)*]

What am I doing wrong? What am I missing?

[cyber]

snmptrap[regexp]
your regex "snmptrap[ALARM.*Switch Sensor 2 \(*'Switch Sensor 2'\)*" does not match what is in your trap...

iso.3.6.1.4.1.20916.1.12.2.1.0 type=4 value=STRING: "ALARM: Switch Open Alarm on Sensor 'Switch Sensor 2'"

snmptrap[ALARM: .*'Switch Sensor 2'] should work...

https://regex101.com/r/9jMyfh/1

[EdgarLoya]

Highly appreciate the help Cyber, it worked, and the item captured the value=STRING: "ALARM: Switch Open Alarm on Sensor 'Switch Sensor 2'" but... I failed to realize that snmptrap[ALARM: .*'Switch Sensor 2'] would not capture iso.3.6.1.4.1.20916.1.12.2.1.0 type=4 value=STRING: "CLEAR: Switch Open Alarm Cleared On Sensor 'Switch Sensor 1'".

I've attempted a few different regular expressions, but I can't seem to figure out how to capture both value strings into one snmptrap item.

I uploaded a screenshot of what is showing up in our RA:Trap.

Greatly appreciate the help!

[cyber]

snmptrap["iso.3.6.1.4.1.20916.1.12.2.1.0"]

will match any trap with that OID

If you want to use the text from it in trigger then you need set event name as

{{ITEM.VALUE}.regsub("iso.3.6.1.4.1.20916.1.12.2.1.0 type=4 value=STRING: \"(.*)\","\1")}

or one trigger for alarm and other for clear

{{ITEM.VALUE}.regsub("iso.3.6.1.4.1.20916.1.12.2.1.0 type=4 value=STRING: \"ALARM: (.*)\","\1")}
{{ITEM.VALUE}.regsub("iso.3.6.1.4.1.20916.1.12.2.1.0 type=4 value=STRING: \"CLEAR: (.*)\","\1")}

[EdgarLoya]

Cyber, thank you a ton for your help with all of this. I ended up running into another issue where the item ended up capturing the traps of all 3 sensors into one item. After poking around for a while, I figured out how to create capture each sensor into its own item.

For anyone in the future trying to figure this out:

Sensor 1:
Name: (Any name you want to give it)
Type: SNMP trap
Key: snmptrap['Switch Sensor 1']
Type of info: text

Trigger:
Name: (Any name you want to give it)
Problem expression: find(/nameofhost/snmptrap['Switch Sensor 1'],#1,,"ALARM: Switch Open Alarm on Sensor 'Switch Sensor 1'")=1
Ok event generation: Recovery expression
Recovery expression: find(/nameofhost/snmptrap['Switch Sensor 1'],#1,,"CLEAR: Switch Open Alarm Cleared On Sensor 'Switch Sensor 1'")=1
Allow manual close: checked

Sensor 2:
Name: (Any name you want to give it)
Type: SNMP trap
Key: snmptrap['Switch Sensor 2']
Type of info: text

Trigger:
Name: (Any name you want to give it)
Problem expression: find(/nameofhost/snmptrap['Switch Sensor 2'],#1,,"ALARM: Switch Open Alarm on Sensor 'Switch Sensor 2'")=1
Ok event generation: Recovery expression
Recovery expression: find(/nameofhost/snmptrap['Switch Sensor 2'],#1,,"CLEAR: Switch Open Alarm Cleared On Sensor 'Switch Sensor 2'")=1
Allow manual close: checked

Etc. I've attached screenshots of what they look like.

[EdgarLoya]

I then ran into an issue trying to setup the internal and external temperature items and triggers. I ended up figuring it out... see attachments. In the room alert web UI, enable high on both the internal sensor and sensor 1, set to desired Fahrenheit. The inter temp 2 screenshot preprocessing can be used for both external and internal. For the MIB browser, I used iReasoning MIB browser.

Hopefully this helps someone in the future.

[cyber]

If you only caprture ALARM and CLEAR traps, then you actually do not need recovery expression there... recovery one is additional condition that has to be true after problem expression becomes false. If your item already catches "CLEAR" event, your problem expression already becomes false and problem is set to OK... recovery basically duplicates this.
If there would be some other events captured by this item, then recovery expression makes sense, only clear trap then closes problem, not some other random trap...

[EdgarLoya]

I'm not entirely sure how our existing Zabbix dashboard was initially set up, but the reason for using recovery expressions is related to its configuration. When the door sensor is in an open state, it appears under Door Activity and Problems. Once we update and acknowledge the door activity, it is immediately cleared from the problems. However, if I remove the recovery expression and we update and acknowledge the door activity, it remains in the problems for 15-45 seconds before disappearing.

I noted to remove the recovery expression on our door sensors and accept that the alert will remain in the problems for a few seconds longer than it usually did.


Again, thank you Cyber!