Snmp TRAP v3 configuration on DEBIAN 12

[Yrzq]

Hello,

I try to understand why my snmp trap on zabbix doesn't work. I dig on all forum and googling like hell. And if someone can help me to solve this ?

My environnement :
- Zabbix 7.4
- VM on Debian 12
- First configuration.
- Package libsnmp-perl / snmp / snmp-mibs-downloader / snmptrapd

CONFIGURATION :

+ /usr/bin/zabbix_trap_receiver.pl :

- I change this line

$SNMPTrapperFile = '/var/log/snmptrap/snmptrap.log';

+ /etc/snmp/snmptrapd.conf :

createUser test SHA test DES test
authUser log,execute,net test

#Zabbix SNMP trap receiver
perl do "/usr/bin/zabbix_trap_receiver.pl";

+ /etc/zabbix/zabbix_server.conf :

- I change this line

SNMPTrapperFile=/var/log/snmptrap/snmptrap.log
StartSNMPTrapper=1

MY SERVER STATUS

ZABBIX-SERVER :

● zabbix-server.service - Zabbix Server
     Loaded: loaded (/lib/systemd/system/zabbix-server.service; enabled; preset: enabled)
     Active: active (running) since Fri 2025-08-08 11:51:07 CEST; 32min ago
    Process: 27383 ExecStart=/usr/sbin/zabbix_server -c $CONFFILE (code=exited, status=0/SUCCESS)
   Main PID: 27386 (zabbix_server)
      Tasks: 78 (limit: 4636)
     Memory: 83.3M
        CPU: 16.722s
     CGroup: /system.slice/zabbix-server.service
             ├─27386 /usr/sbin/zabbix_server -c /etc/zabbix/zabbix_server.conf
             ├─27387 "/usr/sbin/zabbix_server: ha manager"
             ├─27388 "/usr/sbin/zabbix_server: service manager #1 [processed 0 events, updated 0 event tags, deleted 0 problems, synced 0 service updates, idle 5.005981 sec during 5.009389 sec]"
             ├─27389 "/usr/sbin/zabbix_server: configuration syncer [synced configuration in 0.039126 sec, idle 10 sec]"
             ├─27390 "/usr/sbin/zabbix_server: alert manager #1 [sent 0, failed 0 alerts, idle 5.007457 sec during 5.007741 sec]"
             ├─27391 "/usr/sbin/zabbix_server: alerter #1 started"
             ├─27392 "/usr/sbin/zabbix_server: alerter #2 started"
             ├─27393 "/usr/sbin/zabbix_server: alerter #3 started"
             ├─27394 "/usr/sbin/zabbix_server: preprocessing manager #1 [queued 0, processed 0 values, idle 5.010576 sec during 5.010793 sec]"
             ├─27395 "/usr/sbin/zabbix_server: lld manager #1 [processed 0 LLD rules, idle 5.005475sec during 5.005681 sec]"
             ├─27396 "/usr/sbin/zabbix_server: lld worker #1 [processed 1 LLD rules, idle 20.985621 sec during 20.999912 sec]"
             ├─27397 "/usr/sbin/zabbix_server: lld worker #2 [processed 1 LLD rules, idle 39.034041 sec during 39.044439 sec]"
             ├─27398 "/usr/sbin/zabbix_server: housekeeper [deleted 70 hist/trends, 0 items/triggers, 0 events, 0 sessions, 0 alarms, 0 audit items, 0 autoreg_host, 0 records in 0.010815 sec, idle for 1 hour(s)]"
             ├─27399 "/usr/sbin/zabbix_server: timer #1 [updated 0 hosts, suppressed 0 events in 0.001012 sec, idle 59 sec]"
             ├─27400 "/usr/sbin/zabbix_server: http poller #1 [got 0 values in 0.000048 sec, idle 5 sec]"
             ├─27401 "/usr/sbin/zabbix_server: browser poller #1 [got 0 values in 0.000055 sec, idle 5 sec]"
             ├─27402 "/usr/sbin/zabbix_server: discovery manager #1 [processing 0 rules, 0 unsaved checks]"
             ├─27403 "/usr/sbin/zabbix_server: history syncer #1 [processed 2 values, 1+0 triggers in 0.002680 (0.002,0.000,0.000,0.000,0.000) sec, idle 1 sec]"
             ├─27404 "/usr/sbin/zabbix_server: history syncer #2 [processed 0 values, 0+0 triggers in 0.000068 (0.000,0.000,0.000,0.000,0.000) sec, idle 1 sec]"
             ├─27405 "/usr/sbin/zabbix_server: history syncer #3 [processed 0 values, 0+0 triggers in 0.000076 (0.000,0.000,0.000,0.000,0.000) sec, idle 1 sec]"
             ├─27406 "/usr/sbin/zabbix_server: history syncer #4 [processed 0 values, 0+0 triggers in 0.000076 (0.000,0.000,0.000,0.000,0.000) sec, idle 1 sec]"
             ├─27407 "/usr/sbin/zabbix_server: escalator #1 [processed 0 escalations in 0.002008 sec, idle 3 sec]"
             ├─27408 "/usr/sbin/zabbix_server: snmp trapper [processed data in 0.000066 sec, idle 1 sec]"
             ├─27409 "/usr/sbin/zabbix_server: proxy poller #1 [exchanged data with 0 proxies in 0.000050 sec, idle 5 sec]"
             ├─27410 "/usr/sbin/zabbix_server: self-monitoring [processed data in 0.000051 sec, idle 1 sec]"
             ├─27411 "/usr/sbin/zabbix_server: task manager [processed 0 task(s) in 0.000743 sec, idle 5 sec]"
             ├─27420 "/usr/sbin/zabbix_server: poller #1 [got 0 values in 0.000068 sec, idle 5 sec]"
             ├─27429 "/usr/sbin/zabbix_server: poller #2 [got 0 values in 0.000066 sec, idle 5 sec]"
             ├─27430 "/usr/sbin/zabbix_server: poller #3 [got 0 values in 0.000061 sec, idle 5 sec]"
             ├─27431 "/usr/sbin/zabbix_server: poller #4 [got 0 values in 0.000056 sec, idle 5 sec]"
             ├─27437 "/usr/sbin/zabbix_server: poller #5 [got 0 values in 0.000052 sec, idle 5 sec]"
             ├─27438 "/usr/sbin/zabbix_server: unreachable poller #1 [got 0 values in 0.000045 sec, idle 5 sec]"
             ├─27439 "/usr/sbin/zabbix_server: trapper #1 [processed data in 0.000166 sec, waiting for connection]"
             ├─27440 "/usr/sbin/zabbix_server: trapper #2 [processed data in 0.000065 sec, waiting for connection]"
             ├─27441 "/usr/sbin/zabbix_server: trapper #3 [processed data in 0.000117 sec, waiting for connection]"
             ├─27442 "/usr/sbin/zabbix_server: trapper #4 [processed data in 0.000104 sec, waiting for connection]"
             ├─27443 "/usr/sbin/zabbix_server: trapper #5 [processed data in 0.000139 sec, waiting for connection]"
             ├─27444 "/usr/sbin/zabbix_server: icmp pinger #1 [got 0 values in 0.000059 sec, idle 5 sec]"
             ├─27445 "/usr/sbin/zabbix_server: alert syncer [queued 0 alerts(s), flushed 0 result(s) in 0.000002 sec, idle 1 sec]"
             ├─27446 "/usr/sbin/zabbix_server: history poller #1 [got 0 values in 0.000055 sec, idle 5 sec]"
             ├─27447 "/usr/sbin/zabbix_server: history poller #2 [got 0 values in 0.000055 sec, idle 5 sec]"
             ├─27448 "/usr/sbin/zabbix_server: history poller #3 [got 0 values in 0.000061 sec, idle 5 sec]"
             ├─27449 "/usr/sbin/zabbix_server: history poller #4 [got 0 values in 0.000069 sec, idle 5 sec]"
             ├─27450 "/usr/sbin/zabbix_server: history poller #5 [got 0 values in 0.000064 sec, idle 5 sec]"
             ├─27451 "/usr/sbin/zabbix_server: availability manager #1 [queued 0, processed 0 values, idle 5.005538 sec during 5.005672 sec]"
             ├─27452 "/usr/sbin/zabbix_server: trigger housekeeper [deleted 0 problems records in 0.001149 sec, idle for 60 second(s)]"
             ├─27453 "/usr/sbin/zabbix_server: odbc poller #1 [got 0 values in 0.000071 sec, idle 5 sec]"
             ├─27454 "/usr/sbin/zabbix_server: http agent poller #1 [got 0 values, queued 0 in 5 sec, awaiting 0]"
             ├─27456 "/usr/sbin/zabbix_server: agent poller #1 [got 4 values, queued 3 in 5 sec, awaiting 0]"
             ├─27458 "/usr/sbin/zabbix_server: snmp poller #1 [got 0 values, queued 0 in 5 sec, awaiting 0]"
             ├─27459 "/usr/sbin/zabbix_server: configuration syncer worker [synced 0, updated 0 item names in 0.002814 sec, idle]"
             ├─27461 "/usr/sbin/zabbix_server: internal poller #1 [got 1 values in 0.000293 sec, idle 1 sec]"
             └─27462 "/usr/sbin/zabbix_server: proxy group manager #1 started"

SNMPTRAP SERVICE :

● snmptrapd.service - Simple Network Management Protocol (SNMP) Trap Daemon.
     Loaded: loaded (/lib/systemd/system/snmptrapd.service; static)
     Active: active (running) since Fri 2025-08-08 11:51:01 CEST; 36min ago
TriggeredBy: ● snmptrapd.socket
   Main PID: 27373 (snmptrapd)
      Tasks: 1 (limit: 4636)
     Memory: 5.5M
        CPU: 202ms
     CGroup: /system.slice/snmptrapd.service
             └─27373 /usr/sbin/snmptrapd -LOw -f udp:162 udp6:162

août 08 11:51:01 PS-ZABBIX systemd[1]: Starting snmptrapd.service - Simple Network Management Protocol (SNMP) Trap Daemon....
août 08 11:51:01 PS-ZABBIX systemd[1]: Started snmptrapd.service - Simple Network Management Protocol (SNMP) Trap Daemon..

I followed and apply these tutoriel/documentation :
- Link 1 : How to set up SNMP Trap in Zabbix - initMAX s.r.o.
- Link 2 : Vidéos Bing
- Link 3 : SNMP V3 Trap Configuration and Tests : Versa Support
- Link 4 : Manpage of SNMPTRAPD.CONF

I followed each tutorial separately the first time. Then, I followed the methodology in Link 2 with the information from the other links.
I still have the same problem: snmptrap.log is not being created.

I tested the commands (with my configuration) to test the trap v3 :
snmptrap -v3 -utest -lauthPriv -aSHA -test -xDES -Xtest localhost "" SNMPv2-MIB::snmpMIB IF-MIB::linkDown s eth999

That's not work. I'm running out of idea. I don't want to use SNMP v2. If someone can give some hint ?

Best regard,

Yrzq.

[ISiroshtan]

Yrzq regards permission on log file, writing to log file is snmptrapd daemon, not Zabbix. It usually ran by either root or snmp user, I don't rightfully recall which one and currently have no access to any Linux machine to look how it's there.
You can change permission to 766, effectively allowing anyone write to it and anyone read it (not sure it complies with your security policies tho). Also you need to ensure that folder it located in also has read permission for respectful user (for folder you can test with 777 perms to allow all access to all users)

[Yrzq]

I find it! Now it work thank. Now I have log.


What I do :

I use these command line to find the user of snmptrap service:

The name was truncate so I use this command :

ps -axo user:20,pid,pcpu,pmem,vsz,rss,tty,stat,start,time,comm | grep snmp

I find the user Debian-snmp (why not) who are using the app.

sudo chown root:Debian-snmp /var/log/snmptrap/

I'm so relieved now. That tourmented me so much haha.
I wonder if you know how work zabbix-glpi API work ?

Best Regards and thank,

[ISiroshtan]

Hey there

On top of using Username and Password in SNMPv3 each device has to be uniquely identified by EngingeID. This mentioned in 2 out of 4 links you provided (did not watch the video, maybe they mention it there too, dunno) but you seem to have completely missed it.

For test purpose you can come up with some bogus engineId and set it in /etc/snmp/snmptrapd.conf. Just take one from examples on one of sites that you linked:

createUser -e 0x800000020109840301 test SHA test DES test

When sending the trap you firstly need to use -A option when providing authentication password (so -Atest not the -test) and secondly explicitly tell snmtrap to use the set engineId (with -e0x800000020109840301). So full command should be

snmptrap -v3 -utest -lauthPriv -aSHA [B]-Atest[/B] -xDES -Xtest [B]-e0x800000020109840301[/B]​ localhost "" SNMPv2-MIB::snmpMIB IF-MIB::linkDown s eth999

Also do note, for production use you would need to get unique egineID of each device that will be sending data to Zabbix and add it to your /etc/snmp/snmptrapd.conf.

[Yrzq]

Hello,

Thank for the helps.

I have found the problem. I think it's permission problem.
I adjust my "/etc/snmp/snmptrapd.conf" as ISiroshtan said.

In my smnptrap status : 

● snmptrapd.service - Simple Network Management Protocol (SNMP) Trap Daemon.
     Loaded: loaded (/lib/systemd/system/snmptrapd.service; static)
     Active: active (running) since Mon 2025-08-11 10:03:55 CEST; 14min ago
TriggeredBy: ● snmptrapd.socket
   Main PID: 65148 (snmptrapd)
      Tasks: 1 (limit: 4636)
     Memory: 5.5M
        CPU: 138ms
     CGroup: /system.slice/snmptrapd.service
             └─65148 /usr/sbin/snmptrapd -LOw -f udp:162 udp6:162

août 11 10:03:55 PS-ZABBIX systemd[1]: Starting snmptrapd.service - Simple Network Management Protocol (SNMP) Trap Daemon....
août 11 10:03:55 PS-ZABBIX systemd[1]: Started snmptrapd.service - Simple Network Management Protocol (SNMP) Trap Daemon..
août 11 10:08:35 PS-ZABBIX snmptrapd[65148]: Cannot open [/var/log/snmptrap/snmptrap.log]: Permission denied
août 11 10:16:26 PS-ZABBIX snmptrapd[65148]: Cannot open [/var/log/snmptrap/snmptrap.log]: Permission denied

I try to change the owner group of the "/var/log/snmptrap/snmptrap.log", I believe that user is zabbix ? 

drwxr-xr-x   2 zabbix zabbix            4096  snmptrap

I have same error. Did security profil work like windows ?

Best regards.

[cyber]

Also do note, for production use you would need to get unique egineID of each device that will be sending data to Zabbix and add it to your /etc/snmp/snmptrapd.conf.

As we talk here about v3.... IF your devices are smart enought to send out informs instead of traps, you don't need all the engine ID-s as sending informs has all the negotiation process built in ... "Hello, I am XXX, I want to send you some stuff... ", "Oh hello XXX, you are welcome"... "sending.... ", Received.... " all the user/passwd checking also somewhere in there..

https://www.net-snmp.org/tutorial/tutorial-5/commands/snmptrap-v3.html

[ISiroshtan]

True, tho almost never saw any device admin configuring informs instead of traps. Usually it goes "I did minimum config on my side, it sends traps, now it's your problem to accept them"

[Yrzq]

Hello,

Thank for the helps.

I wonder if in snmp trap, did we need a "Community" or "Context" ? I saw in snmptrap config there are not this parameter in anywhere? Did this thing are important ?

Best regards.

[ISiroshtan]

Yrzq regards permission on log file, writing to log file is snmptrapd daemon, not Zabbix. It usually ran by either root or snmp user, I don't rightfully recall which one and currently have no access to any Linux machine to look how it's there.
You can change permission to 766, effectively allowing anyone write to it and anyone read it (not sure it complies with your security policies tho). Also you need to ensure that folder it located in also has read permission for respectful user (for folder you can test with 777 perms to allow all access to all users)

[Yrzq]

I find it! Now it work thank. Now I have log.


What I do :

I use these command line to find the user of snmptrap service:

The name was truncate so I use this command :

ps -axo user:20,pid,pcpu,pmem,vsz,rss,tty,stat,start,time,comm | grep snmp

I find the user Debian-snmp (why not) who are using the app.

sudo chown root:Debian-snmp /var/log/snmptrap/

I'm so relieved now. That tourmented me so much haha.
I wonder if you know how work zabbix-glpi API work ?

Best Regards and thank,