Questions[snmptrapd](server)

I am trying to configure vCenter 7.0 to send SNMP traps to a VM.

I have followed following procedure:

a. Configurations on vCenter, using CLI

1. Set engine ID : snmp.set --engineid 123456
2. Set authentication : snmp.set --authentication SHA1
3. Set privacy : snmp.set --privacy AES128
4. Set auth and privacy hash : snmp.hash --auth_hash Abcdefgh --priv_hash Abcdefgh –raw_secret true
5. Set user : snmp.set --user root/<auth_hash>/<privacy_hash>/priv
6. Set SNMP target/receiver : snmp.set --v3targets 192.168.100.100@162/root/priv/trap
7. enable SNMP : snmp.enable

b. configure SNMP v3 receiver on VM

1. created a snmp config file : /tmp/snmptrapd.config

disableAuthorization no 
createUser -e 0x123456 root SHA Abcdefgh AES
authUser log,execute root

2. run snmptrapd process : snmptrapd -nLf snmp_traps.log -C -c /tmp/snmptrapd.config

Once the above command is entered, snmptrapd starts monitoring for SNMP notifications, and there is no error in the logs.

But snmptrapd only captures and logs traps/inform which are generated by the snmp.test command entered on vCenter

UDP: [192.168.100.99]:36772->[192.168.100.100]:162 [UDP: [192.168.100.99]:36772->[192.168.100.100]:162]: DISMAN-EVENT-MIB::sysUpTimeInstance = Timeticks: (196478) 0:32:44.78 SNMPv2-MIB::snmpTrapOID.0 = OID: SNMPv2-MIB::warmStart SNMPv2-MIB::snmpTrapEnterprise.0 = OID: SNMPv2-SMI::enterprises.6876.4.6876

Even though the VM receives all other configured traps such as VM power off, etc, which TCPDUMP is able to capture but not snmptrapd

I have a cisco and a monitoring server with icinga (a.k.a. nagios, thruk). I want to receive traps from cisco and show them in icinga. But I am unable to see the interface and vlan for the errdisable trap.

I have downloaded mibs from cisco, incliding CISCO-ERR-DISABLE-MIB.my. Then I converted it for snmptt with this command:

snmpttconvertmib --in=CISCO-ERR-DISABLE-MIB.my --out=snmptt.conf --exec='/bin/bash /usr/local/bin/trap/submit_check_result $r '"errdisable 2" -net_snmp_perl --format=4

which produced the following config (I replaced the absolute path to mib with ... and variable values with ...):

#
#
#
#
MIB: CISCO-ERR-DISABLE-MIB (file:/.../CISCO-ERR-DISABLE-MIB.my) converted on Wed Sep  8 16:49:53 2021 using snmpttconvertmib v1.4.2
#
#
#
EVENT cErrDisableInterfaceEvent .1.3.6.1.4.1.9.9.548.0.1.1 "Status Events" Normal
FORMAT cErrDisableInterfaceEvent - cErrDisableIfStatusCause:$1 
EXEC /bin/bash /usr/local/bin/trap/submit_check_result $r errdisable 2 "cErrDisableInterfaceEvent - cErrDisableIfStatusCause:$1 "
SDESC
The cErrDisableInterfaceEvent is generated when an interface
or {interface, vlan} is error-disabled by the feature
specified in cErrDisableIfStatusCause.
cErrDisableInterfaceEvent is deprecated and replaced by 
cErrDisableInterfaceEventRev1.
Variables:
  1: cErrDisableIfStatusCause
     Syntax="INTEGER"
       1: udld
       ...
       9: portSecurityViolation
     Descr="This object specifies the feature/event that caused the
        {interface, vlan} (or the entire interface) to be
        error-disabled."
EDESC
#
#
#
EVENT cErrDisableInterfaceEventRev1 .1.3.6.1.4.1.9.9.548.0.2 "Status Events" Normal
FORMAT cErrDisableInterfaceEventRev1 - cErrDisableIfStatusCause:$1 
EXEC /bin/bash /usr/local/bin/trap/submit_check_result $r errdisable 2 "$N - $+1 "
SDESC
The cErrDisableInterfaceEventRev1 is generated when an
interface or {interface, vlan} is error-disabled by the 
feature specified in cErrDisableIfStatusCause.
cErrDisableInterfaceEventRev1 deprecates 
cErrDisableInterfaceEvent to make it RFC 2578 compliant. 
According to section 8.5 of RFC 2578, the next
to last sub-identifier in the name of any newly-defined
notification must have the value zero.
Variables:
  1: cErrDisableIfStatusCause
     Syntax="INTEGER"
       1: udld
       ...
       9: portSecurityViolation
     Descr="This object specifies the feature/event that caused the
        {interface, vlan} (or the entire interface) to be
        error-disabled."
EDESC

There are two traps, I am interested only in cErrDisableInterfaceEventRev1, but not in deprecated cErrDisableInterfaceEvent.

This is my send-errdisable.sh which I use to generate a test errdisable event:

TO_HOST=icinga.example.com
community=abcabc

snmptrap -m ALL -v 2c -c $community $TO_HOST '' CISCO-ERR-DISABLE-MIB::cErrDisableInterfaceEventRev1 \
CISCO-ERR-DISABLE-MIB::cErrDisableIfStatusCause.2.0 i 1 \
2>/dev/null

Now when I generate an errdisable event, in icinga plugin output for the errdisable service I get the following text: cErrDisableInterfaceEventRev1 - cErrDisableIfStatusCause:udld
but I expect the interface and vlan to be there, like this:
cErrDisableInterfaceEventRev1 - cErrDisableIfStatusCause.2.0:udld

Why it is not shown? And how to fix that?

Ubuntu 18.04 and 20.04, snmptrapd, versions around 5.7.3.

Trap events go into syslog. Great.

How can you make the log files go to a custom location besides syslog?

logoption or logOption as seen in many internet answers and tutorials does NOT work in snmptrapd.conf.

You can put logoption in snmp.conf, but then ALL snmp logs go there, not JUST the traps. For example, error messages when you run snmpwalk. I can find NO way to create a log file of ONLY snmp traps received by snmptrapd.

I thought a sneaky workaround would be an execute and traphandle, and just have a script write to disk. But traphandle doesn't seem to pass arguments?

something like :

authCommunity log,execute trap-dat
traphandle default /usr/local/bin/logger.rb

So you want snmptrapd to DO SOMETHING. How do you pass arguments? How do you make this thing write to a custom logfile?

There is ONE distasteful method to write a custom log file : change or over-ride snmptrapd's startup unit like : /lib/systemd/system/snmptrapd.service or the override in /etc/whatever

like this :

ExecStart=/usr/sbin/snmptrapd -Ln -f -Lf /var/log/snmptrapd.log

(centos 7.x)

I have syslog-ng setup to parse snmptrapd messages so I can format them for later digestion. The issue is that syslog-ng only outputs the n-1 message. IE if there are 10 lines in snmptrapd.log syslog-ng only outputs 9 lines. If I send a new message to snmptrapd (message #11) then syslog-ng will output the 10th message.

syslog-ng.conf:

@version:3.27
@include "scl.conf"
log {
  source {
    snmptrap(filename("/var/log/snmptrapd.log"));
  };
  destination {
    file("/var/log/syslog-ng.log");
  };
};

snmptrapd.conf:

authCommunity log,execute,net public
authCommunity log,execute,net localtrap
format2 %.4y-%.2m-%.2l %.2h:%.2j:%.2k %B [%b]:\n%v\n
outputOption s

I've tried adding an additional newline to the end of format2 but it doesn't help. (snmptrapd.log does get the additional line though)