Let's create a simple test script snmptraptest.sh that
writes all received SNMP traps into a log file.
|
# vi /tmp/snmptraptest.sh
#!/bin/sh
TESTLOG=/tmp/test
vars=
read host
read ip
while read oid val; do
if [ "$vars" = "" ]; then
vars="$oid = $val"
else
vars="$vars, $oid = $val"
fi
done
if [ -w $TESTLOG ]; then
touch $TESTLOG
fi
echo trap: $1 $host $ip $vars >> $TESTLOG
|
|
We are ready for our first test from the local system, using the 'snmptrap' command,
verifying the traps are received and processed by our test script. Also notice the
use of the TRAP-TEST-MIB we generated. |
# snmptrap -v 2c -c SECtrap 127.0.0.1 "" TRAP-TEST-MIB::demo-trap SNMPv2-MIB::sysLocation
.0 s "here"
# cat /tmp/traptest.log
trap: localhost UDP: [127.0.0.1]:42706 DISMAN-EVENT-MIB::sysUpTimeInstance = 6:4:53:38.72,
SNMPv2-MIB::snmpTrapOID.0 = TRAP-TEST-MIB::demo-trap, SNMPv2-MIB::sysLocation.0 = here
trap: localhost UDP: [127.0.0.1]:42706 DISMAN-EVENT-MIB::sysUpTimeInstance = 6:4:53:38.72,
SNMPv2-MIB::snmpTrapOID.0 = TRAP-TEST-MIB::demo-trap, SNMPv2-MIB::sysLocation.0 = here
|
|
Well, we really are receiving traps, but why are we getting them twice? Let's check if
our 'snmptraptest.sh' script is called twice. We can change the last line writing the
output to include a random string and give it another try.
|
# vi /tmp/snmptraptest.sh
change:
echo trap: $1 $host $ip $vars >> $TESTLOG
to:
echo `/usr/bin/openssl rand 20 -base64` trap: $1 $host $ip $vars >> $TESTLOG
# snmptrap -v 2c -c SECtrap 127.0.0.1 "" TRAP-TEST-MIB::demo-trap SNMPv2-MIB::sysLocation.
0 s "here"
# cat /tmp/traptest.log
vRgoIkp7Y/66EyxK6fETsR7lqhY= trap: localhost UDP: [127.0.0.1]:58476 DISMAN-EVENT-MIB::sys
UpTimeInstance = 6:20:16:06.35, SNMPv2-MIB::snmpTrapOID.0 = TRAP-TEST-MIB::demo-trap, SNM
Pv2-MIB::sysLocation.0 = here
aRsf084ZC/fcJqeOCjFRH/SCNdI= trap: localhost UDP: [127.0.0.1]:58476 DISMAN-EVENT-MIB::sys
UpTimeInstance = 6:20:16:06.35, SNMPv2-MIB::snmpTrapOID.0 = TRAP-TEST-MIB::demo-trap, SNM
Pv2-MIB::sysLocation.0 = here
|
|
Yep, the random hash is different, the script is indeed being called twice! Further down
the investigation ... it turns out that 'snmptrapd' is compiled with the default
configuration file path being already set to '/etc/snmp/snmptrapd.conf'. The explicit
setting of it using the '-c' option in '/etc/init.d/snmptrapd' causes the file being read
and executed twice. Feature or bug? No matter, we need to remove the '-c' option from
'/etc/init.d/snmptrapd'. Re-test, check, problem solved.
|
# vi /etc/init.d/snmptrapd
change:
startproc $SNMPTRAPD $OPTIONS -c /etc/snmp/snmptrapd.conf -Lf /var/log/net-snmpd.log
to:
startproc $SNMPTRAPD $OPTIONS -Lf /var/log/net-snmpd.log
|
|
After we are able to reliably receive SNMP traps, its time to be selective about them.
This is achieved by defining a explicit snmpTrapOID value match in
'/etc/snmp/snmptrapd.conf'. Let's say we only care about the Windows 'coldstart' traps,
our match would be the trap having the oid=value pair of the 'SNMPv2-MIB::snmpTrapOID.0 =
SNMPv2-MIB::coldStart'. Then we restart the Windows SNMP service once more and verify
receiving the trap data. This time whe recorded just a single trap in '/tmp/traptest.log'.
|
# vi /etc/snmp/snmtrapd.conf
change:
traphandle default /tmp/snmptraptest.sh
to:
traphandle SNMPv2-MIB::coldStart /tmp/snmptraptest.sh
# /etc/init.d/snmptrapd restart
# cat /tmp/traptest.log
trap: 192.168.203.140 UDP: [192.168.203.140]:1074 DISMAN-EVENT-MIB::sysUpTimeInstance = 0
:0:00:00.00, SNMPv2-MIB::snmpTrapOID.0 = SNMPv2-MIB::coldStart, SNMP-COMMUNITY-MIB::snmpT
rapAddress.0= 192.168.203.140, SNMP-COMMUNITY-MIB::snmpTrapCommunity.0 = "SECtrap", SNMPv
2-MIB::snmpTrapEnterprise.0 = MSFT-MIB::workstation
|
