Skip to content

snmptrap should add a trap oid field #9

@hobgoblinsmaster

Description

@hobgoblinsmaster

I wrote a small patch (quick and dirty, this is my first code in ruby) to add a field containing either the oid string of the trap or its translation if the mib is available (as many varbinds are allready translated if possible).
I think this task as to be done in this input plugin as it as all the needed informations and data structures.
It maybe better to make this plugin use V2c trap listener handler but this represents to much learning to me at this time.

The patch was developped agains the version 1.4.3 of logstash but semas to apply correctly on master.

--- snmptrap.rb.old     2015-06-01 21:54:00.000000000 +0200
+++ snmptrap.rb 2015-06-19 16:27:16.248385444 +0200
@@ -75,6 +75,18 @@
         trap.each_varbind do |vb|
           event[vb.name.to_s] = vb.value.to_s
         end
+       if trap.generic_trap.to_s != "enterpriseSpecific"
+               event["trap"] = trap.generic_trap
+       else
+               begin
+                       mib = SNMP::MIB.new
+                       @yaml_mibs.each { |m| mib.load_module(m, @yamlmibdir) }
+                       full_oid = SNMP::ObjectId.new(trap.enterprise.to_str + ".0." + trap.specific_trap.to_s, mib)
+                       event["trap"] = full_oid.to_s
+               rescue => e
+                       @logger.error("Enterprise handler failed", :exception => e, :backtrace => e.backtrace)
+               end
+       end
         @logger.debug("SNMP Trap received: ", :trap_object => trap.inspect)
         output_queue << event
       rescue => event

The concatenation of @enterprise, ".0." and @specific_trap comes from testing and this reference: http://www.cisco.com/c/en/us/support/docs/ip/simple-network-management-protocol-snmp/7244-snmp-trap.html#topic1

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions