-
Notifications
You must be signed in to change notification settings - Fork 18
Description
I wrote a small patch (quick and dirty, this is my first code in ruby) to add a field containing either the oid string of the trap or its translation if the mib is available (as many varbinds are allready translated if possible).
I think this task as to be done in this input plugin as it as all the needed informations and data structures.
It maybe better to make this plugin use V2c trap listener handler but this represents to much learning to me at this time.
The patch was developped agains the version 1.4.3 of logstash but semas to apply correctly on master.
--- snmptrap.rb.old 2015-06-01 21:54:00.000000000 +0200
+++ snmptrap.rb 2015-06-19 16:27:16.248385444 +0200
@@ -75,6 +75,18 @@
trap.each_varbind do |vb|
event[vb.name.to_s] = vb.value.to_s
end
+ if trap.generic_trap.to_s != "enterpriseSpecific"
+ event["trap"] = trap.generic_trap
+ else
+ begin
+ mib = SNMP::MIB.new
+ @yaml_mibs.each { |m| mib.load_module(m, @yamlmibdir) }
+ full_oid = SNMP::ObjectId.new(trap.enterprise.to_str + ".0." + trap.specific_trap.to_s, mib)
+ event["trap"] = full_oid.to_s
+ rescue => e
+ @logger.error("Enterprise handler failed", :exception => e, :backtrace => e.backtrace)
+ end
+ end
@logger.debug("SNMP Trap received: ", :trap_object => trap.inspect)
output_queue << event
rescue => eventThe concatenation of @enterprise, ".0." and @specific_trap comes from testing and this reference: http://www.cisco.com/c/en/us/support/docs/ip/simple-network-management-protocol-snmp/7244-snmp-trap.html#topic1