Issue about logstash input snmptrap plugin

Elastic Stack Logstash
1

Hi All....

Here i have an issue with an option yamlmibdir in input snmptrap plugin

input {
snmptrap {
type => "snmptrap"
community => "public"
port => 162
yamlmibdir => "/opt/logstash-5.4.0/vendor/bundle/jruby/1.9/gems/snmp-1.2.0/data/ruby/snmp/mibs"
}
}
filter{
grok{
match => { "message" => ".*SNMPv1\_Trap\:(?<snmp_trap>.*?)\s{0,}\@.*source\_ip.*?=(?<source>.*?)\,.*@agent_addr=\#\<(?<agent_address>.*?)\>"}
}
}
output {
http {
       format => "json"
       http_method => "post"
        headers => ["X-My-Header", "Content-Type: application/json"]
        url => "xxxxxxxxxxxx"
    mapping => {"app_key" => "xxxxxxxxxxxx" "status" => "critical" "host" => "%{message}" }
   }
stdout { codec => rubydebug }
}

the above config file is to push snmp traps.
but the problem is with yamlmibdir when i set that option in input i am unable to send traps to bigpanda
if that option is disable it is working

i am getting the below error:

[logstash.inputs.snmptrap ] It's a Trap! {:Port=>162, :Community=>["public"], :Host=>"0.0.0.0"}
[2017-12-08T20:56:41,450][WARN ][logstash.inputs.snmptrap ] SNMP Trap listener died {:exception=>#<SocketError: bind: name or service wn>, :backtrace=>["org/jruby/ext/socket/RubyUDPSocket.java:160:in bind'", "/opt/logstash-5.4.0/vendor/bundle/jruby/1.9/gems/snmp-1.2.nmp/manager.rb:540:ininitialize'", "/opt/logstash-5.4.0/vendor/bundle/jruby/1.9/gems/snmp-1.2.0/lib/snmp/manager.rb:585:in create_tt'", "/opt/logstash-5.4.0/vendor/bundle/jruby/1.9/gems/snmp-1.2.0/lib/snmp/manager.rb:618:ininitialize'", "/opt/logstash-5.4.0/vendoe/jruby/1.9/gems/logstash-input-snmptrap-3.0.2/lib/logstash/inputs/snmptrap.rb:74:in build_trap_listener'", "/opt/logstash-5.4.0/vendle/jruby/1.9/gems/logstash-input-snmptrap-3.0.2/lib/logstash/inputs/snmptrap.rb:78:insnmptrap_listener'", "/opt/logstash-5.4.0/vendoe/jruby/1.9/gems/logstash-input-snmptrap-3.0.2/lib/logstash/inputs/snmptrap.rb:53:in run'", "/opt/logstash-5.4.0/logstash-core/lib/lopipeline.rb:443:ininputworker'", "/opt/logstash-5.4.0/logstash-core/lib/logstash/pipeline.rb:436:in `start_input'"]}

please suggest to overcome the above error

Thank You.

2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.