Logstash - Translate Use custom MIBS (OEM - Oracle Enterprise Manager)

Elastic Stack Logstash
1

Greetings Experts,

I hope someone will be able to help me with that issue.

I’ve installed Logstash version 9.1.4 on linux redhat machine (version 9.5).

logstash is up and running on port 162 receiving snmp trap v3 - everything working perfectly!

my conf file looks like this:

input {

  snmptrap {

    port => 162

    supported_versions => ['3']

    security_name => ""

    auth_protocol => "md5"

    auth_pass => ''

    priv_protocol => "aes"

    priv_pass => ''

    security_level => "authPriv"

    codec => plain

    use_provided_mibs => true

    mib_paths => "/usr/share/snmp/mibs"

    oid_mapping_format => "ruby_snmp"

  }

}

 

filter {

  mutate {

    add_field => { "raw_event" => "%{message}" }

  }

}

 

output {

  file {

   path => "/tmp/snmptrap.txt"

    codec => line { format => "%{message}"}

  }

}

I’ve also installed libsmi, however I cannot make the trap to be translated according to the mib.

Does anyone know how make logstash use the custom mib?

Thanks in Advance!

2

Does
logstash user has access to mib_paths => "/usr/share/snmp/mibs"?

3

yes it has. the thing is, under the logs i dont see it mention this path.

4

The input will log an info message if it tries to load the MIB. If it is not logging that then it is not loading the MIB.

1 Like
5

Ive just managed to load it, however it’s not reading it and nothing mention in the log file, do i need to use: smidump -k -f python /path/to/omstrap.v1 > /usr/share/logstash/vendor/bundle/.../mibs/custom/ORACLE-ENTERPRISE-MANAGER-4-MIB.dic
or just use it as .txt file?

6

Here is a sample, for input&output. Also you can rename the original field based on MIBs in meaningful name for instance: ""SNMPv2-SMI::enterprises.6027.3.1.1.4.1.2" -> chAlarmVarString . You can get MIB database from online.

Also use debug in the output, provide us with more details.
stdout { codec => rubydebug{}}

7

hello Rios

thanks for the reply, i have no problem with making the Traps to work, just like i said traps arriving and being written into the logfile, however when you need to translate the OIDs into names it just doesnt load it from the mib i provided.

btw the ORA mib link you provided contains 400 lines mine is offical from ORACLE and it contains 1400 lines.

8

I expect it needs to be in the same format as the bundled MIBs.

9

correct thats why i’ve installed libsmi and ran smidump --level=1 -k -f python /tmp/omstrap.v1 > /usr/share/logstash/vendor/bundle/jruby/3.1.0/gems/logstash-integration-snmp-4.0.7-java/lib/mibs/custom/ORACLE-ENTERPRISE-MANAGER-4-MIB.dic
why ORACLE-ENTERPRISE-MANAGER-4-MIB?

because inside the mib i received there was this line: ORACLE-ENTERPRISE-MANAGER-4-MIB DEFINITIONS ::= BEGIN