Plugin-input-snmptrap broken in 5.6?

[MarcusCaepio]

Hi all,
yesterday I wrote an snmptrap input for my test system, which was elk 5.2.
Everything worked fine, I also found a script to translate missing MIBs into yml (the original import.rb script does not work at all....).
Then I upgraded my ELK to 5.6. Since this, my logstash pipeline is not running properly anymore. I start logstash, it begins to overwrite the mibs then nothing happens anymore.

As everything was working yesterday under 5.2 I am really wondering what is going wrong here. I really need this plugin. Also when I just adding my 4 own MIBS and deleting all the others in
/usr/share/logstash/vendor/bundle/jruby/1.9/gems/snmp-1.2.0/data/ruby/snmp/mibs
it is hanging.

:/usr/share/logstash/vendor/bundle/jruby/1.9/gems/snmp-1.2.0/data/ruby/snmp/mibs# /usr/share/logstash/bin/logstash --debug -f /etc/logstash/conf.d/snmp.conf
WARNING: Could not find logstash.yml which is typically located in $LS_HOME/config or /etc/logstash. You can specify the path using --path.settings. Continuing using the defaults
Could not find log4j2 configuration at path //usr/share/logstash/config/log4j2.properties. Using default config which logs errors to the console
warning: overwriting old MIB name 'sni'
warning: overwriting old MIB name 'sniProductMibs'
warning: overwriting old MIB name 'sniExtensions'
warning: overwriting old MIB name 'sniServerMgmt'
warning: overwriting old MIB name 'sniInventory'
warning: overwriting old MIB name 'sniCommon'
warning: overwriting old MIB name 'enterprises'
warning: overwriting old MIB name 'sni'
warning: overwriting old MIB name 'sniProductMibs'
warning: overwriting old MIB name 'sniExtensions'
warning: overwriting old MIB name 'sniServerMgmt'
warning: overwriting old MIB name 'sniInventory'
warning: overwriting old MIB name 'sniCommon'
warning: overwriting old MIB name 'sniBios'
warning: overwriting old MIB name 'sniEisa'
warning: overwriting old MIB name 'sniHd'
warning: overwriting old MIB name 'sniBus'
warning: overwriting old MIB name 'sniServerControl'
warning: overwriting old MIB name 'sniPcSpecific'
warning: overwriting old MIB name 'sniScb'
warning: overwriting old MIB name 'sniOsSpecific'
warning: overwriting old MIB name 'sniNetware'
warning: overwriting old MIB name 'sniWinNt'
warning: overwriting old MIB name 'sniOs2'
warning: overwriting old MIB name 'sniUnix'
warning: overwriting old MIB name 'sniOemComponents'
warning: overwriting old MIB name 'sniOemDpt'
warning: overwriting old MIB name 'sniOemMylex'
warning: overwriting old MIB name 'sniMlxDiskArray'
warning: overwriting old MIB name 'sniSecurity'
warning: overwriting old MIB name 'sniSmSecurity'
warning: overwriting old MIB name 'sniServerView'
warning: overwriting old MIB name 'sniTrapMib'

Seems, I am not the only one:

SNMPTrap not get any snmp message through logstash

I'm trying to use the snmptrap input plugin. But after I running the logstash, there is no any data in the output. Is anyone meet the same issue? I want to know how to debug it and make it works. Anyone can help me? Thanks. My logstash version is logstash 5.4.0. And the snmptrap plugin is automatic install with logstash-input-snmptrap-3.0.2. Server is based on Centos 7 64 bits. I had generate the yaml file and put it into the directory "/usr/share/logstash/vendor/bundle/jruby/1.9/gems/snmp-1.2…

Regards,

Marcus

[MarcusCaepio]

Got it working again...
Don't know why, but because of any reason, the trap port was blocked so logstash could not listen to it. But neither logstash told me, that it cannot listen nor the so good known "it's a trap" message is shown anymore.