Plugin-input-snmptrap broken in 5.6?

Elastic Stack Logstash
1

Hi all,
yesterday I wrote an snmptrap input for my test system, which was elk 5.2.
Everything worked fine, I also found a script to translate missing MIBs into yml (the original import.rb script does not work at all....).
Then I upgraded my ELK to 5.6. Since this, my logstash pipeline is not running properly anymore. I start logstash, it begins to overwrite the mibs then nothing happens anymore.

As everything was working yesterday under 5.2 I am really wondering what is going wrong here. I really need this plugin. Also when I just adding my 4 own MIBS and deleting all the others in
/usr/share/logstash/vendor/bundle/jruby/1.9/gems/snmp-1.2.0/data/ruby/snmp/mibs
it is hanging.

:/usr/share/logstash/vendor/bundle/jruby/1.9/gems/snmp-1.2.0/data/ruby/snmp/mibs# /usr/share/logstash/bin/logstash --debug -f /etc/logstash/conf.d/snmp.conf
WARNING: Could not find logstash.yml which is typically located in $LS_HOME/config or /etc/logstash. You can specify the path using --path.settings. Continuing using the defaults
Could not find log4j2 configuration at path //usr/share/logstash/config/log4j2.properties. Using default config which logs errors to the console
warning: overwriting old MIB name 'sni'
warning: overwriting old MIB name 'sniProductMibs'
warning: overwriting old MIB name 'sniExtensions'
warning: overwriting old MIB name 'sniServerMgmt'
warning: overwriting old MIB name 'sniInventory'
warning: overwriting old MIB name 'sniCommon'
warning: overwriting old MIB name 'enterprises'
warning: overwriting old MIB name 'sni'
warning: overwriting old MIB name 'sniProductMibs'
warning: overwriting old MIB name 'sniExtensions'
warning: overwriting old MIB name 'sniServerMgmt'
warning: overwriting old MIB name 'sniInventory'
warning: overwriting old MIB name 'sniCommon'
warning: overwriting old MIB name 'sniBios'
warning: overwriting old MIB name 'sniEisa'
warning: overwriting old MIB name 'sniHd'
warning: overwriting old MIB name 'sniBus'
warning: overwriting old MIB name 'sniServerControl'
warning: overwriting old MIB name 'sniPcSpecific'
warning: overwriting old MIB name 'sniScb'
warning: overwriting old MIB name 'sniOsSpecific'
warning: overwriting old MIB name 'sniNetware'
warning: overwriting old MIB name 'sniWinNt'
warning: overwriting old MIB name 'sniOs2'
warning: overwriting old MIB name 'sniUnix'
warning: overwriting old MIB name 'sniOemComponents'
warning: overwriting old MIB name 'sniOemDpt'
warning: overwriting old MIB name 'sniOemMylex'
warning: overwriting old MIB name 'sniMlxDiskArray'
warning: overwriting old MIB name 'sniSecurity'
warning: overwriting old MIB name 'sniSmSecurity'
warning: overwriting old MIB name 'sniServerView'
warning: overwriting old MIB name 'sniTrapMib'

Seems, I am not the only one:

Regards,

Marcus

2

Got it working again...
Don't know why, but because of any reason, the trap port was blocked so logstash could not listen to it. But neither logstash told me, that it cannot listen nor the so good known "it's a trap" message is shown anymore.

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.