SNMP Bind Failed

Elastic Stack Logstash
1

When I run the SNMP input filter, I get the SNMP trap listener died; can not assign requested address .
Here is my config:

input {
 snmptrap {
   host => '**.**.**.**'
   port => 161
   community => "public"
   yamlmibdir => 'C:\logstash\vendor\bundle\jruby\2.3.0\gems\snmp-1.2.0\data\ruby\snmp\mibs'
 }
}

output {
stdout {codec => rubydebug}
}

I tried with the MIB browser, it takes port no: 161, and it works fine but it fails at logstash config. please let em know if am wrong anywhere.

2

Are you getting an error message?

3

Hi @AquaX-
Yes, I do. Here is the error log:

[2018-10-04T15:20:10,976][WARN ][logstash.inputs.snmptrap ] SNMP Trap listener d
ied {:exception=>#<Errno::EADDRNOTAVAIL: Can't assign requested address - bind -
 Cannot assign requested address: bind>, :backtrace=>["org/jruby/ext/socket/Ruby
UDPSocket.java:190:in `bind'", "C:/logstash/vendor/bundle/jruby/2.3.0/gems/snmp-
1.2.0/lib/snmp/manager.rb:540:in `initialize'", "C:/logstash/vendor/bundle/jruby
/2.3.0/gems/snmp-1.2.0/lib/snmp/manager.rb:586:in `create_transport'", "C:/logst
ash/vendor/bundle/jruby/2.3.0/gems/snmp-1.2.0/lib/snmp/manager.rb:618:in `initia
lize'", "C:/logstash/vendor/bundle/jruby/2.3.0/gems/logstash-input-snmptrap-3.0.
5/lib/logstash/inputs/snmptrap.rb:75:in `build_trap_listener'", "C:/logstash/ven
dor/bundle/jruby/2.3.0/gems/logstash-input-snmptrap-3.0.5/lib/logstash/inputs/sn
mptrap.rb:79:in `snmptrap_listener'", "C:/logstash/vendor/bundle/jruby/2.3.0/gem
s/logstash-input-snmptrap-3.0.5/lib/logstash/inputs/snmptrap.rb:54:in `run'", "C
:/logstash/logstash-core/lib/logstash/pipeline.rb:524:in `inputworker'", "C:/log
stash/logstash-core/lib/logstash/pipeline.rb:517:in `block in start_input'"]}
4

Looks like port 161 is already in use. Either kill the process that is already listening on that port or change the port to something else :slight_smile:

5

Is the IP address in the host option one of the addresses of the Logstash host?

6

@magnusbaeck - Hi, The IP Address in the Host Option is one of the Cisco device IP. NOT the Logstash IP.
I tried giving the other ports, but still I see the same error message. :frowning:

7

Hi Paul,

Logstash won't be able to bind to an IP address of a remote device, it needs to be an address on the Logstash server. Also, you won't be able to bind to port 161 if you already have an SNMP agent like Net-SNMP running on the same host because 161 is the default snmp agent port and 162 is the default for SNMP traps.

Just a side query, are you expecting snmp traps on this Logstash or are you trying to do a snmp get/walk of a remote Cisco device with this input?

8

Hi @axrayn-
I just need to do the snmp get/get next on a remote cisco device with this input. Thanks !

9

Ah, that could be an issue then. :slight_smile:

The logstash-input-snmptrap module is for accepting snmp traps from remote devices.

Take a look at https://github.com/logstash-plugins/logstash-input-snmp. It's not GA yet but will do the snmp get/walk you're after.

10

@axrayn- Could you please provide a sample input to do the snmpget on a remote device. Thanks !

11

Have a look at the sample.conf under the test folder.

12

Thank you @axrayn.
I just have some of the Vendor MIB files, I need to do the snmp get for all of the OID's present in that MIB files. Is there any way that we can do that. Please let me know. Thanks !

Paul.

13

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.