I'm having a strange problem ingesting snmp into Logstash. This is my pipeline:
input {
snmptrap {
port => 162
type => "snmp"
}
}
output {
if [type] == "snmp" {
stdout { codec => rubydebug }
}
}
This is a raw tcpdump of the incoming SNMP message from the element:
[user@logstash-server mibs]$ sudo tcpdump -i eth0 -vv -A -T snmp -s 0 udp and port 162
tcpdump: listening on eth0, link-type EN10MB (Ethernet), capture size 65535 bytes
18:21:49.957261 IP (tos 0x0, ttl 64, id 29821, offset 0, flags [DF], proto UDP (17), length 288)
host-172-16-1-13.novalocal.48098 > host-172-16-1-21.novalocal.snmptrap: { SNMPv2c { V2Trap(242) R=1882514697 system.sysUpTime.0=51634500 S:1.1.4.1.0=E:11610.6799.3.4.0.5 E:11610.435.5213.1.2.1.0="ProActivePTS" system.sysName.0="pro-pts" E:11610.6799.1.10.0=4 E:11610.435.11281.1.11.1.3.11397.6467="ptsd" E:11610.435.11281.1.11.1.5.11397.6467=1 E:11610.435.11281.1.11.1.6.11397.6467=1 E:11610.435.11281.1.11.1.12.11397.6467=0 } }
..........Vt0........public.....p4. ......0..0...+.......C....D0..
+.....Z......0...+.....Z.3.]......ProActivePTS0...+.........pro-pts0...+.....Z...
....0...+.....Z.3.........C..ptsd0...+.....Z.3.........C...0...+.....Z.3.........C...0...+.....Z.3.........CA..
And this is what I see in stdout from Logstash:
{
"SNMPv2-MIB::sysName.0" => "0\x82\x01\x00\x02\x01\x01",
"RFC1065-SMI::enterprises.11610.435.5213.1.2.1.0" => "0\x82\x01\x00\x02\x01\x01\x04\x06pub",
"RFC1065-SMI::enterprises.11610.6799.1.10.0" => "4",
"RFC1065-SMI::enterprises.11610.435.11281.1.11.1.5.11397.6467" => "1",
"type" => "snmp",
"tags" => [
[0] "snmptrap_enabled"
],
"@version" => "1",
"@timestamp" => 2018-03-27T18:21:50.041Z,
"RFC1065-SMI::enterprises.11610.435.11281.1.11.1.3.11397.6467" => "0\x82\x01\x00",
"RFC1065-SMI::enterprises.11610.435.11281.1.11.1.6.11397.6467" => "1",
"customer_name" => "poc_2",
"DISMAN-EVENT-MIB::sysUpTimeInstance" => "5 days, 23:25:45.00",
"message" => "#<SNMP::SNMPv2_Trap:0x5ff9028a @request_id=1882514697, @error_index=0, @error_status=0, @source_ip=\"172.16.1.13\", @varbind_list=[#<SNMP::VarBind:0x54046e42 @name=[1.3.6.1.2.1.1.3.0], @value=#<SNMP::TimeTicks:0x3a687373 @value=51634500>>, #<SNMP::VarBind:0x2d92cbe6 @name=[1.3.6.1.6.3.1.1.4.1.0], @value=[1.3.6.1.4.1.11610.6799.3.4.0.5]>, #<SNMP::VarBind:0x399a8dc7 @name=[1.3.6.1.4.1.11610.435.5213.1.2.1.0], @value=\"ProActivePTS\">, #<SNMP::VarBind:0x4e1b82c8 @name=[1.3.6.1.2.1.1.5.0], @value=\"pro-pts\">, #<SNMP::VarBind:0x37918393 @name=[1.3.6.1.4.1.11610.6799.1.10.0], @value=#<SNMP::Integer:0xce7a37c @value=4>>, #<SNMP::VarBind:0x61fee392 @name=[1.3.6.1.4.1.11610.435.11281.1.11.1.3.11397.6467], @value=\"ptsd\">, #<SNMP::VarBind:0x73e130a7 @name=[1.3.6.1.4.1.11610.435.11281.1.11.1.5.11397.6467], @value=#<SNMP::Integer:0x4857b853 @value=1>>, #<SNMP::VarBind:0x799a1e66 @name=[1.3.6.1.4.1.11610.435.11281.1.11.1.6.11397.6467], @value=#<SNMP::Integer:0x6f6e90b4 @value=1>>, #<SNMP::VarBind:0x15f0e1f6 @name=[1.3.6.1.4.1.11610.435.11281.1.11.1.12.11397.6467], @value=#<SNMP::Counter32:0x6010563b @value=0>>]>",
"SNMPv2-MIB::snmpTrapOID.0" => "RFC1065-SMI::enterprises.11610.6799.3.4.0.5",
"host" => "172.16.1.13",
"RFC1065-SMI::enterprises.11610.435.11281.1.11.1.12.11397.6467" => "0"
}
Somehow the value of various OIDs is getting messed up...best example is the system name.
From the packet:
system.sysName.0="pro-pts"
In Logstash:
"SNMPv2-MIB::sysName.0" => "0\x82\x01\x00\x02\x01\x01"
I can successfully get the sysName of the server transmitting SNMP using snmpget on the Logstash server as follows:
[user@logstash-server mibs]$ sudo snmpget -v 2c -c public 172.16.1.13 SNMPv2-MIB::sysName.0
SNMPv2-MIB::sysName.0 = STRING: pro-pts
Has anyone seen this before? I discovered this while trying to integrate the MIBs from my element to make my OIDs human readable. I backed out everything to the point where it's the simple pipeline I pasted above, and it's still happening.
Any help would be much appreciated!
Geoff
