Snmptrap input sample messages

(Krishna Chaitanya) #1


I am trying out Logstash's snmptrap input plugin to send snmptrap messages to Elasticsearch. I don't have SNMP agent installed on my machine. But, I am trying to generate sample SNMP trap messages using Netcat, but this is causing errors.

Below are my configs:

  1. Logstash (version 5.4.0 -> running as root):

snmptrap {type => "snmptrap" community => "public" host => "" port => 162 yamlmibdir => "/usr/share/logstash/vendor/bundle/jruby/1.9/gems/snmp-1.2.0/data/ruby/snmp/mibs" }

  1. Sending sample UDP message using netcat (I got this sample message from here):

echo -n '1999-11-12 23:26:07 localhost [] UCD-TRAP-TEST-MIB::demotraps: Enterprise Specific Trap (demoTrap) Uptime: 1 day, 5:34:06 SNMPv2-MIB::sysLocation.0 = "Just here"' | nc -4u -w1 localhost 162

Logstash was unable to process this sample message, below is the error:

Error handling trap: 50
/usr/share/logstash/vendor/bundle/jruby/1.9/gems/snmp-1.2.0/lib/snmp/ber.rb:190:in `decode_sequence'
/usr/share/logstash/vendor/bundle/jruby/1.9/gems/snmp-1.2.0/lib/snmp/pdu.rb:49:in `decode'
/usr/share/logstash/vendor/bundle/jruby/1.9/gems/snmp-1.2.0/lib/snmp/manager.rb:707:in `process_traps'
org/jruby/ `loop'
/usr/share/logstash/vendor/bundle/jruby/1.9/gems/snmp-1.2.0/lib/snmp/manager.rb:704:in `process_traps'
/usr/share/logstash/vendor/bundle/jruby/1.9/gems/snmp-1.2.0/lib/snmp/manager.rb:631:in `initialize'
Received data:
"2017-10-06 23:26:07 localhost [] TRAP-TEST-MIB::demotraps:Enterprise Specific Trap (demo-trap) Uptime: 1 day, 5:34:06SNMPv2-MIB::sysLocation.0 = \\\"Just here\\\" "

I also tried to send sample message that was posted here. But, got same error.

Any help on how to produce a sample snmptrap messages which could be parsed by logstash snmptrap input plugin?

(Krishna Chaitanya) #2

Any help on this ?

(system) #3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.