Contact our honeypot department if you are desperate to get blacklisted.

Tuesday, September 20, 2011

Displaying Interface descriptions in SNMP traps using SNMPTT's PREXEC funtion

I collect snmp traps via snmptrapd which then hands them off to snmptt. Upon receipt of an interface down/up trap (.1.3.6.1.6.3.1.1.5.3, for example) snmptt then runs a quick snmpget request (unfortunately using SNMPv1 at the moment) to the reporting host to pull the description for the given interface like so:
EVENT ciscoConfigManEventDN .1.3.6.1.6.3.1.1.5.3 "Status Events" Normal
# use snmpget to fetch the interface description and save it as $p1, to be used it the FORMAT line.
PREEXEC /usr/bin/snmpget -v 1 -t 2 -Ovq -c snmptt $aA ifAlias.$1
FORMAT Link DOWN $2 - $p1
# OPTIONAL: do not process this event for VI interfaces (like PPPoE interfaces)
MATCH $2:!(Virtual-Access)
MATCH $2:!(Multilink)
MATCH MODE=and
#
EXEC /root/bin/sendemail.sh high traps@mydomain.com "ALERT-$s-$R-$Fz" "Agent $A at $aA reports $Fz$FnTrap $e:$D$Fn"


Note that I've created a special SNMP VIEW and community one our routers which allow access only to the ifAlias.* OID tree like so:
snmp-server view snmptt ifXEntry.* included
! note that ACL99 includes my snmp NMS only!
snmp-server community snmptt view snmptt RO 99