fluent-plugin-snmptrap is an input plug-in for Fluentd. It works with Fluentd v1.0 and later.
These instructions assume you already have fluentd installed. If you don't, please run through [quick start for fluentd] (https://github.com/fluent/fluentd#quick-start)
Now after you have fluentd installed you can follow either of the steps below:
Add this line to your application's Gemfile:
gem 'fluent-plugin-snmptrap'
Or install it yourself as:
$ gem install fluent-plugin-snmptrap
Add the following into your fluentd config.
<source>
type snmptrap # required, chossing the input plugin.
host 127.0.0.1 # optional, interface to listen on, default 0 for all.
port 162 # optional, port to listen for traps, default is 1062
# ports under 1024 range will require sudo to start fluentd
# ports 1062,1063 # optional, alternative to "port" for listening on
# multiple ports
tag alert.snmptrap # optional, tag to assign to events, default is alert.snmptrap
mib_dir /path/to/mibs # optional, directory containing MIB files
mib_modules SNMPv2-SMI,SNMPv2-MIB # optional, comma separated modules to load
</source>
<match alert.snmptrap>
type stdout
</match>
Now startup fluentd
$ sudo fluentd -c fluent.conf &
Send a test trap using net-snmp tools
& sudo snmptrap -v 1 -c public localhost:1062 1.3.6.1.4.1.10300.1.1.1.12 localhost 3 0 ''
When emit_event_format is set to record, a trap like the one above will be
emitted as a structured record:
{
"source_ip": "127.0.0.1",
"enterprise": "1.3.6.1.4.1.10300.1.1.1.12",
"oid": "1.3.6.1.4.1.10300.1.1.1.12",
"name": "SNMPv2-SMI::enterprises.10300.1.1.1.12",
"specific_trap": 0,
"generic_trap": "enterpriseSpecific",
"varbind": {}
}Things left to do, not in any particular order.
- snmp-trap output plug-in that exposes common fields and lets them be overwritten before forwarding.
This project is licensed under the MIT License.