0

I have some Windows PCs sending snmpt traps to a linux server. On the server a snmptt trap handler, that works fine except for one issue.

Windows sends out traps with a description (say "Adobe Flash player update service stopped"). My problem is I don't know how to receive this description. Using snmptt (link to doc page), I only get the trapoid,community, category, uptime, hostname, etc, but no description.

Problem is that the Windows trapOID only states that "a service has been stopped". You understand that this is not a very useful info.

With tcpdump I can see the trap coming:

> { SNMPv1 C=dst0pc10 { Trap(298) 
> E:311.1.13.1.23.83.101.114.118.105.99.101.32.67.111.110.116.114.111.108.32.77.97.110.97.103.101.114 78.168.1.161 enterpriseSpecific s=1073748860 1213932 E:311.1.13.1.9999.1.0=49_6c_20_73_65_72_76_69_7a_69_6f_20_48_50_20_50_6f_72_74_20_52_65_73_6f_6c_76_65_72_20_e8_20_6f_72_61_20_69_6e_20_6d_6f_64_61_6c_69_74_e0_20_61_72_72_65_73_74_61_74_6f_2e_0d_0a
> E:311.1.13.1.9999.2.0="Unknown" E:311.1.13.1.9999.3.0="PCMAGA"
> E:311.1.13.1.9999.4.0="4" E:311.1.13.1.9999.5.0="0"
> E:311.1.13.1.9999.6.0="HP Port Resolver"
> E:311.1.13.1.9999.7.0="stopped" } }

I have big difficulties in understanding how to receive and log those descriptions. Any clue?

Roberto Casalegno
  • 55
  • 8

1 Answers1

0

Ok, posting a question here usually boost my luck. I've found this simple answer: In snmptt.conf file, the FORMAT directive could be set as

FORMAT $*

to put all the description in the "formatline" field of the database generated by snmptt. Another problem arise, hope I can work it out soon: some descrption are in HEX format. Got to find a way to convert them.

Roberto Casalegno
  • 55
  • 8