This discussion has been locked. The information referenced herein may be inaccurate due to age, software updates, or external references.

You can no longer post new replies to this discussion. If you have a similar question you can start a new discussion in this forum.

Is there a way to change the formatting on an SNMP trap for an alert?

robotfish1911 over 9 years ago

I've got a wireless controller configured to send SNMP trap notifications to Kiwi. What I want to do is send out an alert via Kiwi Syslog whenever an access point either associates or disassociates with the controller, but the text that gets sent in the trap notification is too "busy" .. there's an oid in there, and a bunch of other text I am not interested in sending, in the alert.

Is there some way to delete what I don't need, and re-format the text in a more human readable alert?

Here is an example of an "AP Association" and an "AP disassociation." I have bolded the information that I consider the "relevant information" for the alert.

Disassociation:

community=public, enterprise=1.3.6.1.4.1.14179.2.6.3.8, enterprise_mib_name=bsnAPDisassociated, uptime=25757400, agent_ip=10.1.78.9, version=Ver2, bsnAPMacAddrTrapVariable.0=dΘP╕┘p, bsnAPName.0=Truck_Bay

Association:

community=public, enterprise=1.3.6.1.4.1.9.9.513.0.4, enterprise_mib_name=ciscoLwappApAssociated, uptime=25766600, agent_ip=10.1.78.9, version=Ver2, 1.3.6.1.4.1.9.9.513.1.1.1.1.5.100.233.80.184.217.112=Truck_Bay, 1.3.6.1.4.1.9.9.513.1.1.1.1.16.100.233.80.184.217.112=43, 1.3.6.1.4.1.9.9.513.1.1.1.1.36.100.233.80.184.217.112=0

0 bshopp over 9 years ago

What type of alert message do you want to send? You can setup a filter to look for the text you care about and then have an action to send an email for example with whatever text you want in it.
Cancel
Vote Up 0 Vote Down

Cancel
0 bkyle over 9 years ago

Building on what bshopp said, you can also make sure you have the correct MIBs added to Kiwi Syslog. This will give you a more readable message. For example instead of "1.3.6.1.4.1.9.9.513.1.1.1.1.5.100.233.80.184.217.112=Truck_Bay" You could receive text .
Cancel
Vote Up 0 Vote Down

Cancel
0 airsun over 9 years ago

Hi robotfish1911
First off, SNMP Traps can be divided into SNMP Trap fields. You can enable/disable SNMP Trap Fields from (File -> Setup -> Inputs -> SNMP).
Secondly, I don't see any email counters that identifies SNMP Trap fields by default. All email counters can be seen here. Hence, if you are going to email a SNMP Trap message, you can only use %MsgText counter and not SNMP Trap fields. In other words all SNMP fields enabled will be put in %MsgText counter.
So to answer your question, what I would do is to just enable SNMP Enterprise and Message fields then send this message through email.
Now, if you wanted to enable All SNMP Trap Fields and just email SNMP Enterprise and Message fields, this might be available by running script which will put the fields into VarCustomXX. But I will be honest with you, I haven't tried it since birth , but I am very interested to try it too. Let's wait for other Kiwi experts if they have other thoughts.
Hope it helps.
Cancel
Vote Up 0 Vote Down

Cancel