In my opinion Zabbix is a really good NMS, but it’s lacking on SNMP traps handling.
Traps can be received using Net-SNMP suite and snmptrap.sh, a script released within the misc directory of Zabbix.
This is how it works: snmptrapd starts listening on port UDP 162, receives traps and sends them to a handler, which runs the script and pass trap information to its standard input. Finally, the script runs zabbix_sender to send information to the Zabbix server. On Zabbix, you can setup a fake Host with an Item of type “ZABBIX Trapper”: in the original script, both host and item’s key are referenced as snmptraps.
It works! The problem is that, whatever the sender is, trap data is always binded to one host: snmptraps.
zabbix_sender, used to send traps information to the server, can’t translate IP address to hostname:
# ./zabbix_sender -h
ZABBIX send v1.6.2 (16 January 2009)
usage: zabbix_sender [-Vhv] {[-zpsI] -ko | [-zpI] -i } [-c ]
Options:
[cut]
-s --host <Hostname> Specify host name.
Host IP address and DNS name will not work.
[cut]
So, we need to translate the sender’s IP address to its Zabbix hostname, in order to runs zabbix_sender with the right -s option value.
I make a very simple script to build an { IP / Zabbix hostname } file, using mysql client:
DST="/home/zabbix/zabbix-1.6.2/misc/snmptrap/zabbixhosts" mysql --batch --silent -e "SELECT CONCAT( '[', IP, ']', Host ) FROM zabbix.hosts WHERE IP <> '' AND IP <> '0.0.0.0'" > $DST
Running this script every 30 minutes I have a file containing pairs of IP/HostName such these:
[192.168.0.1]MYWEBSERVER [192.168.0.2]MYMAILSERVER
With few changes to the original script I can send traps to the right Zabbix host, grabbing the hostname from the mySql dump (zabbixhosts):
# CONFIGURATION ZABBIX_SERVER="127.0.0.1"; ZABBIX_PORT="10051"; # path to zabbix_sender ZABBIX_SENDER="/home/zabbix/zabbix-1.6.2/src/zabbix_sender/zabbix_sender"; # path to zabbixhosts, containing IP/hostname pairs ZABBIX_HOSTSFILE="/home/zabbix/zabbix-1.6.2/misc/snmptrap/zabbixhosts" # item key used to grab snmp data KEY="snmptrap"; # used if the script can't find the hostname DEFAULTHOST="Default_Trapper"; # END OF CONFIGURATION read hostname read ip read uptime read oid read var1 read var2 read var3 oid=`echo $oid|cut -f2 -d' '` # get hostname from the mySql dump ZABBIX_HOST=`grep "[$hostname]" $ZABBIX_HOSTSFILE` if [ $? -eq 0 ]; then hostname=`echo "$ZABBIX_HOST" | cut -f2 -d]` else hostname="$DEFAULTHOST" fi str="$oid $var1 $var2 $var3" result=`$ZABBIX_SENDER -z $ZABBIX_SERVER -p $ZABBIX_PORT -s $hostname -k $KEY -o "$str"`
With this script you need an Item with type=”ZABBIX Trapper” and key=”snmptrap” for each host you want trap handling. You can also create a template and attach it to hosts you want to monitor.
You can create triggers based on snmp trap content as you want.
I use crontab to update the IP-to-hostname file two times each hour.