class LogStash::Inputs::Snmptrap

Read snmp trap messages as events

Resulting `@message` looks like :

source,ruby

#<SNMP::SNMPv1_Trap:0x6f1a7a4 @varbind_list=[#<SNMP::VarBind:0x2d7bcd8f @value=“teststring”, @name=>], @timestamp=#<SNMP::TimeTicks:0x1af47e9d @value=55>, @generic_trap=6, @enterprise=, @source_ip=“127.0.0.1”, @agent_addr=#<SNMP::IpAddress:0x29a4833e @value=“xC0xC1xC2xC3”>, @specific_trap=99>

Public Class Methods

new(*args) click to toggle source
Calls superclass method
# File lib/logstash/inputs/snmptrap.rb, line 34
def initialize(*args)
  super(*args)
end

Public Instance Methods

register() click to toggle source
# File lib/logstash/inputs/snmptrap.rb, line 38
def register
  @snmptrap = nil
  if @yamlmibdir
    @logger.info("checking #{@yamlmibdir} for MIBs")
    Dir["#{@yamlmibdir}/*.yaml"].each do |yamlfile|
      mib_name = File.basename(yamlfile, ".*")
      @yaml_mibs ||= []
      @yaml_mibs << mib_name
    end
    @logger.info("found MIBs: #{@yaml_mibs.join(',')}") if @yaml_mibs
  end
end
run(output_queue) click to toggle source
# File lib/logstash/inputs/snmptrap.rb, line 51
def run(output_queue)
  begin
    # snmp trap server
    snmptrap_listener(output_queue)
  rescue => e
    @logger.warn("SNMP Trap listener died", :exception => e, :backtrace => e.backtrace)
    Stud.stoppable_sleep(5) { stop? }
    retry if !stop?
  end # begin
end
stop() click to toggle source
# File lib/logstash/inputs/snmptrap.rb, line 62
def stop
  @snmptrap.exit unless @snmptrap.nil?
  @snmptrap = nil
end

Private Instance Methods

build_trap_listener() click to toggle source
# File lib/logstash/inputs/snmptrap.rb, line 69
def build_trap_listener
  traplistener_opts = {:Port => @port, :Community => @community, :Host => @host}
  if @yaml_mibs && !@yaml_mibs.empty?
    traplistener_opts.merge!({:MibDir => @yamlmibdir, :MibModules => @yaml_mibs})
  end
  @logger.info("It's a Trap!", traplistener_opts.dup)
  @snmptrap = SNMP::TrapListener.new(traplistener_opts)
end
snmptrap_listener(output_queue) click to toggle source
# File lib/logstash/inputs/snmptrap.rb, line 78
def snmptrap_listener(output_queue)
  build_trap_listener

  @snmptrap.on_trap_default do |trap|
    begin
      event = LogStash::Event.new("message" => trap.inspect, "host" => trap.source_ip)
      decorate(event)
      trap.each_varbind do |vb|
        event.set(vb.name.to_s, vb.value.to_s)
      end
      @logger.debug("SNMP Trap received: ", :trap_object => trap.inspect)
      output_queue << event
    rescue => event
      @logger.error("Failed to create event", :trap_object => trap.inspect)
    end
  end
  @snmptrap.join
end