Skip to content

Instantly share code, notes, and snippets.

@rasputnik
Last active December 17, 2015 02:59
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 1 You must be signed in to fork a gist
  • Save rasputnik/5540456 to your computer and use it in GitHub Desktop.
Save rasputnik/5540456 to your computer and use it in GitHub Desktop.
dropping this into $pluginpath/logstash/inputs/trappy.rb works for me. Just populate an external directory, then point the plugin at it with a "yamlmibdir" config option.
require "logstash/inputs/base"
require "logstash/namespace"
# Read snmp trap messages as events
#
# Resulting @message looks like :
# #<SNMP::SNMPv1_Trap:0x6f1a7a4 @varbind_list=[#<SNMP::VarBind:0x2d7bcd8f @value="teststring",
# @name=[1.11.12.13.14.15]>], @timestamp=#<SNMP::TimeTicks:0x1af47e9d @value=55>, @generic_trap=6,
# @enterprise=[1.2.3.4.5.6], @source_ip="127.0.0.1", @agent_addr=#<SNMP::IpAddress:0x29a4833e @value="\xC0\xC1\xC2\xC3">,
# @specific_trap=99>
#
class LogStash::Inputs::Trappy < LogStash::Inputs::Base
config_name "trappy"
plugin_status "experimental"
# The address to listen on
config :host, :validate => :string, :default => "0.0.0.0"
# The port to listen on. Remember that ports less than 1024 (privileged
# ports) may require root to use. hence the default of 1062.
config :port, :validate => :number, :default => 1062
# SNMP Community String to listen for.
config :community, :validate => :string, :default => "public"
# directory of YAML MIB maps (same format ruby-snmp uses)
config :yamlmibdir, :validate => :string
def initialize(*args)
super(*args)
end # def initialize
public
def register
require "snmp"
@snmptrap = nil
if @yamlmibdir
@logger.info("checking #{@yamlmibdir} for additional MIBs")
Dir["#{@yamlmibdir}/*.yaml"].each do |yamlfile|
mib_name = File.basename(yamlfile, ".*")
@extra_mibs ||= []
@extra_mibs << mib_name
end
@logger.info("found MIBs: #{@extra_mibs.join(',')}") if @extra_mibs
end
end # def register
public
def run(output_queue)
LogStash::Util::set_thread_name("input|snmptrap|#{@community}")
begin
# snmp trap server
snmptrap_listener(output_queue)
rescue => e
@logger.warn("SNMP Trap listener died", :exception => e, :backtrace => e.backtrace)
sleep(5)
retry
end # begin
end # def run
private
def snmptrap_listener(output_queue)
traplistener_opts = {:Port => @port, :Community => @community, :Host => @host}
if !@extra_mibs.empty?
traplistener_opts.merge!({:MibDir => @yamlmibdir, :MibModules => @extra_mibs})
end
@snmptrap = SNMP::TrapListener.new(traplistener_opts)
@logger.info("It's a Trap!", traplistener_opts)
@snmptrap.on_trap_default do |trap|
begin
event = to_event(trap.inspect, trap.source_ip)
trap.each_varbind do |vb|
event[vb.name.to_s] = vb.value.to_s
end
@logger.debug("SNMP Trap received: ", :trap_object => trap.inspect)
output_queue << event if event
rescue => event
@logger.error("Failed to create event", :trap_object => trap.inspect)
end
end
@snmptrap.join
end # def snmptrap_listener
end # class LogStash::Inputs::Trappy
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment