Snmptrapd trap handler

I've written a replacement for the traptoemail script that is
distributed with the net-snmp package for use with the snmptrapd.

In addition to the functionality provided by traptoemail (reporting
traps via email), it logs the traps in two trees, sorted by date.  One
tree is organized by hostname, the other is organized by trap type.
We find this useful for browsing the traps with a web browser,
allowing us to see what traps a host sent on a given day, or, for
example, seeing which hosts reported VTP
vlanTrunkPortDynamicStatusChange events around the same time.

In addition, it provides some basic filtering of traps, allowing
certain events to be picked out, based on, for example, hostname,
switch port, mac address, etc.  It can then send email as as a
response to a filter match.  This has been used to watch for machine's
MAC address appearing somewhere on our network, or alarming on link
state changes on specific switch ports.  Our philosophy of traps is to
log everything but only send mail on significant events, and the
filtering helps restrain the deluge that can occur.

The filtering can also specify to not send email because of a filter
match.  We sometimes run into pathological cases that generate
excessive traps, such as port security violations.  The filtering
allows us to be notified of port security violations for all ports
except a select few.

In our environment it logs and filters on the order of 25K traps per
day from around 500 machines without adding any noticable load to our
trap receiver, which is a 650mhz Solaris 5.8 machine with Net-SNMP
5.1.1.

I have compiled it under Solaris 5.8, Linux 2.4, and FreeBSD 4.10, and
it should be fairly portable across other unix-like platforms.

If anyone's interested in trying it out then I can provide source, or
binaries for the above mentioned machines.


-------------------------------------------------------
This SF.net email is sponsored by: Splunk Inc. Do you grep through log files
for problems?  Stop!  Download the new AJAX search engine that makes
searching your log files as easy as surfing the  web.  DOWNLOAD SPLUNK!
http://ads.osdn.com/?ad_id=7637&alloc_id=16865&op=click
_______________________________________________
Net-snmp-users mailing list
[email protected]
Please see the following page to unsubscribe or change other options:
https://lists.sourceforge.net/lists/listinfo/net-snmp-users