Re: snmptrapd forwarding with OID wildcards [SEC=UNCLASSIFIED]

On Thu, May 03, 2007 at 10:40:53AM +1000, Hart, Matthew MR 2 wrote:
> Thanks Wayne,
> 
> We use a big correlation engine here (not open-source unfortunately),
> but we wanted to filter out the superflous messages before they get to
> it (our setup is too large to send every single event to the central
> correlation engine and let it sort them out). Now that the Dave S. has
> added the wildcard functionality to snmptrapd, we should be able to do
> some simple filtering. I'll have a hunt around for more advanced methods
> of filtering traps when the need arises :)

> -----Original Message-----
> [mailto:net-snmp-users-bounces at lists.sourceforge.net] On Behalf Of
> Tackabury, Wayne
> Sent: Tuesday, 1 May 2007 23:12
> Subject: RE: snmptrapd forwarding with OID wildcards [sec:unclass]
> 
> 
> 
> -----Original Message-----
> >In the meantime, does anyone know about a tool available that can do 
> >what I'm trying to achieve (forward traps to a different server, if the
> 
> >OID matches a pattern with wildcards)?
> 
> We didn't find one in a fair amount of looking (through open source
> options, anyways).  Moreover, while we were looking, as much as we tried
> to constrain the use case to *just* being about OID's, or issuing agent
> address, we always found some new condition which became an essential
> constraint for forwarding.
> 
> This falls under the general rubric of "event correlation", and we ended
> up writing our own little policy rule manager to take this on.  I do
> know of certain open source rules engines (e.g., Jess Rules for Java)
> that provide a lot of what you need for that if you can write the event
> handler (incoming trap), condition handler and matcher (does an included
> varbind match this OID?) and action handler (forward to this other trap
> recipient).
> 
> On the other hand, there's a fair of adaptation of the gestalt of any
> open source rules engine to meet this kind of relatively minimal
> application, I've found.

I don't know if you folks have looked at using SEC (Simple Event
Correlator), but people have used it for just such event correlation.
If I remember properly somebody successfully used snmptrap called from
SEC to forward traps. There may even be an example in the SEC mailing
list archives.

-- 
				-- rouilj

John Rouillard
System Administrator
Renesys Corporation
603-643-9300 x 111

-------------------------------------------------------------------------
This SF.net email is sponsored by DB2 Express
Download DB2 Express C - the FREE version of DB2 express and take
control of your XML. No limits. Just data. Click to get it now.
http://sourceforge.net/powerbar/db2/
_______________________________________________
Net-snmp-users mailing list
[email protected]
Please see the following page to unsubscribe or change other options:
https://lists.sourceforge.net/lists/listinfo/net-snmp-users