How to process SNMP traps with Sensu

sensusnmpsystem-monitoring

We are evaluating monitoring systems with Sensu being one of the candidates. One requirement we have is processing of the SNMP traps.

My searches come up with Sensu-extensions only, but the extensions are from third parties and not even available via gem.

Can Sensu process SNMP traps — either out of the box or with a common and free extension?

Best Answer

There appear to be two primary open and free methods for accepting SNMP traps via Sensu:

They both appear to operate in a similar manner (by receiving SNMP and translating the source of the message into a Sensu Just In Time Client, and creating a Sensu event from the message.

Related Solutions

Looking for an automated method to install and configure SNMP on servers

For Windows Server 2008, you can use OCSETUP.EXE. See more at: http://support.microsoft.com/kb/936209

For Windows Server 2003, you can use SYSOCMGR. Put the following lines into a file (I'm calling mine "snmp.txt"):

[Components]
netoc = on
[NetOptionalComponents]
SNMP = 1

Then, call SYSOCMGR as an Administrator (or as SYSTEM-- this absolutely does work from an AD startup script):

SYSOCMGR /i:%SystemRoot%\inf\sysoc.inf /u:snmp.txt

(This assumes you're calling SYSOCMGR from the same directory as snmp.txt.)

I've done this all the time w/ Windows XP, and it worked fine in a VM that I just tested w/ W2K3. Be sure the Windows source files are accessible in the location SYSOCMGR looks by default or the install will hang asking for them.

Edit: Reversed /u and /i in command line example. I am an idiot!

Solution to route/proxy SNMP Traps (or Netflow, generic UDP, etc) for network monitoring

A co-worker just showed me samplicator. This tool looks to be just about a perfect solution what I was looking for. From the tool's website:

This simple program listens for UDP datagrams on a network port, and sends copies of these datagrams on to a set of destinations. Optionally, it can perform sampling, i.e. rather than forwarding every packet, forward only 1 in N. Another option is that it can "spoof" the IP source address, so that the copies appear to come from the original source, rather than the relay. Currently only supports IPv4.

It can been used to distribute e.g. Netflow packets, SNMP traps (but not informs), or Syslog messages to multiple receivers.

Best Answer

Related Solutions

Looking for an automated method to install and configure SNMP on servers

Solution to route/proxy SNMP Traps (or Netflow, generic UDP, etc) for network monitoring

Related Topic