extract ip from the variable of a trap

[oslec]

Hi,

we have the following trap

Fri Nov 8 12:00:01 2024 .1.3.6.1.4.1.10377.300.2.0.1 Normal "Status Events" UDP10 - Received trap "omNotificationRaise" with variables "enterprises.10377.300.1.1.1.1.528859:528859
enterprises.10377.300.1.1.1.2.528859:sdb01.her.telcel.ommx/10.24.99.200
enterprises.10377.300.1.1.1.3.528859:/North-America/Mexico/America-Movil/Hermosillo
enterprises.10377.300.1.1.1.4.528859:1
enterprises.10377.300.1.1.1.5.528859:Free disk space on /var/log (percentage)
enterprises.10377.300.1.1.1.6.528859:5
enterprises.10377.300.1.1.1.7.528859:2024-11-08 12:00:01
enterprises.10377.300.1.1.1.8.528859:Free disk space is less than 20% on volume /var/log
enterprises.10377.300.1.1.1.9.528859:Free disk space is less than 20% on volume /var/log"

but the IP that sent the trap is not the affected device

the ip is received in variable 2:
enterprises.10377.300.1.1.1.2.528859:sdb01.her.telcel.ommx/10.24.99.200

How can I pass the IP in that variable to a passive service?

As you can see, hostname and ip are sent in variable 2

Thanks

[DoubleDoubleA]

Hi @oslec,

It should be possible to run a script to isolate the IP address using a PREEXEC in the snmptt config https://snmptt.sourceforge.net/docs/snm ... NF-PREEXEC

Then the IP address can be passed to XI.

Is there a trap forwarder between the device and XI?

Aaron