Page 1 of 1
Snmp v3
Posted: Mon Mar 25, 2019 12:53 pm
by benhank
Hey guys!
Iv'e read this info about snmp but it doesn't say much for setting up snmp V3:
Code: Select all
https://www.elastic.co/guide/en/logstash/2.2/plugins-inputs-snmptrap.html
So my question is how do you set up NLS to receive snmp V3 traps?
Re: Snmp v3
Posted: Mon Mar 25, 2019 1:41 pm
by scottwilkerson
This doesn't appear to be available in any version of the logstash plugin.
Re: Snmp v3
Posted: Mon Mar 25, 2019 4:00 pm
by benhank
SON of a biscuit!
Well, let me ask it this way: If a server is configured with snmp v3 to SEND to the logserver, all the log server needs is to be listening on the correct port :
Code: Select all
tcp {
type => 'snmptrap'
port => 162
}
udp {
type => 'snmptrap'
port => 162
}
to receive the traps right?
Re: Snmp v3
Posted: Mon Mar 25, 2019 4:50 pm
by scottwilkerson
I believe you would need to have the receiver able to decode the v3 traps unfortunately, if someone else has any suggestions I am willing to be wrong on this one
Re: Snmp v3
Posted: Tue Mar 26, 2019 11:38 am
by benhank
say that gives me an idea.
What if I configure the os itself to receive and decode the traps, and then have the logserver read the traps afterwards?
Re: Snmp v3
Posted: Tue Mar 26, 2019 12:07 pm
by scottwilkerson
Now you're thinking! That should work fine.
Re: Snmp v3
Posted: Tue Mar 26, 2019 12:43 pm
by benhank
excellent!
now can you show me how to do it?
and yes you win the bet that I was gonna ask =D
Re: Snmp v3
Posted: Tue Mar 26, 2019 12:52 pm
by scottwilkerson
This is where is gets a bit tricky, but basically you would setup snmptrapd on the server, then setup logging to a file
see snmptrapd Logging section here
https://support.nagios.com/kb/article.php?id=88
finally, add a file input to your Log Server configuration to pull
/var/log/snmptrapd.log along with a filter to parse the traps
Re: Snmp v3
Posted: Tue Mar 26, 2019 12:54 pm
by benhank
Gotcha you can lock it. and thanks!
Re: Snmp v3
Posted: Tue Mar 26, 2019 1:00 pm
by scottwilkerson
benhank wrote:Gotcha you can lock it. and thanks!
Locking thread