-
Title
Snmptrap messages not getting processed by syslog ng -
Description
snmptrap messages (SMI v1) are being received but the messages are not parsed in syslog-ng.
The following error is reported in the system logs
++++++++
Error: (snmptrapd-parser failed; error='cannot parse snmptrapd header', input='TRAP, SNMP v1).++++++++
-
Cause
The snmptrapd configuration file is not configured correctly for v1 traps. -
Resolution
Update the snmptrapd configuration file to include the following format string. It’s a prerequisite for v1 traps.
snmptrapd:format1 %.4y-%.2m-%.2l %.2h:%.2j:%.2k %B [%b]: %N\n\t%W Trap (%q) Uptime: %#T\n%v\nFor SMI v2 traps, the snmptrap() source of syslog-ng PE expects the following default format to be used.
format2 %.4y-%.2m-%.2l %.2h:%.2j:%.2k %B [%b]:\n%v\n
After changing from format 1 to 2 or vis-a-versa, the snmptrapd service must be restarted for the changes to take effect.
# systemctl restart snmptrapd