topic Re: SNMP trap - Topology type definition in Extensions

Topology type definition for the SNMP Trap

gautier_begin — Fri, 10 May 2024 13:56:00 GMT

Hello,

I have an application which is sending SNMP traps to Dynatrace. Dynatrace integrates them using the SNMPTrap extension.

I'ld like to customize the monitored entity according the information of the SNMPtrap. Unfortunately, my rule is not applied and I don't know why.

Could you please help.

SNMPtrap as captured by Dynatrace:

{

"event.type": "LOG",

"content": "SNMP trap (SNMPv2-SMI::enterprises.2190) reported from src:10.195.198.83\n agent:10.195.198.83",

"status": "NONE",

"timestamp": "1712737774254",

"loglevel": "NONE",

"dt.ingest.warnings": "processing_prepare_input_error",

"log.source": "snmptraps",

"snmp.trap_oid": "SNMPv2-SMI::enterprises.2190",

"snmpv2-smi::enterprises.2190.166.4000.1.2": "VTOM_EXPLOIT_PPD/UTILITAIRE_VTOM/test ERRE",

"device.address": "10.195.198.83",

"dt.entity.snmptraps:com_dynatrace_ext_snmp-traps": "CUSTOM_DEVICE-57583FB2E29A224C",

"snmp.version": "1"

}

The topolgy type definition:

[

{

"schemaId": "builtin:monitoredentities.generic.type",

"schemaVersion": "1.0.77",

"scope": "environment",

"value": {

"enabled": true,

"name": "snmptraps:vtom",

"displayName": "VTOM SNMP Trap",

"createdBy": "gbegin",

"rules": [

{

"idPattern": "Job_{snmpv2-smi::enterprises.2190.166.4000.1.2}",

"instanceNamePattern": "VTOM Job {snmpv2-smi::enterprises.2190.166.4000.1.2}",

"iconPattern": null,

"sources": [

{

"sourceType": "Logs"

}

"requiredDimensions": [

{

"key": "snmp.trap_oid",

"valuePattern": "$eq(SNMPv2-SMI::enterprises.2190)"

{

"key": "log.source",

"valuePattern": "$eq(snmptraps)"

}

"attributes": [

{

"key": "dt.ip_addresses",

"displayName": "Device Address",

"pattern": "{device.address}"

{

"key": "vtom_job",

"displayName": "VTOM Job Name",

"pattern": "{snmpv2-smi::enterprises.2190.166.4000.1.2}"

}

"role": null

}

]

}

]

Regards

Re: SNMP trap - Topology type definition

Mike_L — Thu, 11 Apr 2024 11:57:17 GMT

I don't see anything obviously wrong with the configuration. Please create a support ticket as I remember there being some issues of using :: in the past.

Re: SNMP trap - Topology type definition

gautier_begin — Thu, 25 Apr 2024 09:39:49 GMT

Hi,

I found it.

I first created a Log processing rule:

In the field processor definition, the column name to be used is not the JSON field given by the log monitoring but the value sent by the trap. The difference is that in the JSON, the column name is always lower case. The data sent by the trap is a mix lower/upper case.

Rule name: [SNMPTrap] snmptraps:vtom:job

Matcher: snmp.trap_oid = "VTOMASN1MODULE::absyss"

Processor definition:

USING(INOUT "VTOMASN1MODULE::absyss.166.4000.1.2")
| FIELDS_RENAME(snmp.vtom.job: COLUMN("VTOMASN1MODULE::absyss.166.4000.1.2"))

Log sample:

{
"event.type": "LOG",
"content": "SNMP trap (VTOMASN1MODULE::absyss) reported from src:10.195.198.83\n agent:10.195.198.83",
"status": "NONE",
"timestamp": "1713272276183",
"loglevel": "NONE",
"dt.ingest.warnings": "processing_prepare_input_error",
"log.source": "snmptraps",
"snmp.trap_oid": "VTOMASN1MODULE::absyss",
"device.address": "10.195.198.83",
"vtomasn1module::absyss.166.4000.1.2": "CACEIS_PPD/FDS/CHECK_COR_2 ERRE",
"snmp.version": "1"
}

Rk: The Rule test is not working. It is not taking into account this lower case issue.

Then I create this topology rule:

[
{
"schemaId": "builtin:monitoredentities.generic.type",
"schemaVersion": "1.0.77",
"scope": "environment",
"value": {
"enabled": true,
"name": "vtom:snmptrap",
"displayName": "VTOM SNMP Trap",
"createdBy": "gbegin",
"rules": [
{
"idPattern": "job_{snmp.vtom.job}",
"instanceNamePattern": "VTOM Job {snmp.vtom.job}",
"iconPattern": null,
"sources": [
{
"sourceType": "Logs"
}
],
"requiredDimensions": [
{
"key": "snmp.trap_oid",
"valuePattern": "$eq(VTOMASN1MODULE::absyss)"
}
],
"attributes": [],
"role": null
}
]
}
}
]

Regards