[ZBX-5528] SNMPtrap.regexp() is unreliable Created: 2012 Aug 31  Updated: 2017 May 30  Resolved: 2012 Aug 31

Status: Closed
Project: ZABBIX BUGS AND ISSUES
Component/s: Server (S)
Affects Version/s: 2.0.2
Fix Version/s: None

Type: Incident report Priority: Major
Reporter: ojab Assignee: Unassigned
Resolution: Won't fix Votes: 0
Labels: snmptraps, triggers
Remaining Estimate: Not Specified
Time Spent: Not Specified
Original Estimate: Not Specified
Environment:

FreeBSD-8.2

Attachments: Text File pgw_linkupdown.txt     File trap.sh     Text File zbx_events.txt     Text File zbx_items.txt    

 Description   

I'm trying to handle Cisco PGW2200 traps about links UpDown and such things.

I've created basically:
Item of type SNMP Trap, Key is `snmptrap[CISCO-TRANSPATH-MIB::tpCompMMLName.1900545]` in order to handle all traps related
to one PGW object (link in this case)
Trigger looks like (I know that it isn't working, the purpose is to show the issue):
`(

{TRIGGER.VALUE}=0&{pgw:snmptrap[CISCO-TRANSPATH-MIB::tpCompMMLName.1900545].regexp(CISCO-TRANSPATH-MIB::tpAlarmSet.0)}=1)|({TRIGGER.VALUE}

=1&

{pgw:snmptrap[CISCO-TRANSPATH-MIB::tpCompMMLName.1900545].regexp(CISCO-TRANSPATH-MIB::tpAlarmSet.0)}

=0)`

The issue is trigger switching on receiving link Up trap, so it goes from OK to Problem on first trap and from Problem to OK on second.
AFAIU it's possible only if regexp is False (=0) on first trap and True (=1) on second, which is impossible.

Related MIB can be found at http://www.cisco.com/iam/PGW_MIBS/973/tp.my , it's actually not completely correct, but can be used to convert numeric OID to text for the readability sake.

trap.sh is script to send traps using net-snmp (commuity is 'public', zabbix IP is 10.1.2.30, can be changed in the source). Usage: `./trap.sh up` for linkUp trap, `./trap.sh down` for linkDown trap.

pgw_linkupdown.txt contains linkDown and linkUp traps from zabbix log, sent by PGW.

Up and Down traps are different in one line/value:
tpAlarmSet OBJECT-TYPE
SYNTAX INTEGER

{ clear (1), set (2) }

MAX-ACCESS not-accessible
STATUS current
DESCRIPTION
"The alarm set or not."
::=

{tpAlarmObject 5}

 Comments   
Comment by ojab [ 2012 Aug 31 ]

$ php -v
PHP 5.3.5 with Suhosin-Patch (cli) (built: Mar 16 2012 09:48:31)
Copyright (c) 1997-2009 The PHP Group
Zend Engine v2.3.0, Copyright (c) 1998-2010 Zend Technologies

Comment by richlv [ 2012 Aug 31 ]

too much unrelated information. please, show item values and corresponding events for the time period you believe it is working incorrectly.

Comment by ojab [ 2012 Aug 31 ]

Basically: Trigger is in OK state -> 12:06:56 receiving linkUP trap -> Trigger in Problem state -> 12:07:02 receiving linkUP trap -> Trigger in OK state.
Because of the same expression in .regexp() it's only possible if traps are different which is not true.

Comment by richlv [ 2012 Aug 31 ]

that seems to be totally ok to me. your trigger expression tells it to be in problem state :

(if trigger is ok and we have a regexp match)
OR
(if trigger is problem and we have no regexp match)

so the events are generated as follows :
trigger is in ok state. value comes in. there's a regexp match. first clause is matched -> problem
trigger is in problem state. value comes in. there's a regexp match. no clause is matched -> ok

in the second case no clause is matched because :
first doesn't match as trigger is not in ok state;
second does not match as there is a regexp match

Comment by ojab [ 2012 Aug 31 ]

Ouch! Thanks, my fault, closing.

Generated at Sun Apr 06 04:06:34 EEST 2025 using Jira 9.12.4#9120004-sha1:625303b708afdb767e17cb2838290c41888e9ff0.