Setup SNMPTT in Ubuntu 8.10 for traps to go to MySQL

Download from here: http://sourceforge.net/projects/snmptt/files/ Basic installing from here (with exceptions below): http://snmptt.sourceforge.net/docs/snmptt.shtml#Installation-Unix Found some of the paths not right for Ubuntu such as: cp snmptt.init.d to /etc/rc.d/init.d/snmptt should be cp snmptt.init.d to /etc/init.d/snmptt 9.4. I see following error: Can't locate Config/IniFiles.pm in @INC ...What should I do? It's likely that you don't have required Perl modules installed. In this case it's Config::IniFiles that is missing. The easiest way to install Perl modules is to use CPAN extension, eg. perl -MCPAN -e 'install Config::IniFiles'. From here: http://www.secit.at/doc/snmptt-1.0/html/faqs.html Q: Why doesn't the snmptt-init.d script work with Debian? The snmptt-init.d script provided with SNMPTT was written for Mandrake and RedHat. To make the script work with Debian without requiring any re-writing of the script, copy /etc/init.d/skeleton to /etc/init.d/functions. Database setup here: http://snmptt.sourceforge.net/docs/snmptt.shtml#LoggingDatabase-MySQL Put this line in your /etc/rc.local file: /usr/sbin/snmptrapd -f -Lo -On Whenever system starts, rc.local is the last file which system checks before loading. Testing Get this going in a terminal window so you can see the raw UDP data. WARNING: Even though you see the packets here they may still be getting rejected by your firewall. tcpdump -i tun0 port 162 Add this to /etc/snmp/snmptrapd.conf disableAuthorization yes Run this snmptrapd -P -F "%02.2h:%02.2j TRAP%w.%q from %A\n" And then this: snmptrap -v 1 -c public localhost 1.2.3.4 localhost 3 0 ’’ 1.2.3.4 i 1 You should see some output. So I thought I was pretty much home and hosed on this one, but after stuffing around for another two days (I'm talking a solid 16 hours) and getting pretty much nowhere as even as I write this, I feel like I must be missing some critical tutorial or something to get this stuff going!! Anyway here is another article I tried to follow, but still no luck. http://www.sage.org/lists/sage-members-archive/2005/msg03326.html Finally figured it out, even though I could see the SNMP traps using tcpdump they had not yet been parsed by the firewall!! So they were hitting the server but getting rejected by the firewall. After editing the snmptrapd.conf and adding these two lines: disableAuthorization yes traphandle default /usr/sbin/snmptt I see now see the traps hitting the snmp logs: $ tail -f /var/log/snmptt/snmpttunknown.log. So the next step is to notify your php parsing code that a trap occured. This was pretty basic in the end, but took a bit of stuffing around, so here are some tips on how I did it. 1) Edit snmptrapd.conf $ nano /etc/snmp/snmptrapd.conf Should look something like this: disableAuthorization yes traphandle default /usr/sbin/snmptt traphandle default /var/www/foo/bar/traps 2) Create a shell script called traps which is executable like the following to call a php file. #!/bin/sh # May need to allow time for the trap to hit the SQL table. sleep 1 php -f /var/www/foo/bar/parse_snmp_traps.php $ sudo chmod +x /var/www/foo/bar/traps 3)Don't forget to restart snmpd service after making conf changes. $ sudo /etc/init.d/snmpd restart 4) Create a php file called parse_snmp_traps.php to do the business. 5) Test it. Could use this by raising a trap.