SNMPTRAPD(8)

💖 NAME 💖

okay bestie, gather round — snmptrapd is the girl who just receives and logs SNMP trap messages. that's her whole job. she catches them, she writes them down. iconic behavior honestly. ✨

---

🎀 SYNOPSIS 🎀

snmptrapd [OPTIONS] [LISTENING ADDRESSES]

---

🌸 DESCRIPTION 🌸

so like, snmptrapd is an SNMP application that receives and logs SNMP TRAP and INFORM messages. she's the listener. the one who picks up the phone. 🫶

⚠️ heads up bestie: the default is to listen on UDP port 162 on all IPv4 interfaces. and since 162 is a privileged port, snmptrapd must typically be run as root. it's giving main character with a security clearance, no cap.

---

✨ OPTIONS ✨

• -a — ignore authenticationFailure traps. not today, ma'am. 💅
• -A — append to the log file instead of truncating it. keeping the receipts, as she should.

fr fr note this: it needs to come before any -Lf options that it should apply to. order matters bestie, it's a whole thing.

• -c FILE — read FILE as a configuration file (or a comma-separated list of configuration files). plural queens only. 🎀
• -C — do not read any configuration files except the one optionally specified by the -c option. she's on a strict diet, no outside influence.
• -d — dump (in hexadecimal) the sent and received SNMP packets. raw data reveal, we love to see it. 🔥
• -D[TOKEN[,...]] — turn on debugging output for the given TOKEN(s). try ALL for extremely verbose output. like, extremely. she will not stop talking and honestly? respect.
• -f — do not fork() from the calling shell. staying attached, clingy in a cute way. 🦋
• -F FORMAT — when logging to standard output, use the format in the string FORMAT. scroll down to FORMAT SPECIFICATIONS for the tea. ☕
• -h, --help — display a brief usage message and then exit. the "hi bestie here's the deal" button.
• -H — display a list of configuration file directives understood by the trap daemon and then exit. the full menu, no secrets. ✨
• -I [-]INITLIST — specifies which modules should (or should not) be initialized when snmptrapd starts up. if the comma-separated INITLIST is preceded with a -, it is the list of modules that should not be started. otherwise this is the list of the only modules that should be started.
  • to get a list of compiled modules, run snmptrapd with the arguments -Dmib_init -H (assuming debugging support has been compiled in). iykyk. 💜
• -L[efos] — specify where logging output should be directed (standard error or output, to a file or via syslog). see LOGGING OPTIONS in snmpcmd(1) for details. she's got range. 🌈
• -m MIBLIST — specifies a colon separated list of MIB modules to load for this application. this overrides the environment variable MIBS. see snmpcmd(1) for details.
• -M DIRLIST — specifies a colon separated list of directories to search for MIBs. this overrides the environment variable MIBDIRS. see snmpcmd(1) for details. 🍓
• -n — do not attempt to translate source addresses of incoming packets into hostnames. no name-dropping, just IPs. lowkey mysterious of her.
• -p FILE — save the process ID of the trap daemon in FILE. writing down her own number in case you need her. 🫶
• -O [abeEfnqQsStTuUvxX] — specifies how MIB objects and other output should be displayed. see the section OUTPUT OPTIONS in the snmpcmd(1) manual page for details.
• -t — do not log traps to syslog. this disables logging to syslog. this is useful if you want the snmptrapd application to only run traphandle hooks and not to log any traps to any location. she's just vibing, observing, not journaling. 🙈
• -v, --version — print version information for the trap daemon and then exit. the "who even am i" moment. 👑
• -x ADDRESS — connect to the AgentX master agent on the specified address, rather than the default "/var/agentx/master". see snmpd(8) for details of the format of such addresses.
• -X — do not connect to a AgentX master agent. solo era. 💅
• --name="value" — allows one to specify any token ("name") supported in the snmptrapd.conf file and sets its value to "value". overrides the corresponding token in the snmptrapd.conf file. see snmptrapd.conf(5) for the full list of tokens. so powerful. so specific.

---

🌈 FORMAT SPECIFICATIONS 🌈

snmptrapd interprets format strings similarly to printf(3). she understands the following formatting sequences — and bestie, she understands all of them:

• %% — a literal %
• %a — the contents of the agent-addr field of the PDU (v1 TRAPs only)
• %A — the hostname corresponding to the contents of the agent-addr field of the PDU, if available, otherwise the contents of the agent-addr field of the PDU (v1 TRAPs only).
• %b — PDU transport address (Note: this is not necessarily an IPv4 address). Something like "[UDP: [172.16.10.12]:23456->[10.150.0.8]]"
• %B — PDU source hostname if available, otherwise PDU source address (see note above)
• %E — SNMPv3 context engine id
• %h — current hour on the local system
• %H — the hour field from the sysUpTime.0 varbind
• %j — current minute on the local system
• %J — the minute field from the sysUpTime.0 varbind
• %k — current second on the local system
• %K — the seconds field from the sysUpTime.0 varbind
• %l — current day of month on the local system
• %L — the day of month field from the sysUpTime.0 varbind
• %m — current (numeric) month on the local system
• %M — the numeric month field from the sysUpTime.0 varbind
• %N — enterprise string
• %P — security information from the PDU (community name for v1/v2c, user and context for v3)
• %q — trap sub-type (numeric, in decimal)
• %s — SNMP version number (0: v1, 1: v2c, 2: v3)
• %S — SNMPv3 security model version number
• %t — decimal number of seconds since the operating system epoch (as returned by time(2))
• %T — the value of the sysUpTime.0 varbind in seconds
• %u — SNMPv3 security name, or v1/v2c community name
• %v — list of variable-bindings from the notification payload. These will be separated by a tab, or by a comma and a blank if the alternate form is requested See also %V
• %V — specifies the variable-bindings separator. This takes a sequence of characters, up to the next % (to embed a % in the string, use \%)
• %w — trap type (numeric, in decimal)
• %W — trap description
• %y — current year on the local system
• %Y — the year field from the sysUpTime.0 varbind

in addition to these values, an optional field width and precision may also be specified , just as in printf(3), and a flag value. The following flags are supported:

• - — left justify
• 0 — use leading zeros
• # — use alternate form

The "use alternate form" flag changes the behavior of various format string sequences:

• Time information will be displayed based on GMT (rather than the local timezone)
• The variable-bindings will be a comma-separated list (rather than a tab-separated one)
• The system uptime will be broken down into a human-meaningful format (rather than being a simple integer)

💫 Examples: 💫

To get a message like "14:03 TRAP3.1 from humpty.ucd.edu" you could use something like this:

snmptrapd -P -F "%02.2h:%02.2j TRAP%w.%q from %A\n"

If you want the same thing but in GMT rather than local time, use:

snmptrapd -P -F "%#02.2h:%#02.2j TRAP%w.%q from %A\n"

---

🦋 LISTENING ADDRESSES 🦋

By default, snmptrapd listens for incoming SNMP TRAP and INFORM packets on UDP port 162 on all IPv4 interfaces. However, it is possible to modify this behaviour by specifying one or more listening addresses as arguments to snmptrapd. See the snmpd(8) manual page for more information about the format of listening addresses. she can multitask, she can hold multiple conversations. 💅

---

👑 NOTIFICATION-LOG-MIB SUPPORT 👑

As of net-snmp 5.0, the snmptrapd application supports the NOTIFICATION-LOG-MIB. It does this by opening an AgentX subagent connection to the master snmpd agent and registering the notification log tables. As long as the snmpd application is started first, it will attach itself to it and thus you should be able to view the last recorded notifications via the nlmLogTable and nlmLogVariableTable. See the snmptrapd.conf file and the "doNotRetainNotificationLogs" token for turning off this support. See the NOTIFICATION-LOG-MIB for more details about the MIB itself.

🫶 reminder: start snmpd first. she's not going to chase you.

---

🎀 EXTENSIBILITY AND CONFIGURATION 🎀

See the snmptrapd.conf(5) manual page. that's where all the customization lore lives, bestie.

---

⭐ SEE ALSO ⭐

snmpcmd(1), snmpd(8), printf(3), snmptrapd.conf(5), syslog(8), traptoemail(1), variables(5)

---

✨ and that's the whole page, bestie! ✨ this little masterpiece is snmptrapd from Net-SNMP, version V5.9.5.2, dated 27 Apr 2014 — and yes, that date is giving vintage, but she still slays. periodt. 💖🎀🦋🌸💅