snmptt as a SNMP trap handler for
snmptrapd, with the aim being to write to a trap file that can be read and processed by Zabbix.
I have set up snmptt to run as the
zabbix user by changing the
# grep daemon /etc/init.d/snmptt # description: SNMP Trap Translator daemon # Short-Description: SNMP Trap Translator daemon OPTIONS="--daemon" daemon --user=zabbix /usr/sbin/snmptt $OPTIONS
snmpttt is running as expected as the
zabbix user, the same user which is running the Zabbix server.
# ps -ef | grep snmp root 3796 1 0 Jun19 ? 00:13:04 /usr/sbin/snmpd -LS0-6d -Lf /dev/null -p /var/run/snmpd.pid zabbix 4444 1 0 15:00 ? 00:00:00 /usr/bin/perl /usr/sbin/snmptt --daemon zabbix 4445 4444 0 15:00 ? 00:00:00 /usr/bin/perl /usr/sbin/snmptt --daemon root 9300 29899 0 15:25 pts/2 00:00:00 grep snmp zabbix 16576 16511 0 Aug16 ? 00:00:11 /path/to/sbin/zabbix_server: snmp trapper [processed data in 0.000007 sec, idle 1 sec] root 16600 1 0 Aug16 ? 00:00:07 /usr/sbin/snmptrapd -A -Lf /var/log/snmptrapd.log -D -p /var/run/snmptrapd.pid
The log file to send traps caught is
# egrep "^(log_file|pid)" /etc/snmp/snmptt.ini pid_file = /var/run/snmptt/snmptt.pid log_file=/var/tmp/zabbixtest/zabbix_traps.tmp
However, the trap log file is being written to, and owned by the
root user, not as the
zabbix user as expected. Moreover, the permissions on the file are
0640, meaning that the zabbix user running the server is not able to read the file.
# service snmptt stop Stopping snmptt: [ OK ] # rm /var/tmp/zabbixtest/zabbix_traps.tmp rm: remove regular file `/var/tmp/zabbixtest/zabbix_traps.tmp'? y # ls -lia /var/tmp/zabbixtest/zabbix_traps.tmp ls: cannot access /var/tmp/zabbixtest/zabbix_traps.tmp: No such file or directory # ls -lia /var/tmp/zabbixtest/ total 24 263224 drwxrwxr-x 2 root zabbix 4096 Aug 17 15:32 . 262145 drwxrwxrwt 7 root root 4096 Aug 17 14:53 .. # service snmptt start Starting snmptt: PID file: /var/run/snmptt/snmptt.pid [ OK ] # ps -ef | grep snmptt zabbix 9944 1 0 15:32 ? 00:00:00 /usr/bin/perl /usr/sbin/snmptt --daemon zabbix 9945 9944 0 15:32 ? 00:00:00 /usr/bin/perl /usr/sbin/snmptt --daemon root 9981 29899 0 15:32 pts/2 00:00:00 grep snmptt # ps -ef | grep snmp root 3796 1 0 Jun19 ? 00:13:04 /usr/sbin/snmpd -LS0-6d -Lf /dev/null -p /var/run/snmpd.pid zabbix 9944 1 0 15:32 ? 00:00:00 /usr/bin/perl /usr/sbin/snmptt --daemon zabbix 9945 9944 0 15:32 ? 00:00:00 /usr/bin/perl /usr/sbin/snmptt --daemon root 9986 29899 0 15:32 pts/2 00:00:00 grep snmp zabbix 16576 16511 0 Aug16 ? 00:00:11 /path/to/sbin/zabbix_server: snmp trapper [processed data in 0.000079 sec, idle 1 sec] root 16600 1 0 Aug16 ? 00:00:07 /usr/sbin/snmptrapd -A -Lf /var/log/snmptrapd.log -D -p /var/run/snmptrapd.pid # ls -lia /var/tmp/zabbixtest/zabbix_traps.tmp 262265 -rw-r----- 1 root root 122 Aug 17 15:32 /var/tmp/zabbixtest/zabbix_traps.tmp
Note the file permissions and ownership of
zabbix user is unable to read the file and is hence unable to process it.
I can fix by manually modifying the mode of the trap file
0644, for example, but I am hoping there is a better way, e.g. via a configuration file, since the file location will most likely change. (There are some blog sites recommending to change the mode to 0777, obviously that is not the correct solution).
I guess it is due to the
snmptrapd configuration, running as root, but not sure the best way to fix this.
Why is the trap log file being written to as the
root user with
0640 permissions, instead of as
zabbix user running
How can/should I configure
snmptrapd to have the trap file be owned and readable by the
zabbix user instead of root user.
Other relevant info:
snmptrapd config file:
# grep -v '^#' /etc/snmp/snmptrapd.conf disableAuthorization yes traphandle default /usr/sbin/snmptthandler
Running RHEL 6.6