SNMPTRAPD(8) Net-SNMP SNMPTRAPD(8)

NAME
       snmptrapd - Receive and log SNMP trap messages.

SYNOPSIS
       ssnnmmppttrraappdd [OPTIONS] [LISTENING ADDRESSES]

DESCRIPTION
       ssnnmmppttrraappdd  is  an SNMP application that receives and logs SNMP TRAP and
       INFORM messages.

       Note: the default is to listen on UDP port 162 on all IPv4  interfaces.
       Since  162  is a privileged port, ssnnmmppttrraappdd must be typically be run as
       root.

OOPPTTIIOONNSS
       -aa      Ignore authenticationFailure traps.

       -cc FILE Read FILE as a configuration file.

       -CC      Do not read any configuration files except the  one  optionally
               specified by the -cc option.

       -dd      Dump (in hexadecimal) the sent and received SNMP packets.

       -DD TOKEN[,...]
               Turn  on  debugging output for the given TOKEN(s).  Try ALL for
               extremely verbose output.

       -ee      Print event numbers (rising/falling alarm etc.).

       -ff      Do not fork() from the calling shell.

       -FF FORMAT
               When logging to standard output, use the format in  the  string
               FORMAT.   See  the section FFOORRMMAATT SSPPEECCIIFFIICCAATTIIOONNSS below for more
               details.

       -hh,, --hheellpp
               Display a brief usage message and then exit.

       -HH      Display a list of configuration file directives  understood  by
               the trap daemon and then exit.

       -ll d|0-7
               Specifies  the  syslog  facility to use when logging to syslog.
               'd' means LLOOGGDDAAEEMMOONN and 0 through 7  mean  LLOOGGLLOOCCAALL00  through
               LLOOGGLLOOCCAALL77.  LLOOGGLLOOCCAALL00 is the default.
               This  option  is being deprecated, and '-Ls FACILITY' should be
               used instead.

       -LL[[eeffooss]]
               Specify where logging output should be directed (standard error
               or  output,  to  a file or via syslog).  See LOGGING OPTIONS in
               snmpcmd(1) for details.
               This option deprecates the -ll -oo -PP and -ss options.

       -mm MIBLIST
               Specifies a colon separated list of MIB  modules  to  load  for
               this  application.   This  overrides  the  environment variable
               MIBS.

       -MM DIRLIST
               Specifies a colon separated list of directories to  search  for
               MIBs.  This overrides the environment variable MIBDIRS.

       -nn      Do  not attempt to translate source addresses of incoming pack-
               ets into hostnames.

       -oo FILE Log formatted incoming  traps  to  FILE.   Upon  receipt  of  a
               SIGHUP,  the  daemon will close and re-open the log file.  This
               feature is useful when rotating the log file with other  utili-
               ties such as logrotate.
               This  option is being deprecated, and '-Lf FILE' should be used
               instead.

       -pp FILE Save the process ID of the trap daemon in FILE.
               This option deprecates the -uu option.

       -PP      Print formatted incoming traps to stderr.
               This option is being  deprecated,  and  '-Le'  should  be  used
               instead.

       -ss      Log  formatted incoming traps to syslog.  These syslog messages
               are sent with a level of LLOOGGWWAARRNNIINNGG and facility as determined
               by  the  -ll  flag (LLOOGGLLOOCCAALL00 by default).  This is the default
               unless the -oo, -PP or -LL flag is used.
               This option is being deprecated, and '-Ls FACILITY'  should  be
               used instead.

       -SS d|0-7
               Specifies  the  syslog  facility to use when logging to syslog.
               See -ll for details.
               This option is being deprecated, and '-Ls FACILITY'  should  be
               used instead.

       -tt      Do  not  log traps to syslog.  This disables logging to syslog.
               This is useful if you want the snmptrapd  application  to  oonnllyy
               run  traphandle hooks and not to log any traps to any location.

       -uu FILE Save the process ID of the trap daemon in FILE.
               This option is being deprecated, and '-p FILE' should  be  used
               instead.

       -vv,, --vveerrssiioonn
               Print version information for the trap daemon and then exit.

       In addition, ssnnmmppttrraappdd takes the same output formatting (-OO) options as
       the other Net-SNMP commands.  See the section  OOUUTTPPUUTT  OOPPTTIIOONNSS  in  the
       snmpcmd(1) manual page.

FFOORRMMAATT SSPPEECCIIFFIICCAATTIIOONNSS
       ssnnmmppttrraappdd  interprets format strings similarly to printf(3).  It under-
       stands the following formatting sequences:

           %%%%  a literal %

           %%tt  decimal number of seconds since the  operating  system's  epoch
               (as returned by time(2))

           %%yy  current year on the local system

           %%mm  current (numeric) month on the local system

           %%ll  current day of month on the local system

           %%hh  current hour on the local system

           %%jj  current minute on the local system

           %%kk  current second on the local system

           %%TT  the value of the sysUpTime.0 varbind in seconds

           %%YY  the year field from the sysUpTime.0 varbind

           %%MM  the numeric month field from the sysUpTime.0 varbind

           %%LL  the day of month field from the sysUpTime.0 varbind

           %%HH  the hour field from the sysUpTime.0 varbind

           %%JJ  the minute field from the sysUpTime.0 varbind

           %%KK  the seconds field from the sysUpTime.0 varbind

           %%aa  the contents of the agent-addr field of the PDU (v1 TRAPs only)

           %%AA  the hostname corresponding to the contents  of  the  agent-addr
               field  of  the PDU, if available, otherwise the contents of the
               agent-addr field of the PDU (v1 TRAPs only).

           %%bb  PDU source address (Note:  this  is  not  necessarily  an  IPv4
               address)

           %%BB  PDU  source hostname if available, otherwise PDU source address
               (see note above)

           %%NN  enterprise string

           %%ww  trap type (numeric, in decimal)

           %%WW  trap description

           %%qq  trap sub-type (numeric, in decimal)

           %%PP  security information from the PDU (community name  for  v1/v2c,
               user and context for v3)

           %%vv  list  of trap's variable-bindings. These will be separated by a
               tab, or by a comma  and  a  blank  if  the  alternate  form  is
               requested See also %V

           %%VV  specifies   the   variable-bindings  separator.  This  takes  a
               sequence of characters, up to the next % (to embed a %  in  the
               string, use \%)

       In  addition  to  these  values, you may also specify an optional field
       width and precision, just as in printf(3), and a flag value.  The  fol-
       lowing flags are legal:

           -   left justify

           00   use leading zeros

           ##   use alternate form

       The  "use  alternate  form"  flag  changes  the behavior of some format
       flags. Normally, the fields that display time information  base  it  on
       the local timezone, but this flag tells them to use GMT instead.  Also,
       the variable-binding list is normally a tab-separated  list,  but  this
       flag  changes  it  to a comma-separated one. The alternate form for the
       uptime is similar to "3 days, 0:14:34.65"

   EExxaammpplleess::
       To get a message like "14:03 TRAP3.1 from humpty.ucd.edu" you could use
       something like this:

              snmptrapd -P -F "%02.2h:%02.2j TRAP%w.%q from %A\n"

       If you want the same thing but in GMT rather than local time, use

              snmptrapd -P -F "%#02.2h:%#02.2j TRAP%w.%q from %A\n"

LLIISSTTEENNIINNGG AADDDDRREESSSSEESS
       By default, ssnnmmppttrraappdd listens for incoming SNMP TRAP and INFORM packets
       on UDP port 162 on all IPv4 interfaces.  However,  it  is  possible  to
       modify  this behaviour by specifying one or more listening addresses as
       arguments to ssnnmmppttrraappdd.  See the snmpd(8) manual page for more informa-
       tion about the format of listening addresses.

NNOOTTIIFFIICCAATTIIOONN-LLOOGG-MMIIBB SSUUPPPPOORRTT
       As  of  net-snmp  5.0, the snmptrapd application supports the NOTIFICA-
       TION-LOG-MIB.  It does this by opening an AgentX subagent connection to
       the master snmpd agent and registering the notification log tables.  As
       long as the snmpd application is started first, it will  attach  itself
       to  it  and thus you should be able to view the last recorded notifica-
       tions  via  the   nlmLogTable   and   nlmLogVariableTable.    See   the
       snmptrapd.conf file and the "dontRetainLogs" token for turning off this
       support.  See the NOTIFICATION-LOG-MIB for more details about  the  MIB
       itself.

EEXXTTEENNSSIIBBIILLIITTYY AANNDD CCOONNFFIIGGUURRAATTIIOONN
       See the snmptrapd.conf(5) manual page.

SEE ALSO
       snmpcmd(1),  snmpd(8),  printf(3),  snmptrapd.conf(5), syslog(8), vari-
       ables(5)



4th Berkeley Distribution         15 Jan 2004                     SNMPTRAPD(8)