I am trying to utilize the information from snmptrap ‘message’ field to display and pass the values.
But other than Alert Template standard processing method, these values are not getting substituted even for Alert Template’s, Alert title or Recovery.
Not sure where you got those values from but they aren’t what you need to use. Basically the syslog table should be available to you:
You can use those.
As for the subject, it’s hard to use items from $alert→faults array as you would have to technically loop through the array like you do in the template, that gets messy. You can however access say the first item in the array like $alert→fault[0]
Above values we are getting using the sql from Alert Rules
SELECT
t.device_id,
MAX(t.datetime) AS datetime,
t.node_name,
t.alarm_type,
t.source_type,
t.severity,
t.probable_cause
FROM (
SELECT
el.device_id,
el.datetime,
REGEXP_REPLACE(
el.message,
‘(?s).ASMAX-NETSPAN-MIB::asxNmsAlarm2NodeName":“([^”])“.',
‘\1’
) AS node_name,
REGEXP_REPLACE(
el.message,
'(?s).ASMAX-NETSPAN-MIB::asxNmsAlarm2Type":“([^”])”.’,
‘\1’
) AS alarm_type,
REGEXP_REPLACE(
el.message,
‘(?s).ASMAX-NETSPAN-MIB::asxNmsAlarm2SourceType":“([^”])“.',
‘\1’
) AS source_type,
REGEXP_REPLACE(
el.message,
'(?s).ASMAX-NETSPAN-MIB::asxNmsAlarm2Severity":“([^”])”.’,
‘\1’
) AS severity,
REGEXP_REPLACE(
el.message,
‘(?s).ASMAX-NETSPAN-MIB::asxNmsAlarm2ProbableCause":“([^”])“.*’,
‘\1’
) AS probable_cause
FROM
librenms.eventlog AS el
WHERE
el.device_id = ?
AND el.type = “trap”
AND el.datetime >= DATE_SUB(NOW(), INTERVAL 1 HOUR)
AND el.message REGEXP ‘ASMAX-NETSPAN-MIB::asxNmsAlarm7Trap’
AND el.message REGEXP ‘ASMAX-NETSPAN-MIB::asxNmsAlarm2Severity”:“major”,’
ORDER BY
el.datetime DESC
) As t
GROUP BY
t.node_name
ORDER BY
datetime DESC;
Basically, what we are trying to achieve here is the EMS system which sends traps for our different sites the hostname always comes as the EMS hostname and the site name is incorporated in the ‘message’ body so, we are trying to extract that site name and pass is to alert/ticketing system in that way we can at least display the correct site name.
It looks like you do have what you need in that then. The only way for me to debug this is if you provide an example syslog entry from the DB and your template in text format.
MariaDB [librenms]> SELECT count(*) from syslog;
±---------+
| count() |
±---------+
| 0 |
±---------+
1 row in set (0.000 sec)
As I am testing with SNMPTRAP, I can provide the sample trap but this require Airspan MIB’s
snmptrap -v 2c -c public ‘’ ASMAX-NETSPAN-MIB::asxNmsAlarm7Trap ASMAX-NETSPAN-MIB::asxNmsAlarm2Type s “RU Antenna Tilt Permanent Shift” ASMAX-NETSPAN-MIB::asxNmsAlarm2Severity i 4 ASMAX-NETSPAN-MIB::asxNmsAlarm2NodeName s “test4-node4” ASMAX-NETSPAN-MIB::asxNmsAlarm2SourceId s “test-source” ASMAX-NETSPAN-MIB::asxNmsAlarm2ProbableCause s “Test Trigger” ASMAX-NETSPAN-MIB::asxNmsAlarm2SourceType i “gnbRu”
