Mapping SNMP variables to events

Some SNMP traps can include variables (varbind objects), which are ordered implicitly. The ordering requirement takes the form of Name.Number—like someVar.0—and in many cases there will be a series of varbind objects with different numbers on the same name. The following tables provide an example variable and varbind objects.

OID Value
1.2.1.1.3.0 Message0
1.2.1.1.3.1 Message1

Assuming a MIB (imported into Resource Manager) specifies the name someVar (1.2.1.1.3) then the event details would be as follows:

Name Value
someVar.0 Message0
someVar.1 Message1
someVar.sequence 0,1

The following tables illustrate how the implicit ordering is encoded in event details.

Example trap with an SNMP varbind object
OID Value
1.3.6.1.2.1.2.2.1.1.143 143
1.3.6.1.2.1.2.2.1.7.143 1
1.3.6.1.2.1.2.2.1.8.143 1
1.3.6.1.2.1.2.2.1.2.143 "F23"
1.3.6.1.2.1.31.1.1.1.18.143 ""
Event details for example trap
Name Value
ifIndex.143 143
ifIndex.sequence 143
ifAdminStatus.143 1
ifAdminStatus.sequence 143
ifOperStatus.143 1
ifOperStatus.sequence 143
ifDescr.143 F23
ifDescr.sequence 143
ifAlias.143
ifAlias.sequence 143

The event details are repetitive, but an event transform can parse and process sequenced varbind objects.

For example, the following event transform concatenates the someVar parts into the event's summary attribute:

seq = getattr(evt, "someVar.sequence", None) 
if seq is not None:
    values = [] 
    for idx in str(seq).split(','):
        value = getattr(evt, "someVar." + idx, '')
        values.append(value)
    evt.summary = ' '.join(values)