I'm running
snmptt
as a SNMP trap handler for snmptrapd
, with the aim being to write to a trap file that can be read and processed by Zabbix.
I have set up snmptt to run as the zabbix
user by changing the init
script.
# grep daemon /etc/init.d/snmptt
# description: SNMP Trap Translator daemon
# Short-Description: SNMP Trap Translator daemon
OPTIONS="--daemon"
daemon --user=zabbix /usr/sbin/snmptt $OPTIONS
snmpttt
is running as expected as the zabbix
user, the same user which is running the Zabbix server.
# ps -ef | grep snmp
root 3796 1 0 Jun19 ? 00:13:04 /usr/sbin/snmpd -LS0-6d -Lf /dev/null -p /var/run/snmpd.pid
zabbix 4444 1 0 15:00 ? 00:00:00 /usr/bin/perl /usr/sbin/snmptt --daemon
zabbix 4445 4444 0 15:00 ? 00:00:00 /usr/bin/perl /usr/sbin/snmptt --daemon
root 9300 29899 0 15:25 pts/2 00:00:00 grep snmp
zabbix 16576 16511 0 Aug16 ? 00:00:11 /path/to/sbin/zabbix_server: snmp trapper [processed data in 0.000007 sec, idle 1 sec]
root 16600 1 0 Aug16 ? 00:00:07 /usr/sbin/snmptrapd -A -Lf /var/log/snmptrapd.log -D -p /var/run/snmptrapd.pid
The log file to send traps caught is /var/tmp/zabbixtest/zabbix_traps.tmp
# egrep "^(log_file|pid)" /etc/snmp/snmptt.ini
pid_file = /var/run/snmptt/snmptt.pid
log_file=/var/tmp/zabbixtest/zabbix_traps.tmp
However, the trap log file is being written to, and owned by the root
user, not as the zabbix
user as expected. Moreover, the permissions on the file are 0640
, meaning that the zabbix user running the server is not able to read the file.
# service snmptt stop
Stopping snmptt: [ OK ]
# rm /var/tmp/zabbixtest/zabbix_traps.tmp
rm: remove regular file `/var/tmp/zabbixtest/zabbix_traps.tmp'? y
# ls -lia /var/tmp/zabbixtest/zabbix_traps.tmp
ls: cannot access /var/tmp/zabbixtest/zabbix_traps.tmp: No such file or directory
# ls -lia /var/tmp/zabbixtest/
total 24
263224 drwxrwxr-x 2 root zabbix 4096 Aug 17 15:32 .
262145 drwxrwxrwt 7 root root 4096 Aug 17 14:53 ..
# service snmptt start
Starting snmptt: PID file: /var/run/snmptt/snmptt.pid
[ OK ]
# ps -ef | grep snmptt
zabbix 9944 1 0 15:32 ? 00:00:00 /usr/bin/perl /usr/sbin/snmptt --daemon
zabbix 9945 9944 0 15:32 ? 00:00:00 /usr/bin/perl /usr/sbin/snmptt --daemon
root 9981 29899 0 15:32 pts/2 00:00:00 grep snmptt
# ps -ef | grep snmp
root 3796 1 0 Jun19 ? 00:13:04 /usr/sbin/snmpd -LS0-6d -Lf /dev/null -p /var/run/snmpd.pid
zabbix 9944 1 0 15:32 ? 00:00:00 /usr/bin/perl /usr/sbin/snmptt --daemon
zabbix 9945 9944 0 15:32 ? 00:00:00 /usr/bin/perl /usr/sbin/snmptt --daemon
root 9986 29899 0 15:32 pts/2 00:00:00 grep snmp
zabbix 16576 16511 0 Aug16 ? 00:00:11 /path/to/sbin/zabbix_server: snmp trapper [processed data in 0.000079 sec, idle 1 sec]
root 16600 1 0 Aug16 ? 00:00:07 /usr/sbin/snmptrapd -A -Lf /var/log/snmptrapd.log -D -p /var/run/snmptrapd.pid
# ls -lia /var/tmp/zabbixtest/zabbix_traps.tmp
262265 -rw-r----- 1 root root 122 Aug 17 15:32 /var/tmp/zabbixtest/zabbix_traps.tmp
Note the file permissions and ownership of /var/tmp/zabbixtest/zabbix_traps.tmp
.
Accordingly, the zabbix
user is unable to read the file and is hence unable to process it.
I can fix by manually modifying the mode of the trap file /var/tmp/zabbixtest/zabbix_traps.tmp
to 0644
, for example, but I am hoping there is a better way, e.g. via a configuration file, since the file location will most likely change. (There are some blog sites recommending to change the mode to 0777, obviously that is not the correct solution).
I guess it is due to the snmptrapd
configuration, running as root, but not sure the best way to fix this.
**My questions:**
Why is the trap log file being written to as the root
user with 0640
permissions, instead of as zabbix
user running snmptt
?
How can/should I configure snmptt
and/or snmptrapd
to have the trap file be owned and readable by the zabbix
user instead of root user.
**Other relevant info:**
snmptrapd config file:
# grep -v '^#' /etc/snmp/snmptrapd.conf
disableAuthorization yes
traphandle default /usr/sbin/snmptthandler
Running RHEL 6.6
Asked by hilcharge
(359 rep)
Aug 17, 2017, 06:54 AM
Last activity: Jul 19, 2025, 05:00 PM
Last activity: Jul 19, 2025, 05:00 PM