Merge pull request #376 from splunk/feature/trap-support

Experimental Support SNMP Traps

package/Dockerfile

@@ -21,6 +21,8 @@ COPY etc/local_config /opt/syslog-ng/etc/local_config
 COPY reset_persist /opt/syslog-ng/etc/
 COPY sbin/entrypoint.sh /
 
+RUN mkdir -p /opt/syslog-ng/var/log/
+COPY snmp/snmptrapd.conf /opt/net-snmp/etc/snmp/
 COPY VERSION /
 
 RUN  /opt/syslog-ng/sbin/syslog-ng -V

package/etc/conf.d/conflib/_common/templates.conf

@@ -85,3 +85,8 @@ template t_JSON_5424 {
                 --exclude PRIORITY
                 )');
     };
+
+
+template t_snmp_trap {
+    template('$(format-json .snmp.* --rekey .snmp.* --shift-levels 2)');
+    };

package/etc/conf.d/log_paths/lp-snmp_traps.conf.tmpl

@@ -0,0 +1,31 @@
+# Startup events
+
+log {
+    source {snmptrap(
+            filename("/opt/syslog-ng/var/log/snmptrapd.log")
+            );
+        };
+
+    rewrite { r_set_splunk_dest_default(sourcetype("snmp:trap"), index("main"))};
+    parser {p_add_context_splunk(key("snmp_trap")); };
+
+    rewrite { set("$(template ${.splunk.sc4s_template} $(template t_snmp_trap))" value("MSG")); };
+
+{{- if or (conv.ToBool (getenv "SC4S_DEST_SPLUNK_HEC_GLOBAL" "yes")) (conv.ToBool (getenv "SC4S_DEST_SNMP_TRAPS_HEC" "no")) }}
+    destination(d_hec);
+{{- end}}
+
+{{- if eq (getenv "SC4S_DEBUG_STDOUT" "yes") "no"}}
+    destination(d_stdout);
+{{- end}}
+
+{{- if (print (getenv "SC4S_DEST_GLOBAL_ALTERNATES")) }}
+    {{ getenv "SC4S_DEST_GLOBAL_ALTERNATES" | regexp.ReplaceLiteral "^" "destination(" | regexp.ReplaceLiteral "[, ]+" ");\n    destination(" }});
+{{- end }}
+
+{{- if (print (getenv "SC4S_DEST_SNMP_TRAPS_ALTERNATES")) }}
+    {{ getenv "SC4S_DEST_SNMP_TRAPS_ALTERNATES" | regexp.ReplaceLiteral "^" "destination(" | regexp.ReplaceLiteral "[, ]+" ");\n    destination(" }});
+{{- end }}
+
+    flags(flow-control,final);
+ };

package/sbin/entrypoint.sh

@@ -21,6 +21,9 @@ cp /opt/syslog-ng/etc/context_templates/* /opt/syslog-ng/etc/conf.d/local/contex
 for file in /opt/syslog-ng/etc/conf.d/local/context/*.example ; do cp --verbose -n $file ${file%.example}; done
 cp --verbose -R /opt/syslog-ng/etc/local_config/* /opt/syslog-ng/etc/conf.d/local/config/
 mkdir -p /opt/syslog-ng/var/log
+
+/opt/net-snmp/sbin/snmptrapd -Lf /opt/syslog-ng/var/log/snmptrapd.log
+
 echo syslog-ng checking config
 echo sc4s version=$(cat /VERSION)
 echo sc4s version=$(cat /VERSION) >/opt/syslog-ng/var/log/syslog-ng.out

package/snmp/snmptrapd.conf

@@ -0,0 +1,3 @@
+authCommunity log,execute,net public
+format2 %.4y-%.2m-%.2l %.2h:%.2j:%.2k %B [%b]:\n%v\n
+outputOption s