zabbix配置snmptrap告警自动恢复简单应用

在线答疑乐维社区一、配置snmptrap自动恢复前提Snmptrap能够自动恢复的前提是有恢复状态推送以及告警ID要一致以下操作主要是标记告警ID标记出snmptrap推送的告警和恢复是同一条告警数据示例10:49:08 2025/06/27 ZBXTRAP 172.PDU INFO:community Chmessageid 0notificationtype TRAPerrorstatus 0requestid 98567813receivedfrom UDP: [172.30.]:31920-[172.30.]:162version 1errorindex 0transactionid 1058VARBINDS:DISMAN-EVENT-MIB::sysUpTimeInstance type67 valueTimeticks: (13365127) 1 day, 13:07:31.27SNMPv2-MIB::snmpTrapOID.0 type6 valueOID: SNMPv2-SMI::enterprises.2011.2.15.2.4.3.3.0.1SNMPv2-SMI::enterprises.2011.2.15.2.4.3.3.1.0 type4 valueSTRING: “501”SNMPv2-SMI::enterprises.2011.2.15.2.4.3.3.2.0 type4 valueSTRING: “1”SNMPv2-SMI::enterprises.2011.2.15.2.4.3.3.3.0 type4 valueSTRING: “2024-11-18 18:00:15”SNMPv2-SMI::enterprises.2011.2.15.2.4.3.3.4.0 type4 valueSTRING: “fusioncompute”SNMPv2-SMI::enterprises.2011.2.15.2.4.3.3.5.0 type2 valueINTEGER: 5SNMPv2-SMI::enterprises.2011.2.15.2.4.3.3.6.0 type4 valueSTRING: “FusionCompute”SNMPv2-SMI::enterprises.2011.2.15.2.4.3.3.7.0 type4 valueSTRING: “NE66000000”SNMPv2-SMI::enterprises.2011.2.15.2.4.3.3.8.0 type4 valueSTRING: “75”SNMPv2-SMI::enterprises.2011.2.15.2.4.3.3.9.0 type2 valueINTEGER: 151007030SNMPv2-SMI::enterprises.2011.2.15.2.4.3.3.10.0 type2 valueINTEGER: 5SNMPv2-SMI::enterprises.2011.2.15.2.4.3.3.11.0 type2 valueINTEGER: 2SNMPv2-SMI::enterprises.2011.2.15.2.4.3.3.12.0 type2 valueINTEGER: 2SNMPv2-SMI::enterprises.2011.2.15.2.4.3.3.13.0 type2 valueINTEGER: 2SNMPv2-SMI::enterprises.2011.2.15.2.4.3.3.14.0 type4 value“”SNMPv2-SMI::enterprises.2011.2.15.2.4.3.3.15.0 type4 value“”SNMPv2-SMI::enterprises.2011.2.15.2.4.3.3.16.0 type4 value“”SNMPv2-SMI::enterprises.2011.2.15.2.4.3.3.27.0 type4 valueSTRING: “urn:sites:2D661162:vrms:2”SNMPv2-SMI::enterprises.2011.2.15.2.4.3.3.28.0 type4 valueSTRING: “Remote Management Data Backup Is Not Configured for VRM”SNMPv2-SMI::enterprises.2011.2.15.2.4.3.3.29.0 type4 valueSTRING: “Neither the device nor NMS can automatically detect whether the alarm has been restored. Please manually clear the alarm after confirming that the issue has been resolved.”SNMPv2-SMI::enterprises.2011.2.15.2.4.3.3.30.0 type4 value“”二、基于上面的内容设置触发器{{ITEM.VALUE}.iregsub(“SNMPv2-SMI::enterprises.2011.2.15.2.4.3.3.1.0\stype4\svalueSTRING:\s”(\d)“”,\1)} 告警ID要和上一张图名称匹配上而正则表达式就要匹配上告警的ID也是就501核心是{{ITEM.VALUE}.iregsub(“(\d)”,\1)} {ITEM.VALUE}代表监控项采集回来的值iregsub正则过滤””是匹配\1是匹配第一个效果告警标题里面会多了一个 告警ID501如果有了就代表告警和恢复的告警ID标记成功标记为同一条就成功了简单的示例{{ITEM.VALUE}.regsub(“告警ID(\d)”,\1)}如果需要转换告警的内容还可以设置以下的内容就基于原本snmptrap的内容转换翻译因为oid太长而且不明确其意思需要对oid专业使用监控项的JavaScript进行转换var lines value.split(‘\n’);var result [];var fieldMappings {“SNMPv2-SMI::enterprises.2011.2.15.2.4.3.3.1.0”: “告警ID”,“SNMPv2-SMI::enterprises.2011.2.15.2.4.3.3.3.0”: “告警时间”,“SNMPv2-SMI::enterprises.2011.2.15.2.4.3.3.4.0”: “告警设备名称”,“SNMPv2-SMI::enterprises.2011.2.15.2.4.3.3.5.0”: “产品系列标识”,“SNMPv2-SMI::enterprises.2011.2.15.2.4.3.3.6.0”: “产品类型名称”,“SNMPv2-SMI::enterprises.2011.2.15.2.4.3.3.7.0”: “产品唯一标识”,“SNMPv2-SMI::enterprises.2011.2.15.2.4.3.3.11.0”: “告警级别”,“SNMPv2-SMI::enterprises.2011.2.15.2.4.3.3.14.0”: “告警确认时间”,“SNMPv2-SMI::enterprises.2011.2.15.2.4.3.3.16.0”: “进行确认操作的操作员”,“SNMPv2-SMI::enterprises.2011.2.15.2.4.3.3.27.0”: “告警扩展信息”,“SNMPv2-SMI::enterprises.2011.2.15.2.4.3.3.28.0”: “告警发生原因”,“SNMPv2-SMI::enterprises.2011.2.15.2.4.3.3.29.0”: “告警修复建议”};for (var i 0; i lines.length; i) {var line lines[i].trim();for (var key in fieldMappings) {if (line.startsWith(key)) {var valuePart line.substring(line.indexOf(“type”));result.push(fieldMappings[key] : valuePart);break;}}}return result.join(‘\n’);效果告警ID: type4 valueSTRING: “501”告警时间: type4 valueSTRING: “2024-11-18 18:00:15”告警设备名称: type4 valueSTRING: “fusioncompute”产品系列标识: type2 valueINTEGER: 5产品类型名称: type4 valueSTRING: “FusionCompute”产品唯一标识: type4 valueSTRING: “NE66000000”告警级别: type2 valueINTEGER: 2告警确认时间: type4 value“”进行确认操作的操作员: type4 value“”告警扩展信息: type4 valueSTRING: “urn:sites:2D661162:vrms:2”告警发生原因: type4 valueSTRING: “Remote Management Data Backup Is Not Configured for VRM”告警修复建议: type4 valueSTRING: “Neither the device nor NMS can automatically detect whether the alarm has been restored. Please manually clear the alarm after confirming that the issue has been resolved.”然后触发器也要修改{{ITEM.VALUE}.iregsub(“告警ID: type4\svalueSTRING: “(\d)””,\1)}