snmptrapd -- service to receive and log SNMP trap messages

SYNOPSIS

snmptrapd [-install] [-remove] [-debug] [OPTIONS] [LISTENING_ADDRESSES]

DESCRIPTION

The snmptrapd service is an SNMP application that receives and logs SNMP TRAP and INFORM messages.

Note: the default is to listen on UDP port 162 on all IPv4 interfaces. Since 162 is a privileged port, snmptrapd must typically be run as root.

Options

-install

installs and starts the snmptrapd service. To start the service without installing it, use the service command:

service start "snmptrapd service"

-remove

stops and removes the snmptrapd service. To stop the service without removing it, use the service command:

service stop "snmptrapd service"

-debug

runs snmptrapd as a normal program in the current console for debugging purposes.

-a

Ignores authenticationFailure traps.

-A

Append to the log file rather than truncating it.

Note that this needs to come before any -Lf options that it should apply to.

-c FILE

Reads FILE as a configuration file.

-C

Does not read any configuration files except the one optionally specified by the -c option.

-d

Dumps (in hexadecimal) the sent and received SNMP packets.

-D TOKEN[,...]

Turn on debugging output for the given "TOKEN"(s)." Try ALL for extremely verbose output.

-f

Does not fork() from the calling shell.

-F FORMAT

When logging to standard output, use the format in the string FORMAT. See the section FORMAT SPECIFICATIONS below for more details.

-h

--help

Displays a brief usage message and then exit.

-H

Displays a list of configuration file directives understood by the trap daemon and then exit.

-I [-]INITLIST

Specifies which modules should (or should not) be initialized when snmptrapd starts up. If the comma- separated INITLIST is preceded with a '-', it is the list of modules that should not be started. Otherwise this is the list of the only modules that should be started.

To get a list of compiled modules, run snmptrapd with the arguments -Dmib_init -H (assuming debugging support has been compiled in).

-L [efos]

Specify where logging output should be directed (standard error or output, to a file or via syslog (eventlog)). See LOGGING OPTIONS in snmpcmd for details.

-m MIBLIST

Specifies a colon separated list of MIB modules to load for this application. This overrides the environment variable MIBS.

-M DIRLIST

Specifies a colon separated list of directories to search for MIBs. This overrides the environment variable MIBDIRS.

-n

Does not attempt to translate source addresses of incoming packets into hostnames.

-O [abeEfnqQsStTuUvxX]

Specifies how MIB objects and other output should be displayed. See the section OUTPUT OPTIONS in the snmpcmd manual page for details.

-P FILE

Save the process ID of the trap daemon in FILE.

-t

Do not log traps to syslog. This disables logging to syslog. This is useful if you want the snmptrapd application to only run traphandle hooks and not to log any traps to any location.

-v

--version

Prints version information for the trap daemon and then exit.

-x ADDRESS

Connect to the AgentX master agent on the specified address, rather than the default AGENTX_SOCKET. See snmpd for details of the format of such addresses.

--name ="value"

llows to specify any token ("name") supported in the snmptrapd.conf file and sets its value to "value". Overrides the corresponding token in the snmptrapd.conf file. See snmptrapd.conf for the full list of tokens.

FORMAT SPECIFICATIONS

snmptrapd interprets format strings similarly to the printf() function, It understands the following formatting sequences:

%%: a literal %
%t: decimal number of seconds since the operating system's epoch (as returned by time(2))
%y: current year on the local system
%m: current (numeric) month on the local system
%l: current day of month on the local system
%h: current hour on the local system
%j: current minute on the local system
%k: current second on the local system
%T: the value of the sysUpTime.0 varbind in seconds
%Y: the year field from the sysUpTime.0 varbind
%M: the numeric month field from the sysUpTime.0 varbind
%L: the day of month field from the sysUpTime.0 varbind
%H: the hour field from the sysUpTime.0 varbind
%J: the minute field from the sysUpTime.0 varbind
%K: the seconds field from the sysUpTime.0 varbind
%a: the contents of the agent-addr field of the PDU (v1 TRAPs only)
%A: the hostname corresponding to the contents of the agent-addr field of the PDU, if available, otherwise the contents of the agent-addr field of the PDU (v1 TRAPs only).
%b: PDU source address (Note: this is not necessarily an IPv4 address)
%B: PDU source hostname if available, otherwise PDU source address (see note above)
%N: enterprise string
%w: trap type (numeric, in decimal)
%W: trap description
%q: trap sub-type (numeric, in decimal)
%P: security information from the PDU (community name for v1/v2c, user and context for v3)
%v: list of trap's variable-bindings

In addition to these values, you may also specify an optional field width and precision, just as in printf(), and a flag value. The following flags are legal:

-: left justify
0: use leading zeros
#: use alternate form

The "use alternate form" flag changes the behavior of various format string sequences.

Time information will be displayed based on GMT (rather than the local timezone)

The variable-bindings will be a comma-separated list (rather than a tab-separated one)

The  system  uptime will be broken down into a human-meaningful format (rather than being a simple integer)

Examples:

To get a message like "14:03 TRAP3.1 from humpty.ucd.edu" you could use something like this:

snmptrapd -P -F "%02.2h:%02.2j TRAP%w.%q from %A\n"

If you want the same thing but in GMT rather than local time, use:

snmptrapd -P -F "%#02.2h:%#02.2j TRAP%w.%q from %A\n"

LISTENING ADDRESSES

By default, snmptrapd listens for incoming SNMP TRAP and INFORM packets on UDP port 162 on all IPv4 interfaces. However, it is possible to modify this behavior by specifying one or more listening addresses as arguments to snmptrapd.

NOTIFICATION-LOG-MIB SUPPORT

As of net-snmp 5.0, the snmptrapd application supports the NOTIFICATION-LOG-MIB. It does this by opening an AgentX subagent connection to the master snmpd agent and registering the notification log tables. As long as the snmpd application is started first, it will attach itself to it and thus you should be able to view the last recorded notifications via the nlmLogTable and nlmLogVariableTable. See the snmptrapd.conf file and the "dontRetainLogs" token for turning off this support. See the NOTIFICATION-LOG-MIB for more details about the MIB itself.

EXTENSIBILITY AND CONFIGURATION

See the snmptrapd.conf reference page.

PORTABILITY

All UNIX systems. Windows 10. Windows Server 2016. Windows Server 2019. Windows 11. Windows Server 2022. Windows Server 2025.

AVAILABILITY

PTC MKS Toolkit for System Administrators
PTC MKS Toolkit for Developers
PTC MKS Toolkit for Interoperability
PTC MKS Toolkit for Professional Developers
PTC MKS Toolkit for Professional Developers 64-Bit Edition
PTC MKS Toolkit for Enterprise Developers
PTC MKS Toolkit for Enterprise Developers 64-Bit Edition

snmptrapd
service to receive and log SNMP trap messages

Command