Moogsoft Docs

Configure the Trapd LAM

The Trapd LAM allows Moogsoft AIOps to receive and process trap messages as events.

You can configure the Trapd LAM to process SNMPv1 traps, SNMPv2 informs and, SNMPv3 traps and informs.

For an overview of trap processing and the different versions of SNMP see Ingest SNMP Traps .

Before You Begin

Before you set up your Trapd LAM integration, ensure you have met the following requirements:

  • Ensure port 162 , the default port for receiving SNMP traps over UDP, is available and open on Moogsoft AIOps. Alternatively configure another port to receive the traps.
  • You have parsed any MIB files into JSON format using the mibparser utility. See Parse MIBs for Trap Integration .
  • If using SNMPv3, you have generated t he engine ID of your SNMP application in hexadecimal format.

If you are configuring an HA deployment refer to High Availability first.

Configure the Trapd LAM

Edit the Trapd LAM configuration file to control the behavior of the Trapd LAM. You can find the file at $MOOGSOFT_HOME/config/trapd_lam.conf.

See the Trapd LAM Reference for a full description of all properties. Some properties are commented out by default. Uncomment properties to enable them.

  1. Configure the connection properties:

    • trap_port : Port the Trapd LAM uses to receive traps. SNMP agents typically send traps to port 162 via UDP.
    • concurrency : Maximum number of threads the Trapd LAM can use for receiving and processing traps.
    • name_resolution : Provides hostname of IP address the trap came from.

  2. Configure the Trapd LAM behavior:

    • event_ack_mode : Determines when Moogsoft AIOps acknowledges an event from the Trapd LAM during processing.
    • mib_db_file : Defines the location where the Mibparser utility exports and parses its MIB s. See Parse MIBs for Trap Integration for more details.

  3. O ptionally configure the USM file and engine ID properties if you want to use SNMPv3:

    • usm_file : Path to your User-based Security Model (USM) file t hat allows you to authenticate and encrypt messages for SNMPv3.
    • local_engine_id : Engine ID of the SNMP monitor that sends Inform messages to your Trap LAM.

  4. Configure the properties relating to your SNMP agent:

    • name : Name of the SNMP agent that is the source of the trap messages.
    • log : Location of the Trapd LAM log file.

Example

The following example shows a Trapd LAM that is able to process SNMPv3 traps and informs:

monitor:
{
	name            : "Trap Monitor",
    class           : "CTrapMonitor",
    trap_port       : 162,
    concurrency     : 5,
    name_resolution : false,
    event_ack_mode : "queued_for_processing"
    mib_db_file : "etc/myParsedMibs.json"
    usm_file: "$MOOGSOFT_HOME/config/trapd_usm.conf"
	local_engine_id: "03c4b11e3e"
}

Configure for High Availability

Configure the Trapd LAM for high availability if required. See Integrations HA Configuration for details.

Configure LAMbot Filtering

The Trapd LAMbot filters and processes Trapd LAM events using the "TrapdLam.js" stream, then sends them to the message bus.

The LAMbot moves overflow properties to custom info and performs any filtering you configure in the LAMbot file. See Data Parsing for details.

If you don’t want to map overflow properties, you can comment out the presend property in the filter section to bypass the LAMbot and send events straight to the message bus. This speeds up processing if you have a high volume of incoming email messages.

You can define a custom stream to receive Trapd LAM events. See Alert Builder Moolet for details.

filter:
{
	presend: "TrapdLam.js"
}

Start and Stop the LAM

Restart the Trapd LAM to activate any changes you make to the configuration file or LAMbot.

The LAM service name is trapdlamd .

See Control Moogsoft AIOps Processes for further details.