snmptrapd

snmptrapd is Net-SNMP's trap receiver - it listens for incoming SNMP traps and informs, and can log them, forward them, or hand each one off to a script for custom handling. This guide covers installing it, basic configuration, loading MIBs so trap output is readable, and wiring it up to a custom Python handler script.

Installing snmptrapd

# Debian / Ubuntu
sudo apt install snmptrapd

# RHEL / CentOS / Fedora
sudo dnf install net-snmp
# snmptrapd is included in the main net-snmp package on RHEL-family systems

Basic configuration

Configuration lives in /etc/snmp/snmptrapd.conf. At minimum, you need to tell it which community strings (v1/v2c) or users (v3) are allowed to send traps - by default, snmptrapd drops everything as unauthorized.

# /etc/snmp/snmptrapd.conf

# Accept v1/v2c traps sent with this community string
authCommunity log,execute,net public

# For SNMPv3, define a user the same way you would for snmpd
createUser myuser SHA "authpassword" AES "privpassword"
authUser log,execute,net myuser priv

The log,execute,net flags control what snmptrapd does with a matching trap: log writes it to the log, execute allows traphandle scripts to run for it, net allows forwarding.

Run it in the foreground first to confirm it's receiving traps before setting it up as a background service:

sudo snmptrapd -f -Lo -c /etc/snmp/snmptrapd.conf

-f keeps it in the foreground, -Lo logs to stdout instead of syslog, so you see traps arrive in real time. Once that's confirmed working, run it without -f (or via your init system) for normal operation.

Loading MIBs

Same mechanism as the client tools covered in the net-snmp guide - snmptrapd uses the same MIB search path and MIBS environment variable. Without the relevant MIB loaded, an incoming trap logs as a raw OID rather than a readable name like ciscoEnvMonTemperatureNotification. Either set MIBS=+ALL in the environment snmptrapd runs under, or add specific MIBs via -m:

sudo snmptrapd -f -Lo -m +CISCO-ENVMON-MIB -c /etc/snmp/snmptrapd.conf

Pointing snmptrapd at a handler script

The traphandle directive in snmptrapd.conf runs an external script for every matching trap, passing the trap's variable bindings on stdin. This is the mechanism for anything beyond logging - writing to a database, sending an alert, triggering automation.

# /etc/snmp/snmptrapd.conf
traphandle default /usr/local/bin/traphandler.py

default matches every trap OID; you can also target a specific one, e.g. traphandle 1.3.6.1.6.3.1.1.5.3 /usr/local/bin/linkdown_handler.py for only linkDown traps.

Example traphandle script (Python)

snmptrapd writes the trap to the script's stdin as plain text: the source host on the first line, the source IP/port on the second, then one OID value pair per line for every variable binding in the trap.

#!/usr/bin/env python3
"""
Minimal snmptrapd traphandle script - reads a trap from stdin and
logs it to a file. Wire this up with:
    traphandle default /usr/local/bin/traphandler.py
"""
import sys
import datetime

LOG_FILE = "/var/log/snmp-traps.log"

def main():
    lines = sys.stdin.read().splitlines()
    if len(lines) < 2:
        return  # malformed/empty input, nothing to do

    hostname = lines[0]
    source = lines[1]
    varbinds = lines[2:]

    timestamp = datetime.datetime.now().isoformat()
    with open(LOG_FILE, "a") as f:
        f.write(f"[{timestamp}] Trap from {hostname} ({source})\n")
        for line in varbinds:
            f.write(f"    {line}\n")

if __name__ == "__main__":
    main()

Make it executable (chmod +x /usr/local/bin/traphandler.py) and confirm the shebang line points at a Python 3 that's actually on the system's PATH. From here, this is where you'd add real logic - parsing a specific varbind by OID, filtering on which trap it is, calling out to a notification API, and so on.