I am trying to receive SNMP traps from a Cisco Wireless LAN Controller. I installed the SNMP_TA app, added a MIB file (SNMPv2-MIB) from Cisco, and originally setup using port 162. After saving I searched for " " and saw the following message:
"ERROR ExecProcessor - message from "python /opt/splunkinstall/splunk/etc/apps/snmp_ta/bin/snmp.py" Failed to register transport and run dispatcher: bind() for ('localhost', 162) failed: [Errno 13] Permission denied snmp_stanza:snmp://XXXXXX".
I then added aN iptables rule:
iptables -t nat -A PREROUTING -i eth0 -p udp --dport 162 -j REDIRECT --to-port 8166
and changed the data input to be equal to 8166. There are no other rules in my iptables. I then did a search for index=_internal error ExecProcessor snmp.py and saw no errors, but I see no SNMP data when I search for sourcetype=SNMP_TA .
Additionally when I do a TCPdump for the host that is supposed to be sending the data, I see the traps.
Below are my input settings as they exist now:
SNMP Mode = Listen for traps
IP Version 6 = Not checked
SNMP Version = 2c
Community String = XXXXXX
MIB Names = SNMPv2-MIB
Response Handler = BLANK
Response Handler Arguments = BLANK
TRAP listener host = XXXXX.XXX.com
TRAP listener port = 8166
Reverse DNS lookup of trap sources = Not checked
Set sourcetype * = Manual
Source Type = cisco:asa
Host field value = localhost.localdomain
Index = access
... View more