[[inputs.snmp_trap]] the source field of tags is not used

[gesnaud]

Relevant telegraf.conf

[[inputs.snmp]]
  agents = ["tcp://172.16.3.2:1612"]
  agent_host_tag = "agent_host"
  #agent_host_tag = "source"
   [inputs.snmp.tags]
     input_type ="snmp_polling_kikoo"
     source = "source_polling_snmp"

[[inputs.snmp_trap]]
  service_address = "udp://X.X.X.X:162"
  #version = "2c"
  #path = ["/usr/share/snmp/mibs"]
  [inputs.snmp_trap.tags]
     input_type ="snmp_trap_kikoo"
     source = "source_trap_snmp"

Logs from Telegraf

snmp_trap,community=test_snmp,host=my-vm,input_type=snmp_trap_kikoo,mib=SMI-MIB,name=linuxMacLearn,oid=.1.3.6.1.4.1.0.2,source=172.16.3.2,version=2c sysUpTimeInstance=2705239i,dot1qTpFdbPort.1006.170.193.171.206.157.182=1i 1761754429892330009

System info

Telegraf 1.36.2 / Ubuntu 24.04.3 LTS (Noble Numbat)

Docker

No response

Steps to reproduce

...

Expected behavior

I expect to have this:

snmp_trap,community=test_snmp,host=my-vm,input_type=snmp_trap_kikoo,mib=SMI-MIB,name=linuxMacLearn,oid=.1.3.6.1.4.1.0.2,source=source_trap_snmp,version=2c sysUpTimeInstance=2705239i,dot1qTpFdbPort.1006.170.193.171.206.157.182=1i 1761754429892330009

Actual behavior

I actually have this:

snmp_trap,community=test_snmp,host=my-vm,input_type=snmp_trap_kikoo,mib=SMI-MIB,name=linuxMacLearn,oid=.1.3.6.1.4.1.0.2,source=172.16.3.2,version=2c sysUpTimeInstance=2705239i,dot1qTpFdbPort.1006.170.193.171.206.157.182=1i 1761754429892330009

Additional info

Even if you switch the agent_host_tag from agent_host to source, I never have the expected value.

Also important ot note is that the field source of the plugin SNMP is working well: For SNMP (ie not SNMP trap plugin):

• If agent_host_tag is source, I have source_polling_snmp in logs.
• If I set agent_host_tag to agent_host, I have the IP adress in logs.

Conclusion: I expect SNMP TRAP plugin behavior be the same as SNMP plugin for the source attribute

[Hipska]

You can add this to override the snmp_trap behaviour:

[[processors.override]]
  namepass = "snmp_trap"

  [processors.override.tags]
    source = "source_trap_snmp"

The actual behaviour is normal, as the source tag should be where the IP of the agent sending the trap (source) is stored.

[gesnaud]

Thanks for your answer @Hipska !

The actual behaviour is normal, as the source tag should be where the IP of the agent sending the trap (source) is stored.

Well, I'm confused with the hability to still have access to source configuration in inputs.snmp_trap.tags if the normal beahivor is to have the ip address of the trap receiver? Why not removing this option then?

[Hipska]

The tags you define there are some kind of default. Their value will be used if the plugin itself did not yet create a tag with the same name yet. Hope this clears up the confusion.

[gesnaud]

The tags you define there are some kind of default. Their value will be used if the plugin itself did not yet create a tag with the same name yet. Hope this clears up the confusion.

Hello @Hipska ! Thx for your support... But, sorry, I'm still confused...

On one hand, I still not understand that the snmp plugin config agent_host_tag should have an impact on toher pluging like snmp_trap plugin:

However, to have a consistent experience, set this to "source" in your config to align with other plugins. AFAIU, this is not the case as observed? You agree that other plugins means snmp_trap plugin also?

On second hand, I don't get you when you say Their value will be used if the plugin itself did not yet create a tag with the same name yet. I understood from your sentence that the config below (source in particular):

[[inputs.snmp_trap]]
  service_address = "udp://X.X.X.X:162"
  [inputs.snmp_trap.tags]
     input_type ="snmp_trap_kikoo"
     source = "source_trap_snmp"

will be activated only the plugin itself (snmp_trap here) did not create a tag with the same name like in the code below:

[[inputs.snmp_trap]]
  service_address = "udp://X.X.X.X:162"
  source ="i_have_the_precedence_here"

But this is not working...

Thanks for your support!

[Hipska]

Source is always present on metrics from snmp_trap, so extra defining it on the input tags will have no effect. As said, if you want to override that tag, you will need to do with the override processor.

[telegraf-tiger[bot]]

Hello! I recommend posting this question in our Community Slack or Community Forums, we have a lot of talented community members there who could help answer your question more quickly. You can also learn more about Telegraf by enrolling at InfluxDB University for free!

Heads up, this issue will be automatically closed after 7 days of inactivity. Thank you!