SNMP Trap: Large Log Files
--------------------------

A trap is generated when large log files are detected in ``/var/log/``.

Identification

* The originating IP / hostname is used to identify the system generating the traps
* The NMS is responsible for associating traps with each managed system, along with clearing of alarms and escalation to the relevant system operator
* The trap OID is generic  for various SNMP events monitored by the system
* The SNMP system name is included as part of the variable binding to assist identification: 

  .iso.org.dod.internet.mgmt.mib-2.system.sysName.0 = standalone

Trap OID

.iso.org.dod.internet.mgmt.mib-2.dismanEventMIB.dismanEventMIBNotificationPrefix. dismanEventMIBNotifications.mteTriggerFired

Variable Bindings - large log files detected. 

* .iso.org.dod.internet.mgmt.mib-2.system.sysUpTime.0 = 2 minutes (12065)
* snmpTrapOID = mteTriggerFired
* .iso.org.dod.internet.mgmt.mib-2.dismanEventMIB.dismanEventMIBNotificationPrefix. dismanEventMIBNotificationObjects.mteHotTrigger.0 = 'ERROR: Log files larger than 1Gig found in /var/log'
* .iso.org.dod.internet.mgmt.mib-2.dismanEventMIB.dismanEventMIBNotificationPrefix. dismanEventMIBNotificationObjects.mteHotValue.0 = 1
* .iso.org.dod.internet.mgmt.mib-2.system.sysName.0 = standalone

Severity Messages:

* Info : INFO: /var/log rotated
* Urgent : ERROR: Log files larger than 1Gig found in /var/log 




Severity: Info Trap Example
...........................  

Message: INFO: /var/log rotated

::

   Notification message from (1, 3, 6, 1, 6, 1, 1):('192.22.21.124', 25035): 
   Var-binds:
   1.3.6.1.2.1.1.3.0 = 24804740
   1.3.6.1.6.3.1.1.4.1.0 = 1.3.6.1.2.1.88.2.0.1
   1.3.6.1.2.1.88.2.1.1.0 = INFO: /var/log rotated
   1.3.6.1.2.1.88.2.1.3.0 = /var/log rotated
   1.3.6.1.2.1.88.2.1.5.0 = 0
   1.3.6.1.2.1.1.5.0 = UN1-192.22.21.124




Severity: Urgent Trap Example
..............................  

Message: ERROR: Log files larger than 1Gig found in /var/log

::

   Notification message from (1, 3, 6, 1, 6, 1, 1):('192.22.21.124', 51928): 
   Var-binds:
   1.3.6.1.2.1.1.3.0 = 52324087
   1.3.6.1.6.3.1.1.4.1.0 = 1.3.6.1.2.1.88.2.0.1
   1.3.6.1.2.1.88.2.1.1.0 = ERROR: Log files larger than 1Gig found in /var/log 
   1.3.6.1.2.1.88.2.1.3.0 = Logrotation was executed to rotate the \
     following logs: /var/log/some.log: 7.3G
   1.3.6.1.2.1.88.2.1.5.0 = 1
   1.3.6.1.2.1.1.5.0 = UN1-192.22.21.124