# SNMP Trap Monitoring

Monitors ModSecurity WAF blocks, backup errors, and OPNsense gateway events via SNMP traps.

## How It Works

1. **ModSecurity** on kaburusvr sends WAF block traps to kaburuaibox (trap2sink 100.120.18.44)
2. **Backup scripts** send completion/error traps via SNMP
3. **OPNsense** sends gateway state change traps (UP/DOWN)
4. **Trap handler** logs to `/var/log/snmptrapd-events.log`
5. **snmp-trap-check.sh** reports last 24h activity to security cron

## Log Format

```
2026-08-16 17:33:07 |  |  | kaburusvr.tail5a4390.ts.net
UDP: [100.112.54.2]:44473->[100.120.18.44]:162
iso.3.6.1.2.1.1.3.0 = 2:10:40:42.30
iso.3.6.1.6.3.1.1.4.1.0 = iso.3.6.1.4.1.99999.1.1
iso.3.6.1.4.1.99999.1.1.1 = "ModSecurity: ..."
```

Log format: `DATE TIME | | | SOURCE` followed by trap OID lines.

## Script: snmp-trap-check.sh

Located at: `/home/kaburu/.hermes/scripts/snmp-trap-check.sh`

Uses 24h rolling window via `awk` date cutoff — counts only recent traps, not lifetime cumulative.

### Output Categories

| Alert | Condition |
|-------|-----------|
| 🛡️ ModSecurity WAF | Attacks or new signatures in last 24h |
| 💾 Backup errors | Error traps from Z840, ubuntu-svr, etc. |
| 🔌 Gateway events | OPNsense WAN state changes |
| ⚠️ High-volume source | Any source with >50 traps in 24h |

## Known Issues

### Lifetime vs Rolling Count (Fixed 2026-08-16)

Previously, backup errors and gateway events counted the entire 132K-line log. This produced misleading totals (e.g., "88 traps" stuck at the same number).

**Fix:** Changed to awk date filter matching the WAF check pattern. Now only reports traps from the last 24 hours.

## Related

- `modsec-classify.py` — WAF attack triage (24h window)
- Security check cron: runs every 30 minutes at :05 and :35
- SNMP trap handler: `snmptrapd` configured in `/etc/snmp/`