security:snmp-trap-monitoring

# SNMP Trap Monitoring

Monitors ModSecurity WAF blocks, backup errors, and OPNsense gateway events via SNMP traps.

## How It Works

1. ModSecurity on kaburusvr sends WAF block traps to kaburuaibox (trap2sink 100.120.18.44) 2. Backup scripts send completion/error traps via SNMP 3. OPNsense sends gateway state change traps (UP/DOWN) 4. Trap handler logs to `/var/log/snmptrapd-events.log` 5. snmp-trap-check.sh reports last 24h activity to security cron

## Log Format

``` 2026-08-16 17:33:07 | | | kaburusvr.tail5a4390.ts.net UDP: [100.112.54.2]:44473→[100.120.18.44]:162 iso.3.6.1.2.1.1.3.0 = 2:10:40:42.30 iso.3.6.1.6.3.1.1.4.1.0 = iso.3.6.1.4.1.99999.1.1 iso.3.6.1.4.1.99999.1.1.1 = “ModSecurity: …” ```

Log format: `DATE TIME | | | SOURCE` followed by trap OID lines.

## Script: snmp-trap-check.sh

Located at: `/home/kaburu/.hermes/scripts/snmp-trap-check.sh`

Uses 24h rolling window via `awk` date cutoff — counts only recent traps, not lifetime cumulative.

### Output Categories

Alert	Condition
——-	———–
🛡️ ModSecurity WAF	Attacks or new signatures in last 24h
💾 Backup errors	Error traps from Z840, ubuntu-svr, etc.
🔌 Gateway events	OPNsense WAN state changes
⚠️ High-volume source	Any source with >50 traps in 24h

## Known Issues

### Lifetime vs Rolling Count (Fixed 2026-08-16)

Previously, backup errors and gateway events counted the entire 132K-line log. This produced misleading totals (e.g., “88 traps” stuck at the same number).

Fix: Changed to awk date filter matching the WAF check pattern. Now only reports traps from the last 24 hours.

## Related

- `modsec-classify.py` — WAF attack triage (24h window) - Security check cron: runs every 30 minutes at :05 and :35 - SNMP trap handler: `snmptrapd` configured in `/etc/snmp/`