# SNMP Trap Monitoring
Monitors ModSecurity WAF blocks, backup errors, and OPNsense gateway events via SNMP traps.
## How It Works
1. ModSecurity on kaburusvr sends WAF block traps to kaburuaibox (trap2sink 100.120.18.44) 2. Backup scripts send completion/error traps via SNMP 3. OPNsense sends gateway state change traps (UP/DOWN) 4. Trap handler logs to `/var/log/snmptrapd-events.log` 5. snmp-trap-check.sh reports last 24h activity to security cron
## Log Format
``` 2026-08-16 17:33:07 | | | kaburusvr.tail5a4390.ts.net UDP: [100.112.54.2]:44473→[100.120.18.44]:162 iso.3.6.1.2.1.1.3.0 = 2:10:40:42.30 iso.3.6.1.6.3.1.1.4.1.0 = iso.3.6.1.4.1.99999.1.1 iso.3.6.1.4.1.99999.1.1.1 = “ModSecurity: …” ```
Log format: `DATE TIME | | | SOURCE` followed by trap OID lines.
## Script: snmp-trap-check.sh
Located at: `/home/kaburu/.hermes/scripts/snmp-trap-check.sh`
Uses 24h rolling window via `awk` date cutoff — counts only recent traps, not lifetime cumulative.
### Output Categories
| Alert | Condition |
| ——- | ———– |
| 🛡️ ModSecurity WAF | Attacks or new signatures in last 24h |
| 💾 Backup errors | Error traps from Z840, ubuntu-svr, etc. |
| 🔌 Gateway events | OPNsense WAN state changes |
| ⚠️ High-volume source | Any source with >50 traps in 24h |
## Known Issues
### Lifetime vs Rolling Count (Fixed 2026-08-16)
Previously, backup errors and gateway events counted the entire 132K-line log. This produced misleading totals (e.g., “88 traps” stuck at the same number).
Fix: Changed to awk date filter matching the WAF check pattern. Now only reports traps from the last 24 hours.
## Related
- `modsec-classify.py` — WAF attack triage (24h window) - Security check cron: runs every 30 minutes at :05 and :35 - SNMP trap handler: `snmptrapd` configured in `/etc/snmp/`