You can add custom plugins that activate after the SNMP filtering process. However, you still need to configure SNMP trap filters by OID as you currently do. The plugin will activate only after a trap has passed through the filtering stage.

Multiple custom plugins can be created. The system executes file logic by sorting "textkey" in alphabetical order. At startup, all provided plugins load, and the system checks for new ones.

Trap processing

When processing a trap:

1. If the trap passes the initial SNMP filter, it will be passed through each loaded plugin in order.

2. Processing stops if any plugin returns True.
   - A log entry is added indicating that the plugin handled the trap.
   - The trap is marked with a Filtered status.
   - The corresponding SNMPTrapQueue record is deleted from the database.

Plugin installation

Custom plugins should be added to the /usr/share/onsight/custom-traps directory on the host VM. These plugins must subclass the SNMPTrapPlugin parent class, which defines a single method:

class SNMPTrapPlugin:
    def filter_trap(self, source_ip, source_hostname, trap_oid, varbinds):

• varbinds: A dictionary of OID - value mappings for all OIDs in the trap payload.

The filter_trap() method must return a Boolean value:

• True: Indicates that the plugin acted on the trap and further processing should stop.

• False: Means the plugin did not take action on the trap.

For example:

Plugin path: /usr/share/onsight/custom-traps/

Each queue will process every script in the directory above. The resolved varbinds from the SNMP trap will serve as input for this plugin.

The custom plugin file name under /usr/share/onsight/custom-traps/ can be any name except SNMPTrapPlugin.py.

Creating a custom SNMP trap plugin

1. Create an SNMP trap filter. In this example, we will use 1.3.6.1.4.1.50345 as the base OID.

2. Create the plugin in the /usr/share/onsight/custom-traps directory on the host VM.

import logging
from SNMPTrapPlugin import SNMPTrapPlugin

class Plugin3(SNMPTrapPlugin):
    textkey = "plugin0529"
    name = "plugin0529"

    def filter_trap(self, source_ip, source_hostname, trap_oid, varbinds: dict) -> bool:
        logging.info(f"{source_ip}, {source_hostname}, {trap_oid}, {varbinds}")
        if source_ip == "50.171.247.250":
            return True
        return

3. Verify in the logs that the trap was not processed.