telegraf: SNMP Trap input does not properly handle non-string data

System info:

1.18.1 running in docker

Steps to reproduce:

When using the snmp_trap input plugin, some devices send traps with non utf-8 encoded strings, for instance:

snmpTrapEnterprise.0="jnxProductNameEX4500" sysUpTimeInstance="3297275066" jnxCmRescueChgTime.0="3297275065" jnxCmRescueChgDate.0="�	&+" jnxCmRescueChgSource.0="2" jnxCmRescueChgUser.0="user" jnxCmRescueChgState.0="2" 

Expected behavior:

See https://github.com/influxdata/telegraf/issues/9113#issuecomment-829585208

Actual behavior:

See https://github.com/influxdata/telegraf/issues/9113#issuecomment-829585208

Additional info:

About this issue

  • Original URL
  • State: open
  • Created 3 years ago
  • Comments: 15 (9 by maintainers)

Most upvoted comments

Hi, we were running into the same issue, in this case jnxCmCfgChgLatestDate (1.3.6.1.4.1.2636.3.18.1.3.0), which is also an SNMP DateAndTime object. Using snmpwalk we got:

$ snmpwalk -v2c -cpublic 10.0.0.1 1.3.6.1.4.1.2636.3.18.1.3.0
SNMPv2-SMI::enterprises.2636.3.18.1.3.0 = Hex-STRING: 07 E6 0A 04 10 2A 30 00 2D 04 00

We are using the json serializer which gave us:

\u0007\ufffd\n\u0004\u0010*0\u0000-\u0004\u0000

Comparing the two outputs, somehow the first two bytes 07 E6 are mangled by telegraf and replaced with \u0007\ufffd (maybe part of an internal data structure of telegraf?). This corresponds well to the observation of @adrianhardkor.

\u0007	???
\ufffd	???
\n	0A
\u0004	04
\u0010	10
*	2A
0	30
\u0000	00
-	2D
\u0004	04
\u0000	00

We now worked around the issue by base64 encoding the value using json_transformation, basically from:

json_transformation = '''
metrics{
  tags.agent_host: {
    "LastConfChange": fields.InfoLastConfChange,
  }
}
'''

to:

json_transformation = '''
metrics{
  tags.agent_host: {
    "LastConfChange": $base64encode(fields.InfoLastConfChange),
  }
}
'''

and base64 decoding the value in our application.

any update on this? we still cannot decode SystemClock fields from snmp traps from standard routers like Cisco Juniper “systemClock”: “\u0007\ufffd\u0003\u0015\u000b-*\u0001-\u0004\u0000”,