Sending traps

This section describes how to configure basic SNMP support on the Endpoint Security (HX) appliance, enable and configure traps, and set up trap logging. For detailed information about SNMP commands and options for more advanced configurations, see the Trellix CLI Command Reference.

Enabling and configuring traps

Various events can trigger the appliance to send traps to the SNMP manager. Most of the events are enabled by default. This topic describes how to enable the appliance to send traps, configure the IP address of the SNMP manager that receives the traps, and disable and enable individual events.

Prerequisites

Operator or Admin access

To enable traps and events:

Go to CLI configuration mode:

hostname > enable
hostname # configure terminal

SNMP is enabled by default. Verify that it is enabled:
```
hostname (config) # show snmp
                     
```
If the output shows SNMP enabled: no, enter the snmp-server enable command.
Enable the appliance to send notifications to the SNMP manager:
```
hostname (config) # snmp-server enable notify
```

Specify the IP address of the SNMP manager:

hostname (config) # snmp-server host <IPAddress> traps public

Save your changes.
```
hostname (config) # write memory
```

To view the events that can be enabled or are currently enabled:

Go to CLI configuration mode:

hostname > enable
hostname # configure terminal

View a list of all events that can be enabled:

hostname (config) # snmp-server notify event ?

View the events that are currently enabled:

hostname (config) # show snmp events

To disable or enable specific events:

Go to CLI configuration mode:

hostname > enable
hostname # configure terminal

Disable an event:

hostname (config) # no snmp-server notify event <event>

For example, the following command stops a trap from being sent when the temperature of the appliance is normal:

hostname (config) # no snmp-server notify event normal-temperature

Enable an event:

hostname (config) # snmp-server notify event <event>

For example, the following command enables the appliance to send a trap when there is a change in an interface link:

hostname (config) # snmp-server notify event if-link-change

Save your changes:

hostname (config) # write memory

Logging trap messages

The snmptrapd service receives and logs trap messages.

To set up trap logging:

Log into the SNMP manager application.
Enable the snmptrapd service:
```
snmptrapd
```
Specify the log location:
```
/var/log/snmptrapd.log
```