If this is for Cisco boxes, you can use:
snmp-server enable traps syslog

This will generate a trap using the enterprise oid of 1.3.6.1.4.1.9.9.41.2

______________________________________________________________

Clayton Dukes
______________________________________________________________


On Thu, Dec 9, 2010 at 3:24 PM, Balazs Scheidler <bazsi@balabit.hu> wrote:

hi,

I just happened to be thinking about SNMP support. Cisco seems to have a
MIB for syslog->snmp translation. So if anyone volunteers to anything
related, I think this should be followed:

http://tools.cisco.com/Support/SNMP/do/BrowseOID.do?objectInput=clogMessageGenerated&translate=Translate&submitValue=SUBMIT


On Thu, 2010-12-09 at 11:54 -0800, Matthew Hall wrote:
> My advice, Net-SNMP via Perl if Perl is fast enough.
>
> Otherwise next easiest would be Westhawk SNMP via Java.
>
> If that won't work then Net-SNMP via C or SNMP++ via C++ is the fastest
> there is.
>
> I have a lot of experience writing SNMP network management software so I
> can try to get you straightened out if you run into trouble.
>
> Matthew.
>
> On Thu, Dec 09, 2010 at 01:05:26PM -0600, Martin Holste wrote:
> > I think program() is the best bet for you.  I haven't had anything like that
> > happen when using program().  What version of syslog-ng are you using?  I
> > don't think syslog-ng is sending newlines, but your script may be
> > interpreting "silence" from syslog-ng as nothing and appending a newline or
> > something.  If you post a snippet from your script showing how it's reading
> > from syslog-ng, that would help.  It would also help to see the config
> > relevant to the program() destination.
> >
> > On Thu, Dec 9, 2010 at 12:27 PM, Jay <difficult_id@yahoo.com> wrote:
> >
> > > Have a requirement to convert all incoming syslogs to SNMP traps and send
> > > it to another host. One option I could think of is to use program ()
> > > destination.
> > >
> > > When I tried this option, I find that syslog-ng is continuously sending
> > > newline characters to the specified program. i.e. even when no syslog is
> > > received, syslog-ng seems to be pumping newline chars to the specified
> > > program.
> > >
> > > Also I read the warning message in admin guide that, it will open up the
> > > door to DOS attack.
> > >
> > > Could someone let me know the best way to achieve this, please ?
> > >

--
Bazsi


______________________________________________________________________________
Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng
Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng
FAQ: http://www.campin.net/syslog-ng/faq.html