snmptrapd - Receive and log snmp trap messages.


snmptrapd [common options] [-P] [-o file] [-s] [-f] [-p port] [-e] [-l [d0-7]] [-a] [-C] [-c confFile] [-F FORMAT]


Snmptrapd is an SNMP application that receives and logs snmp trap messages sent to the SNMP-TRAP port (162) on the local machine.

The log messages are of the form:
Sep 17 22:39:52 suffern snmptrapd: Cold Start Trap (0) Uptime: 8 days, 0:35:46

Snmptrapd must be run as root so that UDP port 162 can be opened.


In addition to the command arguments described under snmpcmd(1) the following arguments are understood:


Print the logged messages to stderr.

-o file

Logs messages to a given file.

-p port

Specifies the port to run on, if the default 162 is not desired.


Log the messages to syslog(8). These syslog messages are sent with the level of LOG_WARNING, and to the LOG_LOCAL0 facility (by default). The demon will also fork away from its caller when the syslog facilities are used. This is the default unless the ’-P’ flag or ’-o’ flag is used.


Don’t do reverse translation from IP address to host name.

-l [d0-7]

Specifies the syslog facility to use, demon or local[0-7].


makes snmptrapd ignore AuthenticationFailure traps


Causes the application to dump input and output packets.


Turn debugging output on.


Don’t fork away from the caller when using syslog().


Don’t read the default set of configuration files.

-c confFile

Force the reading of confFile as a configuration file.


When logging to standard output, use the format in the string FORMAT.

FORMAT is a printf-like string. Snmptrapd interprets the following formatting sequences:


a literal %


decimal number of seconds since the operating system’s epoch


current year


current (numeric) month


current day of month


current hour


current minute


current second


up-time in seconds (in decimal)


the year field from the up-time


the numeric month field from the up-time


the day of month field from the up-time


the hour field from the up-time


the minute field from the up-time


the seconds field from the up-time


agent’s hostname if available, otherwise IP address


agent’s IP address


PDU’s hostname if available, otherwise IP address


PDU’s IP address


Enterprise string


Trap type (numeric, in decimal)


Trap description


Trap sub-type (numeric, in decimal)


Security information from the PDU (community name for v1/v2c, user and context for v3)


list of trap’s variables

In addition to these values, you may also specify an optional field width and precision, just as in printf, and a flag value. The following flags are legal:


left justify


use leading zeros


use alternate form

The "use alternate form" flag changes the behavior of some format flags. Normally, the fields that display time information base it on the local time, but this flag tells them to use GMT instead. Also, the variable list is normally a tab-separated list, but this flag changes it to a comma-separated one. The alternate form for the uptime is similar to "3 days, 0:14:34.65"


To get a message like "14:03 TRAP3.1 from" you could use something like this:

snmptrapd -P -F "%02.2h:%02.2j TRAP%w.%q from %A\n"

If you want the same thing but in GMT rather than local time, use

snmptrapd -P -F "%#02.2h:%#02.2j TRAP%w.%q from %A\n"


See the snmptrapd.conf(5) manual page.


snmpcmd(1), syslog(8), variables(5)