使用SNMPTT的变量替换功能，消息可以变的更友好，如在SNMPTT 配置文件中定义如下的格式：
FORMAT Logical Drive Status Change: Status is now $3.
那么上面收到的消息将会显示,可以看出，第三个变量rebuilding被替换显示出来： Feb 12 13:37:13 server11 TRAPD: .1.3.6.1.4.1.232.0.3008 Normal "XLOGONLY" server08 - Logical Drive Status Change: Status is now rebuilding
(1). Perl 5.6.1 or higher. SNMPTT is developed with 5.6.1 and 5.8.0, but other versions may also work.
(2). Required: Net-SNMP (formerly known as UCD-SNMP). Specifically snmptrapd.
(3). Required: Text::ParseWords module (included with most distributions including ActivePerl)
(4). Required: Getopt::Long module (included with most distributions including ActivePerl)
(5). Required: Posix module (included with most if not all distributions including ActivePerl)
(6). Required: Config::IniFiles module
(7). Required: Time::HiRes module (only required when using SNMPTT in daemon mode - required by snmptthandler)
(8). Required: Sys::Hostname module (included with most if not all distributions including ActivePerl).
(9). Required: File::Basename module (included with most if not all distributions including ActivePerl).
(10). Required: Text::Balanced module (included with most if not all distributions including ActivePerl).
第三行：禁止访问控制检查 will disable the above access control checks, and revert to the previous behaviour of accepting all incoming notifications.
第四行：禁止通知的日志记录disables the logging of notifications altogether. This is useful if the snmptrapd application should only run traphandle hooks and should not log traps to any location.
注： snmptrapd.conf有很多很多具体的参数配置，具体可以man一下。
2.FORMAT format_string
每个EVENT只能有一行FORMAT
使用如下的变量在字符串上进行变量替换： $A - Trap agent host name (see Note 1)
$aA - Trap agent IP address
$Be - securityEngineID (snmpEngineID) (see Note 7)
$Bu - securityName (snmpCommunitySecurityName) (see Note 7)
$BE - contextEngineID (snmpCommunityContextEngineID) (see Note 7)
$Bn - contextName (snmpCommunityContextName) (see Note 7)
$c - Category
$C - Trap community string
$D - Description text from SNMPTT.CONF or MIB file (see Note 6)
$E - Enterprise trap OID in symbolic format
$e - Enterprise trap OID in number format
$Fa - alarm (bell) (BEL)
$Ff - form feed (FF)
$Fn - newline (LF, NL)
$Fr - return (CR)
$Ft - tab (HT, TAB)
$Fz - Translated FORMAT line (EXEC only)
$G - Generic trap number (0 if enterprise trap)
$H - Host name of the system running SNMPTT
$S - Specific trap number (0 if generic trap)
$N - Event name defined in .conf file of matched entry
$i - Event OID defined in .conf file of matched entry (could be a wildcard OID)
$O - Trap OID in symbolic format (see Note 4)
$o - Trap OID in numerical format (see Note 4)
$R, $r - Trap hostname (see Note 1)
$aR, $ar - IP address
$s - Severity
$T - Uptime: Time since network entity was initialized
$X - Time trap was spooled (daemon mode) or current time (standalone mode)
$x - Date trap was spooled (daemon mode) or current date (standalone mode)
$# - Number of (how many) variable-bindings in the trap
$$ - Print a $
$@ - Number of seconds since the epoch of when the trap was spooled (daemon mode) or the current time (standalone mode)
$n - Expand variable-binding n (1-n) (see Note 2,5)
$+n - Expand variable-binding n (1-n) in the format of variable name:value (see Note 2,3,5)
$-n - Expand variable-binding n (1-n) in the format of variable name (variable type):value (see Note 2,3,5)
$vn - Expand variable name of the variable-binding n (1-n)(see Note 3)
$* - Expand all variable-bindings (see Note 5)
$+* - Expand all variable-bindings in the format of variable name:value (see Note 2,3,5)
$-* - Expand all variable-bindings in the format of variable name (variable type):value (see Note 2,3,5)
3.[EXEC command_string]
可以一个EVENT，多行EXEC。
当一个trap接收到后，则按照顺序执行命令。
EXEC使用的变量替换跟FORMAT行中的一样。 例如： EXEC /usr/bin/qpage -f TRAP alex "$r: $x $X - NIC switchover to slot $3, port $4 from slot $5, port $6"
EXEC c:\snmp\pager netops "$r: $x $X - NIC switchover to slot $3, port $4 from slot $5, port $6"
4.此次案例中snmptt.conf.cisco文件的内容为：
#端口开启操作定义 EVENT authenticationFailure .1.3.6.1.6.3.1.1.5.4 "Status Events" Normal
FORMAT Link Up
EXEC /apps/usr/nagios/libexec/eventhandlers/submit_check_result "$A" "Snmp_Trap" "2" "$2 $Fz"
#端口关闭操作定义 EVENT authenticationFailure .1.3.6.1.6.3.1.1.5.3 "Status Events" Normal
FORMAT Link Down
EXEC /apps/usr/nagios/libexec/eventhandlers/submit_check_result "$A" "Snmp_Trap" "2" "$2 $Fz"
5. PREEXEC
[PREEXEC command_string]
每个EVENT，可以有多行PREEXEC
当 一个trap收到后，在FORMAT和EXEC声明执行之前，要执行得语句和命令。外部程序的输出将保存在$pn变量中，n从1开始计数。当有多行 PREEXEC时，第一个PREEXEC存储结果到$p1，第二个PREEXEC将结果存在$p2。要开启这个功能，需要在snmptt.ini文件中， 设置pre_exec_enable选项
例子：
EVENT linkDown .1.3.6.1.6.3.1.1.5.3 "Status Events" Normal
FORMAT Link down on interface $1($p1). Admin state: $2. Operational state: $3
PREEXEC /usr/local/bin/snmpget -v 1 -Ovq -c public $aA ifDescr.$1
这个特色经常用在，对于相同的事件，一些需要按照常规处理，一些需要按照特殊处理。如
例一
NODES fred barney betty wilma
例二
NODES fred barney betty wilma
NODES MODE=NEG
7. MATCH [MATCH [MODE=[or | and]] | [$n:[!][( )[i] | n | n-n | > n | < n | x.x.x.x | x.x.x.x-x.x.x.x | x.x.x.x/x]]
匹配这个MATCH的trap，才可以引发相应的EVENT定义。
如果一条MATCH声明已经存在，没有trap匹配它，默认的，没有EVENT定义会被匹配。
如下的perl正则表达式被支持：
i – 忽略大小写
如下的命令模式可用：
MATCH MODE=[or | and]
MATCH $x: [!] (reg) [i]
MATCH $x: [!] n
MATCH $x: [!] n-n
MATCH $x: [!] < n
MATCH $x: [!] > n
MATCH $x: [!] & n
MATCH $x: [!] x.x.x.x
MATCH $x: [!] x.x.x.x-x.x.x.x
MATCH $x: [!] x.x.x.x/x
例如：
$2必须在1000到2000之间：MATCH $2: 1000-2000
任何匹配(or)：$3等于52，或者$4是IP地址段192.168.1.10－192.168.1.20，或者severity为Major：
MATCH $3: 52
MATCH $4: 192.168.1.10-192.168.1.20
MATCH $s: (Major)
全部匹配(and): $3大于20，$5不包含关键词alarm或者critical, $6 必须字符串’(1)remaining’ , $7 必须包含字符串’power’，不管是大写还是小写：
MATCH $3: >20
MATCH $5: !(alarm|critical)
MATCH $6: (\(1\) remaining)
MATCH $7: (power)i
MATCH MODE=and
如下的Perl正则表达式被支持：
i － 当匹配左侧时忽略大小写
g － 替换所有匹配的部分，而不是仅替换查找到的第一个匹配
e － 执行右侧的代码
为了使用capture替换，或者e参数，需要在snmptt.ini文件中设置allow_unsafe_regex为1
如果有多行REGEX，那么从上到下的处理，并且结果是累加的。即第二行处理第一行产生的结果。
例1：
处理前的FORMAT行：UPS has detected a building alarm. Cause: UPS1 Alarm #14: Building alarm 3.
计算
安全
数据库
网络和加速
企业服务
