ACE Appliance snmp traps

Hi,
I have an Appliance with an Admin context (for management) and a User context (for the Internet-facing VIP's). I can monitor the User context using snmp via the Admin context no problem, but I really want traps from the User context to be forwarded from the Admin context (otherwise I need to mess about with routing and firewalls to get the traps to the right place).
I don't think it's possible, but I could be missing something - anyone managed to get this to work?
thanks,
Andrew.

HI Andrew ,
Kindly tell where you want to transfer your traps , this is not clear from your mail.
Please specify.
Thanks and regards,
Sachin Garg
Senior Specialist Security
HCL Comnet Ltd.
http://www.hclcomnet.co.in
A-10, Sector 3, Noida- 201301
INDIA
Mob: +91-9911757733
Email: [email protected]

Similar Messages

Anm 4.1 support for receiving snmp traps from CSS / ACE

Hi
Does anyone have an ANM 4.1 installation that is accepting snmp traps from their CSSes / ACEs?
If I configure CSSes / ACEs to send snmp v1 traps to anm, they never appear in the Monitor -> Events view.
I've tried both the ANM 4.1 Virtual Appliance and ANM 4.1 running on RHEL and it seems that there's nothing listening on udp port 162 to receive the snmp traps.
From the virtual appliance:
admin# show ports
Process : java (5999)
     tcp: 0.0.0.0:40000, 0.0.0.0:40001, 127.0.0.1:10023, 0.0.0.0:10443, 0.0.0.0:
10003, 0.0.0.0:10004, 0.0.0.0:8443
     udp: 0.0.0.0:39182, 0.0.0.0:10003, 0.0.0.0:6120
Process : rpc.statd (2348)
     tcp: 0.0.0.0:834
     udp: 0.0.0.0:828, 0.0.0.0:831
Process : mysqld (3125)
     tcp: 0.0.0.0:3306
Process : java (5992)
     tcp: 0.0.0.0:10444, 0.0.0.0:10445
Process : portmap (2312)
     tcp: 0.0.0.0:111
     udp: 0.0.0.0:111
Process : monit (2779)
     tcp: 0.0.0.0:2812
Process : java (2952)
     tcp: :::40002
Process : java (2966)
     tcp: :::40003
Process : sshd (2625)
     tcp: :::22
Process : ntpd (2606)
     udp: 127.0.0.1:123, 0.0.0.0:123, ::1:123, :::123
I notice that port 443 isn't in here and I'm accessing the web interface using this port so perhaps there's something else going on behind the scenes.
Can anyone point me in the right direction to get snmp traps shown as events in ANM 4.1?
Thanks very much

hi.
as per documentation:
http://www.cisco.com/en/US/docs/app_ntwk_services/data_center_app_services/application_networking_manager/4.1/user/guide/UG_monitor.html#wp1176870
you need to send snmpv2 to anm. can you try v2 traps and see if it works?
Regards,
Fadi.

ACE and ANM, Syslog and SNMP Traps

Hi guys.. another ACE/ANM question.
I configured the ACE devices to send Syslog and SNMP messages to the ANM server. But i got a couple of questions:
Whats the difference between using the:
logging history 4 (this would send logging messages as SNMP traps according to doc)
And:
snmp-server host x.x.x.x traps version 2c public
snmp-server trap-source vlan 1000
This of course I think should do the same..
The funny and weird thing, in the ANM Event viewer, I can only see syslog messages, not one snmp event.
Thanks!
Omar
PS: ACE ver A2.4
ANM Ver 4.2

Hi Omar,
Let's see if I can clarify your questions.
As you mentioned, the "logging history 4" command specifies that, syslog messages of severity 4 and higher will be sent as SNMP traps. After you configure it, you need the "snmp-server host x.x.x.x traps version 2c public" command to specify what will be the destination IP and SNMP community for these traps.
It would only make sense to use the "logging history 4" command if your monitoring application doesn't support receiving syslog messages. However, since ANM is able to get syslog messages from the ACE without issues, I would just configure a destination for syslog message instead (with "logging host x.x.x.x")
I hope this makes this point more clear.
Now, moving on to why you are not seeing any SNMP traps in your ANM, the first things you would need to check are:
-- Did you enable traps? You would use the "ACE(config)# snmp-server enable traps" command for this
-- Are traps being sent? You can use the "show snmp" command and check if the "Trap PDUs" counter increases
-- Is ANM getting these traps? This is the most complicated step. For this, I would recommend getting a traffic capture on the ANM server (if it's installed on linux) or as close as possible to it if it's a ANM appliance
I hope this helps
Daniel

ACE 4710 SNMP false linkup/down trap notification?

We have two ACE4710 in a failover configuration with Software version A4(2.0). SNMP is setup and the receiver is able to receive SNMP traps.
The issue is we are receiving a linkDown trap notification at least once every other day, followed shortly by a linkUp notification a minute later. We have checked all layer 2 devices connected to the ACE and cannot see any evidence that any link actually disconnected. We experienced no traffic lost, but this could be because a couple of the ACE links are bundled. The trap notification does not actually indicate which interface changed status. All links are Gigabits, and there are no packet drops either on the ACE or the layer 2 switch. What could be causing this?
Thanks in advance.

Hi Matthew, apologies for the late reply, and thanks for getting back to me. Please find below the output on our SNMP receiver today. As you will see from the log timestamp the linkdown and linkup occurred within a minute which is typical. We get this issue at least once every other day!
Notification Type: PROBLEM
Service: Link
Host: ldmzbmh001
Address: x.x.x.x
State: CRITICAL
Date/Time: Thu Feb 21 11:18:35 GMT 2013
Additional Info:
A linkDown trap signifies that the SNMP entity, acting in 16777312 up down
Notification Type: PROBLEM
Service: Link
Host: ldmzbmh001
Address: x.x.x.x
State: CRITICAL
Date/Time: Thu Feb 21 11:18:35 GMT 2013
Additional Info:
A linkDown trap signifies that the SNMP entity, acting in 65540 up down
Notification Type: RECOVERY
Service: Link
Host: ldmzbmh001
Address: x.x.x.x
State: OK
Date/Time: Thu Feb 21 11:19:05 GMT 2013
Additional Info:
A linkUp trap signifies that the SNMP entity, acting in an 16777312 up up
Regards,
Sam

Cisco Prime Infrastructure 1.4 SNMP Traps are not converted into Alarms

Hi everybody,
I just configured SNMP Traps on a Cisco Catalyst 3750-x to send to our Cisco Prime Infrastructure 1.4 Appliance.
Now I forced the Switch to send some traps (Power off a Power Supply, Interface errdisable). The only events I see in Alarms & Events on PI is the same information message everytime:
Configuration management event has been recorded in ccmHistoryEventTable.
I think the forced traps should be converted into alarms? Why can't I see them?
Thanks,
Marc

Ok, I started debugging as you said. I get the following output:
Mar 13 09:28:13.711: SNMP: V2 Trap, reqid 11689, errstat 0, erridx 0
sysUpTime.0 = 198609846
snmpTrapOID.0 = ciscoSyslogMIB.2.0.1
clogHistoryEntry.2.1688 = PM
clogHistoryEntry.3.1688 = 5
clogHistoryEntry.4.1688 = ERR_RECOVER
clogHistoryEntry.5.1688 = Attempting to recover from bpduguard err-disable state on Gi1/0/13
clogHistoryEntry.6.1688 = 198609844
Mar 13 09:28:13.737: SNMP: Queuing packet to xx.xx.xx.xx
Looks like the Switch is sending SNMP Traps from the ciscoSyslogMIB. Is this why PI can't show the Traps and convert it into a alarm?
After this test I configured logging (syslog) to the PI. Now the errors are showed but still not converted into alarms. I just want to be notified by email when such errors occurs.
Thanks,
Marc

Logging user commands in Cisco ACE appliance

Good afternoon gentlemen
I need to configure the same as shown below in Cisco ACE Appliance. The requirement is logging all user access login (whether failed or succeeded) and also logging all commands that users issue.
#IOS commands
no logging console
logging buffered 307200 informational
service timestamps log datetime localtime show-timezone
logging trap debugging
login on-failure log
login on-success log
archive
   log config
      logging enable
      logging size 500
      hidekeys
      notify syslog contenttype plaintext
If you guys have an idea please answear
Regards
Christian

Hello Arun,
we saw before the message you report, it's probably a symptom of:
CSCtx03563
or
CSCue38032
I would suggest opening a TAC case to get this properly investigated.
Kind Regards,
Francesco

Anyone have succes configuring SNMP traps?

anyone have succes testing SNMP with snmptrap command?
Hello,
I am new to Ironport and the setup configuration of these devices. I am in the process of testing the snmp feature of these servers. As such I have configured the SNMP via snmpconfig command. From customer support I tried to enter the process for alerts and have not been able to get anything. https://ironport.custhelp.com/cgi-bin/ironport.cfg/php/enduser/std_adp.php?p_faqid=949&p_li=cF91c2VyaWQ9MXJvblAwcnQmcF9wYXNzd2Q9Zm8wQmE1
Is the link to process. I suspect that the traps are not being sent from the appliance. I have gone over the Doc for the configuration and can't see any errors. I have AsyncOS 6.4 for IronPort M660. This is the Admin server for a C150 and C350. Of which I can get no snmp traps either. The snmp manager is CA if that helps. Is there a log file on Ironport to verify taht traps have been sent? I see my command in the CLI log file.

The main issue is not being able to send a snmp trap to a CA NSM agent. Anyone been down this road before????

Cisco ACS SNMP Traps

Is it possible to send an SNMP trap from Cisco ACE 4710 for any configuration changes that occurs?
Regards,
Hesham

Hi Hesham,
these are the traps which are supported by ACE.
http://www.cisco.com/en/US/docs/interfaces_modules/services_modules/ace/vA5_1_0/configuration/administration/guide/snmp.html#wp1177230
read section "ACE SNMP Notifications (Traps)"
I do not see a trap which is useful for your requirement.
regards,
Ajay Kumar

SNMP traps configuration doesn't work in CUSTOMER-CONTEXT

Hi evryone;
I'm having some issues configurin SNMP traps on a ASA5520 USER-CONTEXT (Cisco Adaptive Security Appliance Software Version 8.2(4)):
I had already configured SNMP traps on ADMIN-CONTEXT and traps were getting the correspondig NETCOOL SERVERS (10.105.27.115 and 10.105.27.118) as you can see in point 2).
Cuold you please give me any clue of why I get this output for a non ADMIN-CONTEXT and why I do not even see SNMP packets output
1) CUST-09-CONTEXT
name 10.105.27.115 Netcool1_TESTBED description Netcool1_TESTBED SNMP server.
name 10.105.27.118 Netcool2_TESTBED description Netcool2_TESTBED SNMP server.
snmp-server community sjnemdhqksptabld
snmp-server host CUST-09-HCS-MNGT-TRANSIT Netcool1_TESTBED community sjnemdhqksptabld version 2c
snmp-server host CUST-09-HCS-MNGT-TRANSIT Netcool2_TESTBED community sjnemdhqksptabld version 2c
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart
snmp-server enable traps syslog
route CUST-09-HCS-MNGT-TRANSIT 10.105.27.0 255.255.255.0 192.168.228.1 1
CAPTURES
Lab-asa1-p/CUST-09-CONTEXT/act# capture TEST1 interface CUST-09-HCS-MNGT-TRANSIT match ip host 10.105.27.115 any
Lab-asa1-p/CUST-09-CONTEXT/act# show capture TEST1 trace detail
23 packets captured
   1: 15:17:16.373927 1200.0314.0600 0000.0c9f.fc14 0x8100 118: 802.1Q vlan#3092 P0 192.168.228.4 > 10.105.27.115: icmp: echo request (ttl 255, id 9815)
   2: 15:17:18.370433 1200.0314.0600 0000.0c9f.fc14 0x8100 118: 802.1Q vlan#3092 P0 192.168.228.4 > 10.105.27.115: icmp: echo request (ttl 255, id 10598)
   3: 15:17:20.370433 1200.0314.0600 0000.0c9f.fc14 0x8100 118: 802.1Q vlan#3092 P0 192.168.228.4 > 10.105.27.115: icmp: echo request (ttl 255, id 27648)
   4: 15:17:22.370433 1200.0314.0600 0000.0c9f.fc14 0x8100 118: 802.1Q vlan#3092 P0 192.168.228.4 > 10.105.27.115: icmp: echo request (ttl 255, id 3518)
   5: 15:17:24.370433 1200.0314.0600 0000.0c9f.fc14 0x8100 118: 802.1Q vlan#3092 P0 192.168.228.4 > 10.105.27.115: icmp: echo request (ttl 255, id 18995)
   6: 15:17:43.015258 1200.0314.0600 0000.0c9f.fc14 0x8100 118: 802.1Q vlan#3092 P0 192.168.228.4 > 10.105.27.115: icmp: echo request (ttl 255, id 2110)
   7: 15:17:45.010436 1200.0314.0600 0000.0c9f.fc14 0x8100 118: 802.1Q vlan#3092 P0 192.168.228.4 > 10.105.27.115: icmp: echo request (ttl 255, id 11567)
   8: 15:17:47.010436 1200.0314.0600 0000.0c9f.fc14 0x8100 118: 802.1Q vlan#3092 P0 192.168.228.4 > 10.105.27.115: icmp: echo request (ttl 255, id 25551)
   9: 15:17:49.010436 1200.0314.0600 0000.0c9f.fc14 0x8100 118: 802.1Q vlan#3092 P0 192.168.228.4 > 10.105.27.115: icmp: echo request (ttl 255, id 3716)
10: 15:17:51.010436 1200.0314.0600 0000.0c9f.fc14 0x8100 118: 802.1Q vlan#3092 P0 192.168.228.4 > 10.105.27.115: icmp: echo request (ttl 255, id 20820)
11: 15:48:16.998483 1200.0314.0600 0000.0c9f.fc14 0x8100 118: 802.1Q vlan#3092 P0 192.168.228.4 > 10.105.27.115: icmp: echo request (ttl 255, id 25423)
12: 15:48:18.990366 1200.0314.0600 0000.0c9f.fc14 0x8100 118: 802.1Q vlan#3092 P0 192.168.228.4 > 10.105.27.115: icmp: echo request (ttl 255, id 30357)
13: 15:48:20.990366 1200.0314.0600 0000.0c9f.fc14 0x8100 118: 802.1Q vlan#3092 P0 192.168.228.4 > 10.105.27.115: icmp: echo request (ttl 255, id 31174)
14: 15:48:22.990366 1200.0314.0600 0000.0c9f.fc14 0x8100 118: 802.1Q vlan#3092 P0 192.168.228.4 > 10.105.27.115: icmp: echo request (ttl 255, id 10878)
15: 15:48:39.735527 1200.0314.0600 0000.0c9f.fc14 0x8100 118: 802.1Q vlan#3092 P0 192.168.228.4 > 10.105.27.115: icmp: echo request (ttl 255, id 8146)
16: 15:48:41.730354 1200.0314.0600 0000.0c9f.fc14 0x8100 118: 802.1Q vlan#3092 P0 192.168.228.4 > 10.105.27.115: icmp: echo request (ttl 255, id 1803)
17: 15:49:01.881134 1200.0314.0600 0000.0c9f.fc14 0x8100 46: 802.1Q vlan#3092 P0 192.168.228.4.49175 > 10.105.27.115.33434: [udp sum ok] udp 0 [ttl 1] (id 15279)
18: 15:49:01.881744 1200.0314.0600 0000.0c9f.fc14 0x8100 46: 802.1Q vlan#3092 P0 192.168.228.4.49175 > 10.105.27.115.33435: [udp sum ok] udp 0 [ttl 1] (id 20090)
19: 15:49:01.884201 1200.0314.0600 0000.0c9f.fc14 0x8100 46: 802.1Q vlan#3092 P0 192.168.228.4.49175 > 10.105.27.115.33436: [udp sum ok] udp 0 [ttl 1] (id 24847)
20: 15:49:01.886672 1200.0314.0600 0000.0c9f.fc14 0x8100 46: 802.1Q vlan#3092 P0 192.168.228.4.49175 > 10.105.27.115.33437: [udp sum ok] udp 0 (ttl 2, id 8822)
21: 15:49:04.880356 1200.0314.0600 0000.0c9f.fc14 0x8100 46: 802.1Q vlan#3092 P0 192.168.228.4.49175 > 10.105.27.115.33438: [udp sum ok] udp 0 (ttl 2, id 20949)
22: 15:49:07.880371 1200.0314.0600 0000.0c9f.fc14 0x8100 46: 802.1Q vlan#3092 P0 192.168.228.4.49175 > 10.105.27.115.33439: [udp sum ok] udp 0 (ttl 2, id 9126)
23: 15:49:10.880340 1200.0314.0600 0000.0c9f.fc14 0x8100 46: 802.1Q vlan#3092 P0 192.168.228.4.49175 > 10.105.27.115.33440: [udp sum ok] udp 0 (ttl 3, id 24404)
23 packets shown
I had already configured SNMP traps on ADMIN-CONTEXT and traps were getting the correspondig NETCOOL SERVERS:
2) CONFIGURATION ADMIN-CONTEXT
IP Management ASA-FW -->10.105.89.38
interface GigabitEthernet0/3.710
nameif management
security-level 100
ip address 10.105.89.38 255.255.255.192 standby 10.105.89.39
management-only
name 10.105.27.115 Netcool1_TESTBED description Netcool1_TESTBED SNMP server.
name 10.105.27.118 Netcool2_TESTBED description Netcool2_TESTBED SNMP server.
snmp-server community sjnemdhqksptabld
snmp-server host management Netcool1_TESTBED community sjnemdhqksptabld version 2c
snmp-server host management Netcool2_TESTBED community sjnemdhqksptabld version 2c
snmp-server enable traps snmp authentication linkup linkdown coldstart
snmp-server enable traps syslog
ip route 0.0.0.0 0.0.0.0 10.105.89.1
CAPTURES : I could see 206 SNMP packets output and traffic towards the NETCOOL SERVERS (10.105.27.115 AND 10.105.27.118)
Lab-asa1-p/ADMIN-CONTEXT/act# sh snmp statistics
0 SNMP packets input
    0 Bad SNMP version errors
    0 Unknown community name
    0 Illegal operation for community name supplied
    0 Encoding errors
    0 Number of requested variables
    0 Number of altered variables
    0 Get-request PDUs
    0 Get-next PDUs
    0 Get-bulk PDUs
    0 Set-request PDUs (Not supported)
206 SNMP packets output
    0 Too big errors (Maximum packet size 512)
    0 No such name errors
    0 Bad values errors
    0 General errors
    0 Response PDUs
    206 Trap PDUs
Lab-asa1-p/ADMIN-CONTEXT/act#
Lab-asa1-p/ADMIN-CONTEXT/act# capture TEST1 interface management match ip host 10.105.27.115 any
Lab-asa1-p/ADMIN-CONTEXT/act# show capture TEST1
5 packets captured
   1: 18:36:17.631070 802.1Q vlan#710 P0 10.105.89.38.162 > 10.105.27.115.162: udp 356
   2: 18:36:18.491261 802.1Q vlan#710 P0 10.105.89.38.162 > 10.105.27.115.162: udp 355
   3: 18:36:22.389338 802.1Q vlan#710 P0 10.105.89.38.162 > 10.105.27.115.162: udp 266
   4: 18:36:29.491231 802.1Q vlan#710 P0 10.105.89.38.162 > 10.105.27.115.162: udp 355
   5: 18:36:40.491246 802.1Q vlan#710 P0 10.105.89.38.162 > 10.105.27.115.162: udp 355
5 packets shown
Lab-asa1-p/ADMIN-CONTEXT/act# capture TEST2 interface management match ip host 10.105.27.118 any
Lab-asa1-p/ADMIN-CONTEXT/act# show capture TEST2
13 packets captured
   1: 18:37:16.198094 802.1Q vlan#710 P0 10.105.89.38.162 > 10.105.27.118.162: udp 356
   2: 18:37:24.491307 802.1Q vlan#710 P0 10.105.89.38.162 > 10.105.27.118.162: udp 355
   3: 18:37:35.491307 802.1Q vlan#710 P0 10.105.89.38.162 > 10.105.27.118.162: udp 355
   4: 18:37:46.491307 802.1Q vlan#710 P0 10.105.89.38.162 > 10.105.27.118.162: udp 355
   5: 18:37:57.491307 802.1Q vlan#710 P0 10.105.89.38.162 > 10.105.27.118.162: udp 355
   6: 18:38:08.491322 802.1Q vlan#710 P0 10.105.89.38.162 > 10.105.27.118.162: udp 355
   7: 18:38:19.491292 802.1Q vlan#710 P0 10.105.89.38.162 > 10.105.27.118.162: udp 355
   8: 18:38:30.491338 802.1Q vlan#710 P0 10.105.89.38.162 > 10.105.27.118.162: udp 355
   9: 18:38:41.491307 802.1Q vlan#710 P0 10.105.89.38.162 > 10.105.27.118.162: udp 355
10: 18:38:52.491307 802.1Q vlan#710 P0 10.105.89.38.162 > 10.105.27.118.162: udp 355
11: 18:39:03.491307 802.1Q vlan#710 P0 10.105.89.38.162 > 10.105.27.118.162: udp 355
12: 18:39:14.491307 802.1Q vlan#710 P0 10.105.89.38.162 > 10.105.27.118.162: udp 355
13: 18:39:25.491307 802.1Q vlan#710 P0 10.105.89.38.162 > 10.105.27.118.162: udp 355
13 packets shown
thanks
Ana

Hi guys coould you please help me out ??
BR
ANA

Odd SNMP trap - anyone else seen this?

Hi, all!
Just got and implemented a couple of C300s and they're making my life a lot easier than my old Marshal servers, but I'm seeing an odd alert in my SNMP traps that doesn't appear to be getting translated by the MIB, and since my traps generate emails to me unless it's a critical, it's leading to something like 125 emails a night.
Just wondering if anyone had seen this trap before and could tell me A) What the hell it is (I -think- it might be related to definition updates or quarantined messages, but I can't find anything to prove that) and B) If it's not in the MIB, if anyone else wrote a custom MIB entry to cover it so I can get some better reporting.
NodeName=(appliance)
Application=SNMPTraps
Severity=16
Tally=1
MessageText=Virus Outbreak Filters
NodePlatform=other
NodeOperatingSystem=other
MessageNumber=22562b36-5453-71dc-1ce3-0a69c6460000
MessageGroup=ACM
Object=(UNAVAILABLE EVENT PARAMETER $2)
Source=Ironport
TimeCreated=8/27/2007 00:08:15
TimeReceived=8/27/2007 00:08:15
TimeLastReceived=8/27/2007 11:28:19
Thanks!

The message above should be comming from the traps that we translate into messages
SNMPTraps-IronPort Update failure for (Sophos Antivirus)
SNMPTraps-IronPort Update failure for (Virus Outbreak Filters)
SNMPTraps-IronPort Update failure for (IronPort Anti-Spam)
Where original traps are these below, and meaning should be that attempted update from ironport.com failed.
Generic: 6; Specific: 6; Enterprise: .1.3.6.1.4.1.15497.1.1.2.0.6;
Variables:
[1] private.enterprises.IronPort.AsyncOSAppliances.AsyncOSMail.AsyncOSMailObjects.updateTable.updateEntry.updateServiceName (OctetString): Sophos Antivirus
Generic: 6; Specific: 6; Enterprise: .1.3.6.1.4.1.15497.1.1.2.0.6;
Variables:
[1] private.enterprises.ironPort.asyncOSAppliances.asyncOSMail.asyncOSMailObjects.updateTable.updateEntry.updateServiceName (OctetString): Virus Outbreak Filters
Generic: 6; Specific: 6; Enterprise: .1.3.6.1.4.1.15497.1.1.2.0.6;
Variables:
[1] private.enterprises.IronPort.AsyncOSAppliances.AsyncOSMail.AsyncOSMailObjects.updateTable.updateEntry.updateServiceName (OctetString): IronPort Anti-Spam

Questions on Receiving SNMP Traps

Hi:
- I have more questions on receiving SNMP traps:
1) the OEM plug-in can receive traps now, but when I click the metric, I see:
Error getting data for target test20. Exception: ORA-20216: ORA-06512: at "SYSMAN.EMD_MNTR", line 817 ORA-01403: no data found ORA-06512: at line 1
- the push descriptor looks like:
<PushDescriptor RECVLET_ID="SNMPTrap">
<Property NAME="MatchEnterprise" SCOPE="GLOBAL">...</Property>
<Property NAME="MatchGenericTrap" SCOPE="GLOBAL">6</Property> <Property NAME="MatchSpecificTrap" SCOPE="GLOBAL">31</Property> <Property NAME="MatchAgentAddr" SCOPE="INSTANCE">target_ip</Property>
<Property NAME="EventsnChasFanIndexOID" SCOPE="GLOBAL">...</Property>
<Property NAME="ContextsnChasFanDescriptionOID" SCOPE="GLOBAL">...</Property>
<Property NAME="SeverityCode" SCOPE="GLOBAL">WARNING</Property>
</PushDescriptor>
- is the Key Property needed ?
2) The alerts for some reason do not filter back to the all targets home page.
- When I click the Home tab and goto to the 'All Targets' pane, I do not see the alert generated by the OEM plug-in.
- What I am doing wrong ?
3) Is it okay to receive traps with the metric usage set to either: HIDDEN or HIDDEN_COLLECT ?
- Does this cause the errors I see in Q 1) ?
Thanks
John
Edited by: user8826739 on Feb 23, 2010 7:05 AM

Hi John,
Can you post the full definition of the metric? You would need to use the Key property for each key column in the metric description.
With the SNMP receivelet you can set up definitons for data points or alerts. I would assume (as I've never tried this ;) that if you set up the definition to be a data point, you would see data from the All Metrics page. To me, it wouldn't make sense for a metric that used the PushDescriptor SNMPTrap to have data to be viewed as the result of the SNMP trap coming is would be an alert. I will have to look into that. My gut reaction is that a metric with PushDescriptor SNMPTrap shouldn't even appear on the All Metrics page ...
To be clear are you saying that you don't see the Warning number under "All Targets Alerts" increase by 1 when you SNMP trap is caught and alert is generated? When this occurs do you see the alert on the target instance homepage?
In regards to HIDDEN and HIDDEN_COLLECT, I don't know what effect they would have on a metric defined for an SNMP trap to raise an alert. You definitely wouldn't want to use HIDDEN as this setting is for temporary metrics that are used in the caclulation of other metrics. HIDDEN metrics are not collected (or hence uploaded to the OMS) and don't appear in the UI. HIDDEN_COLLECT are collected, but do not show up in the UI and are not uploaded. I've never used this settings with SNMP trap metrics that are for alerts. If your metrics for the SNMP trap alerts do show up on the All Metrics page (I'd have to get something set up to look at this), then it could make sense to use the HIDDEN_COLLECT as the alert would still be generated, but the metric itself wouldn't be shown in the UI.
Let me find out the expected behavior from someone on the agent team.
Dave

What is the minimum server layer OEM version supports SNMP trap reception ?

Hi:
- I have been trying to enable SNMP trap reception on an OEM plug-in.
- I turned on debug channel for recvlets.snmp and saw:
2009-10-16 16:07:42,808 Thread-3028552624 ERROR recvlets.snmp: Duplicate threshold : test900, oracle_guide, interfaces, status
and
2009-10-16 16:09:08,382 Thread-3021634480 INFO recvlets.snmp: Trap received is to convert Data Point
2009-10-16 16:09:08,379 Thread-3021634480 INFO recvlets.snmp: Sending Data Point ...
2009-10-16 16:09:08,379 Thread-3021634480 INFO recvlets.snmp: Listening for TRAP
So, it looks like the OEM agent can receive traps but no data point or alert appears.
And, the agent always issues an error about duplicate thresholds.
- Does the agent have to be patched ?
My agent is:
Oracle Enterprise Manager 10g Release 5 Grid Control 10.2.0.5.0.
Copyright (c) 1996, 2009 Oracle Corporation. All rights reserved.
Agent Version : 10.2.0.5.0
OMS Version : 10.2.0.1.0
Protocol Version : 10.2.0.0.0
Agent is Running and Ready
- on the server layer, the oms is:
Oracle Enterprise Manager 10g Release 10.2.0.1.0
Copyright (c) 1996, 2005 Oracle Corporation. All rights reserved.
Oracle Management Server is Up.
Is a patch needed for OMS ?
Should OMS be version 10.2.0.5.0 ?
Thanks
John
Edited by: user8826739 on Feb 23, 2010 7:17 AM

10.2.0.5 should be fine ...
Dave

Creating SNMP Trap Monitors in 2012 R2

Hello,
For the past week or so I have been attempting to create a MP for my company's UPSs to be monitored in SCOM 2012 R2. I have created a custom MP with custom datasources and objects. All seems to go according to the plan until I attempt to create a SNMP
Trap monitor for those objects. I am able to verify that the device is discovered and is sending the traps successfully with a view. The problem seems to lie within the setup of the monitor. I have followed the steps as much as I can from this page http://technet.microsoft.com/en-us/library/hh563870.aspx
to create a monitor that will be triggered by an incoming trap saying the UPS is on Battery Power.
This is the initial or trigger event information received by SCOM:
<EventData>
<DataItem type="System.SnmpData" time="2014-07-03T08:48:07.6990732-07:00" sourceHealthServiceId="26DF02E5-DEA0-BED0-443B-3605A05D4790">
<Source>10.51.85.40</Source>
<Destination>127.0.0.1</Destination>
<ErrorCode>1</ErrorCode>
<Version>1</Version>
<SnmpVarBinds>
<SnmpVarBind>
<OID>.1.3.6.1.2.1.1.3.0</OID>
<Syntax>67</Syntax>
<Value VariantType="19">17567220</Value>
</SnmpVarBind>
<SnmpVarBind>
<OID>.1.3.6.1.6.3.1.1.4.1.0</OID>
<Syntax>6</Syntax>
<Value VariantType="8">.1.3.6.1.4.1.318.0.5</Value>
</SnmpVarBind>
<SnmpVarBind>
<OID>.1.3.6.1.4.1.318.2.3.3.0</OID>
<Syntax>4</Syntax>
<Value VariantType="8">UPS: On battery power in response to an input power problem.</Value>
</SnmpVarBind>
<SnmpVarBind>
<OID>.1.3.6.1.6.3.1.1.4.3.0</OID>
<Syntax>6</Syntax>
<Value VariantType="8">.1.3.6.1.4.1.318</Value>
</SnmpVarBind>
</SnmpVarBinds>
</DataItem>
</EventData>
This is the event should signal that everything is operating normally once again.
<EventData>
<DataItem type="System.SnmpData" time="2014-07-03T08:48:12.9133769-07:00" sourceHealthServiceId="26DF02E5-DEA0-BED0-443B-3605A05D4790"><Source>10.51.85.40</Source>
<Destination>127.0.0.1</Destination>
<ErrorCode>1</ErrorCode>
<Version>1</Version>
<SnmpVarBinds>
<SnmpVarBind>
<OID>.1.3.6.1.2.1.1.3.0</OID>
<Syntax>67</Syntax>
<Value VariantType="19">17567730</Value>
</SnmpVarBind>
<SnmpVarBind>
<OID>.1.3.6.1.6.3.1.1.4.1.0</OID>
<Syntax>6</Syntax>
<Value VariantType="8">.1.3.6.1.4.1.318.0.9</Value>
</SnmpVarBind>
<SnmpVarBind>
<OID>.1.3.6.1.4.1.318.2.3.3.0</OID>
<Syntax>4</Syntax>
<Value VariantType="8">UPS: No longer on battery power.</Value>
</SnmpVarBind>
<SnmpVarBind>
<OID>.1.3.6.1.6.3.1.1.4.3.0</OID>
<Syntax>6</Syntax>
<Value VariantType="8">.1.3.6.1.4.1.318</Value>
</SnmpVarBind>
</SnmpVarBinds>
</DataItem>
</EventData>
You may notice that these traps are being sent as SNMP v1. I am unable to change that on the UPS so i have modified the monitors to account for that. Here is the code for the monitor:
<UnitMonitor ID="UIGeneratedMonitorc2c65f3c85fe42f48ce8d2580c57bbae" Accessibility="Public" Enabled="true" Target="APC.MP.UPS" ParentMonitorID="Health!System.Health.AvailabilityState" Remotable="true" Priority="Normal" TypeID="SNL!System.NetworkManagement.SnmpTrapProvider.2SingleEvent2StateMonitorType" ConfirmDelivery="false">
<Category>Custom</Category>
<AlertSettings AlertMessage="UIGeneratedMonitorc2c65f3c85fe42f48ce8d2580c57bbae_AlertMessageResourceID">
<AlertOnState>Warning</AlertOnState>
<AutoResolve>true</AutoResolve>
<AlertPriority>Normal</AlertPriority>
<AlertSeverity>Error</AlertSeverity>
</AlertSettings>
<OperationalStates>
<OperationalState ID="UIGeneratedOpStateId2750c1ab2cd14b4a8a8e9f4633eba0b0" MonitorTypeStateID="SecondEventRaised" HealthState="Success" />
<OperationalState ID="UIGeneratedOpStateId5753748399984d08953c1a46895df99c" MonitorTypeStateID="FirstEventRaised" HealthState="Warning" />
</OperationalStates>
<Configuration>
<FirstIP>$Target/Property[Type="SNL!System.NetworkManagement.Node"]/SNMPAddress$</FirstIP>
<FirstVersion>1</FirstVersion>
<FirstOIDProps>
<OIDProp>.1.3.6.1.4.1.318</OIDProp>
</FirstOIDProps>
<FirstExpression>
<SimpleExpression>
<ValueExpression>
<XPathQuery Type="String">SnmpVarBinds/SnmpVarBind[OID=".1.3.6.1.6.3.1.1.4.1.0"]/Value</XPathQuery>
</ValueExpression>
<Operator>Equal</Operator>
<ValueExpression>
<Value Type="String">.1.3.6.1.4.1.318.0.5</Value>
</ValueExpression>
</SimpleExpression>
</FirstExpression>
<SecondIP>$Target/Property[Type="SNL!System.NetworkManagement.Node"]/SNMPAddress$</SecondIP>
<SecondVersion>1</SecondVersion>
<SecondOIDProps>
<OIDProp>.1.3.6.1.4.1.318</OIDProp>
</SecondOIDProps>
<SecondExpression>
<SimpleExpression>
<ValueExpression>
<XPathQuery Type="String">SnmpVarBinds/SnmpVarBind[OID=".1.3.6.1.6.3.1.1.4.1.0"]/Value</XPathQuery>
</ValueExpression>
<Operator>Equal</Operator>
<ValueExpression>
<Value Type="String">.1.3.6.1.4.1.318.0.9</Value>
</ValueExpression>
</SimpleExpression>
</SecondExpression>
</Configuration>
</UnitMonitor>
I tried the following things while attempting to troubleshoot this issue:
Leaving First
SnmpTrapProvider and Second
SnmpTrapProvider blank while creating the monitor.
Adding "" and also '' around the value as it is a string and perhaps that was the cause.
Changing the First and Second SNMPTrapProvider to .1.3.6.1.6.3.1.1.4.1.0 since that is the specific OID I am looking for the value of.
Reading every page of the internet and bashing my head on the keyboard.
I am guessing that the issue will reside in the the monitor creation and definition, but I have not found anything that clearly describes how to fill out the SNMP Trap Monitor wizard given the trap info. Especially since the trap I am receiving does
not seem to contain the usual OID with a common Int or string value. Hopefully someone can provide assistance as I am nearing my wits end with this problem.

Firstly, thank you Michael Skov, knowing that the First and Second SnmpTrapProvider or <FirstOIDProps> in the xml, needed to be blank got me pointed in the right direction. I figured I would come back and share my final working code snippet in case
others run across a similar issue.
<UnitMonitor ID="UIGeneratedMonitorf9f671e5456c44fd807d6ec2bd09621d" Accessibility="Public" Enabled="true" Target="Disc!APC.Disc.UPS" ParentMonitorID="Health!System.Health.PerformanceState" Remotable="true" Priority="Normal" TypeID="NetworkManagement!System.NetworkManagement.SnmpTrapProvider.2SingleEvent2StateMonitorType" ConfirmDelivery="false">
<Category>Custom</Category>
<AlertSettings AlertMessage="UIGeneratedMonitorf9f671e5456c44fd807d6ec2bd09621d_AlertMessageResourceID">
<AlertOnState>Warning</AlertOnState>
<AutoResolve>true</AutoResolve>
<AlertPriority>Normal</AlertPriority>
<AlertSeverity>Warning</AlertSeverity>
</AlertSettings>
<OperationalStates>
<OperationalState ID="UIGeneratedOpStateId8700c95344254f87a60c92d30d4a3953" MonitorTypeStateID="SecondEventRaised" HealthState="Success" />
<OperationalState ID="UIGeneratedOpStateId7bf68c6cfe3d4faabe83e630781c7327" MonitorTypeStateID="FirstEventRaised" HealthState="Warning" />
</OperationalStates>
<Configuration>
<FirstIP>$Target/Property[Type="NetworkManagement!System.NetworkManagement.Node"]/SNMPAddress$</FirstIP>
<FirstVersion>1</FirstVersion>
<FirstOIDProps />
<FirstExpression>
<SimpleExpression>
<ValueExpression>
<XPathQuery Type="String">SnmpVarBinds/SnmpVarBind[OID=".1.3.6.1.6.3.1.1.4.1.0"]/Value</XPathQuery>
</ValueExpression>
<Operator>Equal</Operator>
<ValueExpression>
<Value Type="String">.1.3.6.1.4.1.318.0.5</Value>
</ValueExpression>
</SimpleExpression>
</FirstExpression>
<SecondIP>$Target/Property[Type="NetworkManagement!System.NetworkManagement.Node"]/SNMPAddress$</SecondIP>
<SecondVersion>1</SecondVersion>
<SecondOIDProps />
<SecondExpression>
<SimpleExpression>
<ValueExpression>
<XPathQuery Type="String">SnmpVarBinds/SnmpVarBind[OID=".1.3.6.1.6.3.1.1.4.1.0"]/Value</XPathQuery>
</ValueExpression>
<Operator>Equal</Operator>
<ValueExpression>
<Value Type="String">.1.3.6.1.4.1.318.0.9</Value>
</ValueExpression>
</SimpleExpression>
</SecondExpression>
</Configuration>
</UnitMonitor>

SNMP traps from Solaris 10

Hi,
I'm trying very hard to set up a Sun Fire V245 to send SNMP traps when certain hardware or software related events occur. I've been looking at sma_snmp (net-snmp) and the Fault Management Daemon (SUNWfmd) but they seem to be very limited in their capabilities. I have manged to get some traps sent for filesystem fill-ups and high load averages but that is about it.
Most of all I would like the system to send traps when there is a HW failure such as a faulty FRU or if there are disk failures.
If anyone can point me to some documentation about this, I would be most grateful.
/Mikael

Mikael,
I struggled through the same thing with a Netra 240 recently. The Sun docs are garbage when it comes to this. I opened a ticket with Sun and after 3 days and 6 hours on the phone I finally got hold of someone who knew how to spell SNMP. Yes, it was that bad!
Here's the scoop. In Solaris 10 you run Net-SNMP, a.k.a. SMA, snmpd. The old snmpdx is obsoleted and you shouldn't configure it at all.
Now to get the hardware related traps for the Sunfire and Netra series servers... (what you are really looking for).
You have to load and configure an additional SNMP daemon for the hardware specific traps.
(The first doc is rather old, the last one 819-7978-12 is pretty new and is somewhat more relevant.)
Sun� SNMP Management Agent for Sun Fire� and Netra� Systems: Sun Doc number 817-2559-13
Sun� SNMP Management Agent Addendum for the Netra� 240 Server: Sun Doc Number 817-6238-10
Sun� SNMP Management Agent Administration Guide for Sun Blade� /Sun Fire�/Sun SPARC� Enterprise/Netra� Servers: Sun Doc Number 819-7978-12
And finally the SMA/net-snmp/snmpd guide for the standard Solaris related traps:
Solaris System Management Agent Administration Guide: Sun Doc Number 817�3000�11
There are problems with all of the above documents. None of the Netra/Sunfire docs specifically talk about Solaris 10 so read them with caution. They also talk about configuring and running snmpdx and never reference SMA/net-snmp. This is odd because the instructions I got from Sun (finally) were not to run snmpdx, only to run sma/snmpd and additionally run the sunfire/netra snmpd agent.
The SMA document (817-3000-11) has an undocumented bug, which Sun knows about and is working on but will not reveal to the public. In the section titled "Migration From the Sun Fire Management Agent" it references using a script called masfcnv to convert the sunfire/netra specific snmp config and daemon to work with and through SMA. Since they all use the same ports (161/162) there is some conflict and the masfcnv is script is meant to resolve this by making sma/snmpd a proxy agent to requests toward the sunfire/netra specific hardware daemon.
The problem is the masfcnv script doesn't work properly. In fact, if you run the script you will destroy your other snmp configurations and may have to uninstall and reinstall the packages to clean everything up. This script hasn't ever worked and Sun is working on a fix but they neglect to mention this in the document which is IMO gross negligence and is a reflection of Sun's overall state of affairs (but that's another ranting thread).
So what you must do is configure SMA/net-snmp (or whatever you want to call it), and also configure the sunfire/netra specific snmp (after downloading and installing that package).
Since traps are sent to the remote trapsink using destination port 162, both net-snmp and the netra specific snmp daemons can co-exist here (port 162 is not an open listening port on the machine).
Port 161 is used for receiving SNMP Get requests and can only be bound to one daemon at a time. So either it is used by net-snmp or the netra snmp daemon, but not both. Since my boxes have not been fully integrated still I can't figure out which daemon 161 is bound to. At any rate, in my application the customer is only interested in receiving traps so the outcome here isn't that important.
I realize this isn't complete but I'm no expert here and haven't worked through all the test scenarios on a fully configured system. Hopefully though this will help clear some of the confusion propogated through Sun's stupid documents. Good luck!
/Frank

Snmp trap on solaris 10

Hi,
how can i make my Solaris 10 generate SNMP trap on specific event?
like high CPU,Load or lack of disk space ?
thanks
Ram

it should be possible to define the "index" in each /etc/hostname. file
I have never done this, but when the system boots it reads the content of these files and passes them to "ifconfig" to configure the NICs
search this page for "index":
http://docs.oracle.com/cd/E19253-01/816-5166/ifconfig-1m/index.html

ACE Appliance snmp traps

Similar Messages

Maybe you are looking for