BGP snmp trap on XR OS
We are trying to test the snmp trap on IOS-XR for BGP up down, but ASR didn't send out any traps when we brought down the BGP neighbour. When we tested the OSPF, it worked fine. I also tried to use command 'snmp test' to generate the test trap and I got following message, The version is 4.2. Any suggestions? Thanks.
RP/0/RSP0/CPU0:Feb 22 13:58:20.691 : test_trap[65889]: Debug init Done
RP/0/RSP0/CPU0:Feb 22 13:58:21.083 : test_trap[446]: Trap ID: 28
RP/0/RSP0/CPU0:Feb 22 13:58:21.084 : test_trap[446]: make_test_traps: input args 0x0 0x0 (null) (null)
Failed to format BGP Trap
RP/0/RSP0/CPU0:Feb 22 13:58:21.084 : test_trap[446]: get_first_bgp_peer_index: Getting first BGP Peer
RP/0/RSP0/CPU0:Feb 22 13:58:21.104 : test_trap[446]: get_first_bgp_peer_index: Failed to get BGP indices
Current config:
snmp-server host x.x.x.x traps version 2c xxxxxx
snmp-server community encrypted xxxx RO
snmp-server community encrypted yyyy RW
snmp-server traps rf
snmp-server traps bgp cbgp2
snmp-server traps bgp
snmp-server traps ospf state-change neighbor-state-change
snmp-server packetsize 1024
snmp-server trap-source MgmtEth0/RSP0/CPU0/0
snmp-server ifindex persist
Regards. Leo
Hi,
I am running 4.2.3 and seems like trap generated. also see the snm-server traps bgp commands in running config.
RP/0/RSP0/CPU0:PE2#show vrf mse_1001 detail
Mon Feb 25 14:58:29.027 PST
VRF mse_1001; RD 65002:1001; VPN ID not set
VRF mode: Regular
Description not set
Interfaces:
GigabitEthernet0/3/0/0.1001
Address family IPV4 Unicast
Import VPN route-target communities:
RT:65001:1001
Export VPN route-target communities:
RT:65001:1001
No import route policy
No export route policy
Address family IPV6 Unicast
Import VPN route-target communities:
RT:65001:1001
Export VPN route-target communities:
RT:65001:1001
No import route policy
No export route policy
RP/0/RSP0/CPU0:PE2#show ipv4 vrf mse_1001 interface brief
Mon Feb 25 14:59:16.154 PST
Interface IP-Address Status Protocol
GigabitEthernet0/3/0/0.1001 101.1.1.1 Up Up
RP/0/RSP0/CPU0:PE2#term mon
Mon Feb 25 14:59:33.803 PST
RP/0/RSP0/CPU0:PE2#conf t
Mon Feb 25 14:59:34.894 PST
RP/0/RSP0/CPU0:PE2(config)#int gi0/3/0/0.1001
RP/0/RSP0/CPU0:PE2(config-subif)#shut
RP/0/RSP0/CPU0:PE2(config-subif)#commit
Mon Feb 25 14:59:46.480 PST
LC/0/3/CPU0:Feb 25 14:59:46.617 : bfd_agent[124]: %L2-BFD-6-ADJACENCY_DELETE : Adjacency to neighbor 101.1.1.2 on interface GigabitEthernet0/3/0/0.1001 was deleted
RP/0/RSP0/CPU0:Feb 25 14:59:46.621 : bgp[1048]: %ROUTING-BGP-5-ADJCHANGE : neighbor 101.1.1.2 Down - Admin. shutdown (VRF: mse_1001)
RP/0/RSP1/CPU0:Feb 25 14:59:46.620 : bgp[1048]: %ROUTING-BGP-5-NBR_NSR_DISABLED_STANDBY : NSR disabled on neighbor 101.1.1.2 on standby due to Admin. shutdown (VRF: mse_1001)
RP/0/RSP0/CPU0:Feb 25 14:59:46.626 : bgp[1048]: %ROUTING-BGP-5-ADJCHANGE : neighbor 1011:1:1::2 Down - Admin. shutdown (VRF: mse_1001)
RP/0/RSP1/CPU0:Feb 25 14:59:46.622 : bgp[1048]: %ROUTING-BGP-5-NBR_NSR_DISABLED_STANDBY : NSR disabled on neighbor 1011:1:1::2 on standby due to Admin. shutdown (VRF: mse_1001)
LC/0/3/CPU0:Feb 25 14:59:46.719 : bfd_agent[124]: %L2-BFD-6-ADJACENCY_DELETE : Adjacency to neighbor 1011:1:1::2 on interface GigabitEthernet0/3/0/0.1001 was deleted
LC/0/3/CPU0:Feb 25 14:59:47.294 : bfd_agent[124]: %L2-BFD-6-SESSION_STATE_DOWN : BFD session to neighbor 1011:1:1::2 on interface GigabitEthernet0/3/0/0.1001 has gone down. Reason: Control timer expired
LC/0/3/CPU0:Feb 25 14:59:47.401 : bfd_agent[124]: %L2-BFD-6-SESSION_STATE_DOWN : BFD session to neighbor 101.1.1.2 on interface GigabitEthernet0/3/0/0.1001 has gone down. Reason: Nbor signalled down
RP/0/RSP0/CPU0:Feb 25 14:59:47.513 : config[65903]: %MGBL-CONFIG-6-DB_COMMIT : Configuration committed by user 'lab'. Use 'show configuration commit changes 1000000208' to view the changes.
RP/0/RSP0/CPU0:PE2(config-subif)#RP/0/RSP0/CPU0:Feb 25 14:59:47.633 : snmpd[1112]: t8 Queueing trap:ciscoBgp4MIB.0.2 qlen:0
RP/0/RSP0/CPU0:Feb 25 14:59:47.633 : snmpd[1112]: t8 Queueing trap:bgp.0.2 qlen:1
RP/0/RSP0/CPU0:Feb 25 14:59:47.634 : snmpd[1112]: t8 Queueing trap:ciscoBgp4MIB.0.8 qlen:2
RP/0/RSP0/CPU0:Feb 25 14:59:47.634 : snmpd[1112]: t8 Queueing trap:ciscoBgp4MIB.0.6 qlen:3
RP/0/RSP0/CPU0:Feb 25 14:59:47.635 : snmpd[1112]: t8 Queueing trap:ciscoBgp4MIB.0.1 qlen:4
RP/0/RSP0/CPU0:Feb 25 14:59:47.635 : snmpd[1112]: t8 Queueing trap:ciscoBgp4MIB.0.7 qlen:5
RP/0/RSP0/CPU0:Feb 25 14:59:47.635 : snmpd[1112]: t8 Queueing trap:ciscoBgp4MIB.0.8 qlen:6
RP/0/RSP0/CPU0:Feb 25 14:59:47.636 : snmpd[1112]: t8 Queueing trap:ciscoBgp4MIB.0.6 qlen:7
RP/0/RSP0/CPU0:Feb 25 14:59:47.636 : snmpd[1112]: t8 Queueing trap:ciscoBgp4MIB.0.7 qlen:8
RP/0/RSP0/CPU0:Feb 25 14:59:47.637 : snmpd[1112]: t13 Processing trap ciscoBgp4MIB.0.2
RP/0/RSP0/CPU0:Feb 25 14:59:47.637 : snmpd[1112]: t13 Processing trap bgp.0.2
RP/0/RSP0/CPU0:Feb 25 14:59:47.638 : snmpd[1112]: t13 Processing trap ciscoBgp4MIB.0.8
RP/0/RSP0/CPU0:Feb 25 14:59:47.638 : snmpd[1112]: t13 Processing trap ciscoBgp4MIB.0.6
RP/0/RSP0/CPU0:Feb 25 14:59:47.638 : snmpd[1112]: t13 Processing trap ciscoBgp4MIB.0.1
RP/0/RSP0/CPU0:Feb 25 14:59:47.639 : snmpd[1112]: t13 Processing trap ciscoBgp4MIB.0.7
RP/0/RSP0/CPU0:Feb 25 14:59:47.639 : snmpd[1112]: t13 Processing trap ciscoBgp4MIB.0.8
RP/0/RSP0/CPU0:Feb 25 14:59:47.639 : snmpd[1112]: t13 Processing trap ciscoBgp4MIB.0.6
RP/0/RSP0/CPU0:Feb 25 14:59:47.640 : snmpd[1112]: t13 Processing trap ciscoBgp4MIB.0.7
RP/0/RSP0/CPU0:PE2(config-subif)#
RP/0/RSP0/CPU0:PE2(config-subif)#end
RP/0/RSP0/CPU0:Feb 25 14:59:55.901 : config[65903]: %MGBL-SYS-5-CONFIG_I : Configured from console by lab on vty0 (223.255.254.249)
RP/0/RSP0/CPU0:PE2#show snmp trap
Mon Feb 25 14:59:59.901 PST
TrapOID Number of Times
bgp.0.2 1
ciscoBgp4MIB.0.1 1
ciscoBgp4MIB.0.2 1
ciscoBgp4MIB.0.6 2
ciscoBgp4MIB.0.7 2
ciscoBgp4MIB.0.8 2
RP/0/RSP0/CPU0:PE2#show running-config snmp-server
Mon Feb 25 15:00:20.221 PST
snmp-server vrf mse_1001
context public
snmp-server community public RW
snmp-server traps bgp cbgp2
snmp-server traps bgp
snmp-server traps vrrp events
snmp-server ifindex persist
RP/0/RSP0/CPU0:PE2#conf t
Mon Feb 25 15:02:35.935 PST
RP/0/RSP0/CPU0:PE2(config)#int gi0/3/0/0.1001
RP/0/RSP0/CPU0:PE2(config-subif)#no shut
RP/0/RSP0/CPU0:PE2(config-subif)#commit
Mon Feb 25 15:02:42.609 PST
RP/0/RSP0/CPU0:Feb 25 15:02:43.369 : bgp[1048]: %ROUTING-BGP-5-ADJCHANGE : neighbor 101.1.1.2 Up (VRF: mse_1001)
RP/0/RSP0/CPU0:Feb 25 15:02:43.606 : config[65903]: %MGBL-CONFIG-6-DB_COMMIT : Configuration committed by user 'lab'. Use 'show configuration commit changes 1000000209' to view the changes.
RP/0/RSP0/CPU0:PE2(config-subif)#LC/0/3/CPU0:Feb 25 15:02:44.223 : bfd_agent[124]: %L2-BFD-6-SESSION_STATE_UP : BFD session to neighbor 101.1.1.2 on interface GigabitEthernet0/3/0/0.1001 is up
RP/0/RSP0/CPU0:Feb 25 15:02:44.286 : snmpd[1112]: t8 Queueing trap:ciscoBgp4MIB.0.1 qlen:0
RP/0/RSP0/CPU0:Feb 25 15:02:44.286 : snmpd[1112]: t8 Queueing trap:ciscoBgp4MIB.0.7 qlen:1
RP/0/RSP0/CPU0:Feb 25 15:02:44.287 : snmpd[1112]: t8 Queueing trap:ciscoBgp4MIB.0.1 qlen:2
RP/0/RSP0/CPU0:Feb 25 15:02:44.287 : snmpd[1112]: t8 Queueing trap:ciscoBgp4MIB.0.7 qlen:3
RP/0/RSP0/CPU0:Feb 25 15:02:44.288 : snmpd[1112]: t8 Queueing trap:ciscoBgp4MIB.0.1 qlen:4
RP/0/RSP0/CPU0:Feb 25 15:02:44.289 : snmpd[1112]: t8 Queueing trap:ciscoBgp4MIB.0.7 qlen:5
RP/0/RSP0/CPU0:Feb 25 15:02:44.289 : snmpd[1112]: t8 Queueing trap:bgp.0.1 qlen:6
RP/0/RSP0/CPU0:Feb 25 15:02:44.290 : snmpd[1112]: t8 Queueing trap:ciscoBgp4MIB.0.5 qlen:7
RP/0/RSP0/CPU0:Feb 25 15:02:44.291 : snmpd[1112]: t8 Queueing trap:ciscoBgp4MIB.0.1 qlen:8
RP/0/RSP0/CPU0:Feb 25 15:02:44.291 : snmpd[1112]: t8 Queueing trap:ciscoBgp4MIB.0.7 qlen:9
RP/0/RSP0/CPU0:Feb 25 15:02:44.292 : snmpd[1112]: t10 Processing trap ciscoBgp4MIB.0.1
RP/0/RSP0/CPU0:Feb 25 15:02:44.292 : snmpd[1112]: t10 Processing trap ciscoBgp4MIB.0.7
RP/0/RSP0/CPU0:Feb 25 15:02:44.292 : snmpd[1112]: t10 Processing trap ciscoBgp4MIB.0.1
RP/0/RSP0/CPU0:Feb 25 15:02:44.293 : snmpd[1112]: t10 Processing trap ciscoBgp4MIB.0.7
RP/0/RSP0/CPU0:Feb 25 15:02:44.293 : snmpd[1112]: t10 Processing trap ciscoBgp4MIB.0.1
RP/0/RSP0/CPU0:Feb 25 15:02:44.293 : snmpd[1112]: t10 Processing trap ciscoBgp4MIB.0.7
RP/0/RSP0/CPU0:Feb 25 15:02:44.293 : snmpd[1112]: t10 Processing trap bgp.0.1
RP/0/RSP0/CPU0:Feb 25 15:02:44.294 : snmpd[1112]: t10 Processing trap ciscoBgp4MIB.0.5
RP/0/RSP0/CPU0:Feb 25 15:02:44.294 : snmpd[1112]: t10 Processing trap ciscoBgp4MIB.0.1
RP/0/RSP0/CPU0:Feb 25 15:02:44.294 : snmpd[1112]: t10 Processing trap ciscoBgp4MIB.0.7
RP/0/RSP0/CPU0:PE2(config-subif)#
RP/0/RSP0/CPU0:PE2(config-subif)#end
RP/0/RSP0/CPU0:Feb 25 15:02:48.825 : config[65903]: %MGBL-SYS-5-CONFIG_I : Configured from console by lab on vty0 (223.255.254.249)
RP/0/RSP0/CPU0:PE2#conf tRP/0/RSP0/CPU0:Feb 25 15:02:49.418 : snmpd[1112]: t8 Queueing trap:ciscoBgp4MIB.0.7 qlen:0
RP/0/RSP0/CPU0:Feb 25 15:02:49.419 : snmpd[1112]: t8 Queueing trap:ciscoBgp4MIB.0.7 qlen:1
RP/0/RSP0/CPU0:Feb 25 15:02:49.420 : snmpd[1112]: t10 Processing trap ciscoBgp4MIB.0.7
RP/0/RSP0/CPU0:Feb 25 15:02:49.421 : snmpd[1112]: t10 Processing trap ciscoBgp4MIB.0.7
show running-config snmp-server RP/0/RSP0/CPU0:Feb 25 15:02:50.510 : bgp[1048]: %ROUTING-BGP-5-ADJCHANGE : neighbor 1011:1:1::2 Up (VRF: mse_1001)
show snmp trapLC/0/3/CPU0:Feb 25 15:02:51.046 : bfd_agent[124]: %L2-BFD-6-SESSION_STATE_UP : BFD session to neighbor 1011:1:1::2 on interface GigabitEthernet0/3/0/0.1001 is up
RP/0/RSP0/CPU0:Feb 25 15:02:51.516 : snmpd[1112]: t8 Queueing trap:ciscoBgp4MIB.0.7 qlen:0
RP/0/RSP0/CPU0:Feb 25 15:02:51.516 : snmpd[1112]: t8 Queueing trap:ciscoBgp4MIB.0.5 qlen:1
RP/0/RSP0/CPU0:Feb 25 15:02:51.517 : snmpd[1112]: t8 Queueing trap:ciscoBgp4MIB.0.7 qlen:2
RP/0/RSP0/CPU0:Feb 25 15:02:51.519 : snmpd[1112]: t10 Processing trap ciscoBgp4MIB.0.7
RP/0/RSP0/CPU0:Feb 25 15:02:51.520 : snmpd[1112]: t10 Processing trap ciscoBgp4MIB.0.5
RP/0/RSP0/CPU0:Feb 25 15:02:51.520 : snmpd[1112]: t10 Processing trap ciscoBgp4MIB.0.7
Mon Feb 25 15:02:54.118 PST
TrapOID Number of Times
bgp.0.1 1
bgp.0.2 1
ciscoBgp4MIB.0.1 5
ciscoBgp4MIB.0.2 1
ciscoBgp4MIB.0.5 2
ciscoBgp4MIB.0.6 2
ciscoBgp4MIB.0.7 10
ciscoBgp4MIB.0.8 2
RP/0/RSP0/CPU0:PE2#
Thanks
Parthiv
Similar Messages
-
BGP Peer down monitoring through SNMP Traps
Hello,
I'm trying to figure out how I can monitor with BGP peer went down using SNMP traps or any other methods that are out there. Basically I would like to get a trap that tells me the IP address of the peer that went down.
Looking over the SNMP MIBs for BGP all i can find is snmp traps that tell me there was a change in states in BGP, but don't say which neighbor.
Is there any way to get such information? Would I have to use EEM with some script? This seems like a very common thing that people would want to know.
Thank you in advance,
TomSNMP notifications can be configured on the router and GET operations can be performed from an external management station only after BGP SNMP support is enabled.
SUMMARY STEPS
1. enable
2. configure terminal
3. snmp-server enable traps bgp [state-changes {[all] [backward-trans] [limited]}] | [threshold prefix]
4. exit -
Hi
Whenever there is a bgp neighbour flap, we are not getting snmp traps on the HP NNMI Server.. I believe during the neighbour flap, the device is unable to communicate with NNMI and drop the trap..
So I would like to write a custom EEM SCRIPT that can match a syslog pattern and generate a customised SNMP trap and send it to NNMI. May be I can delay the trap generation or sending so that the device restores the connectivity and then send an alert
Here are my questions:
Is this a good idea?
Can you give me a sample configuration with the MIB Values to be generated?
What MIB Should be loaded on the server?
I am curious how others are monitoring this kind of bgp flaps...
Sent from Cisco Technical Support iPad AppAfter i enabled snmp inform using following command
snmp-server host 100.190.19.33 informs version 2c XXXX
I see it is contineously incrementing snmp inform sent messages on the router..I am not sure what it is sending..I would like to be specific like sending only BGP snmp informs to the NMS..is it possible ?
DR1#show snmp
Chassis: FHK0850F0HL
4338622 SNMP packets input
0 Bad SNMP version errors
746076 Unknown community name
0 Illegal operation for community name supplied
0 Encoding errors
35020739 Number of requested variables
0 Number of altered variables
3303916 Get-request PDUs
97632 Get-next PDUs
0 Set-request PDUs
0 Input queue packet drops (Maximum queue size 1000)
6639622 SNMP packets output
0 Too big errors (Maximum packet size 1500)
546341 No such name errors
0 Bad values errors
0 General errors
3592535 Response PDUs
3047076 Trap PDUs
SNMP Dispatcher:
queue 0/75 (current/max), 0 dropped
SNMP Engine:
queue 0/1000 (current/max), 0 dropped
SNMP logging: enabled
Logging to 10.45.224.19.162, 0/10, 761350 sent, 347 dropped.
Logging to 10.48.176.1.162, 0/10, 759955 sent, 1886 dropped.
Logging to 100.190.19.25.162, 0/10, 761329 sent, 368 dropped.
Logging to 100.190.19.33.162, 0/10, 761367 sent, 474 dropped.
SNMP Manager-role output packets
0 Get-request PDUs
0 Get-next PDUs
0 Get-bulk PDUs
0 Set-request PDUs
11 Inform-request PDUs
0 Timeouts
0 Drops
SNMP Manager-role input packets
0 Inform request PDUs
0 Trap PDUs
11 Response PDUs
0 Responses with errors
SNMP informs: enabled
Informs in flight 0/25 (current/max)
Logging to 100.190.19.33.162
11 sent, 0 in-flight, 0 retries, 0 failed, 0 dropped -
SNMP trapping PRI channels up/down
Hi guys.
I am re-configuring some routers to generate traps for our new monitoring tool.
I have noticed that after I applied the snmp trap configs that we are getting traps for PRI channels (30 voice channels), which I wouldn´t like to. This happens when users are using the voice channels on demand. When they hang up, the used channel goes down and I get a trap.
Basically, regargint the controller, the only interface that I must monitor is the signaling one (my case is the channel 0/3/0:15) or if the entire controller goes down.
Below, the snmp trap config:
snmp-server ifindex persist
snmp-server trap-source Loopback0
snmp-server enable traps snmp linkdown linkup coldstart warmstart
snmp-server enable traps envmon
snmp-server enable traps isdn layer2
snmp-server enable traps isdn chan-not-avail
snmp-server enable traps isdn ietf
snmp-server enable traps bgp
snmp-server enable traps hsrp
snmp-server enable traps ipsla
snmp-server enable traps voice poor-qov
Could you please help me to figure out how I can solve this?
Also, if you guys have any other advises and more ways to monitor the voice environment.
Thanks in advanceDuplicate post.
Go HERE. -
Hi Experts,
When i configure Snmp trap in switches it is showing a list of commands, What exacatly is these are?
snmp-server enable traps snmp authentication linkdown linkup coldstart warmstart
snmp-server enable traps tty
snmp-server enable traps vtp
snmp-server enable traps vlancreate
snmp-server enable traps vlandelete
snmp-server enable traps stpx
snmp-server enable traps port-security
snmp-server enable traps config
snmp-server enable traps entity
snmp-server enable traps copy-config
snmp-server enable traps fru-ctrl
snmp-server enable traps flash insertion removal
snmp-server enable traps syslog
snmp-server enable traps bridge
snmp-server enable traps envmon fan shutdown supply temperature status
snmp-server enable traps hsrp
snmp-server enable traps bgp
snmp-server enable traps pim neighbor-change rp-mapping-change invalid-pim-message
snmp-server enable traps ipmulticast
snmp-server enable traps msdp
snmp-server enable traps rtr
snmp-server enable traps vlan-membership
Does it cause more CPU utilization? Do i need to enable snmp traps to monitor network using solarwinds NPM. I have configured community string and snmpserver host address.
Thanks
VipinHi Vipin,
We usually configure SNMP traps to monitor our network reachability and availability. If anything goes on Device whether it is a link down situation or any issue with protocol running on the Device. So, whenever anything goes wrong on the device it generates an SNMP Trap and notify you if you have configure SNMP-Server host to receive the notifications/traps.
To configure SNMP host command following is the command that you need to configure:
(config)#snmp-server host
E.g.:
snmp-server enable traps snmp authentication linkdown linkup coldstart warmstart
Above trap will send you send you following information :
>Authentication : if any one tries to poll the device using wrong community string
>linkdown/linkup : if any of the interface/ports/links goes down it will notify you
snmp-server enable traps bgp
Above trap will send you traps regarding problems with BGP running on your Device
Now I come to CPU part, yes it may spike CPU sometime if regular polling is done from the Management Server or if any MIB has long output. You can use Solarwinds NPM for the same however if it causes high cpu then you have to openup a TAC Case with NMS team to have the issue resolved.
To know more about MIB's on your device you can execute command on your Device 'show snmp mib' and can translate the MIB's using following link to know more about particular MIB :
http://tools.cisco.com/Support/SNMP/do/BrowseOID.do?local=en&translate=Translate&objectInput=1.3.6.1.2.1.15
Kindly let me know in case you have any other doubts.
Thanks & Regards,
Nikhil Gakhar -
3750 sw is not sending SSH login failure SNMP trap
Hi experts,
I want to make my switch send trap when failed SSH login is detected. I found the "login Enhancement" feature and enabled the trap and logging for the failed attempt.
3750# sh run | in login
aaa authentication login default local
login delay 1
login on-failure
3750# sh login
A login delay of 1 seconds is applied.
No Quiet-Mode access list has been configured.
All failed login is logged and generate SNMP traps.
Router NOT enabled to watch for login Attacks
Then I enabled all the traps except the one for the syslog (because I don't want all the log messages are sent as SNMP traps...)
(config)# snmp-server enable traps
(config)# no snmp-server enable traps syslog
(config)# snmp-server host 10.1.1.1 mysnmpkey
Now when I try to login with incorrect password I do see the log but I don't receive the trap...
Nov 23 12:39:27: %SEC_LOGIN-4-LOGIN_FAILED: Login failed [user: admin] [Source: 10.1.1.1] [localport: 22] [Reason: Login Authentication Failed] at 12:39:27 EST Wed Nov 23 2011
Of course when I enable the "syslog" trap I see something but that's more just for this log message
Any idea why??
My 3750-24TS-E is running
Cisco IOS Software, C3750 Software (C3750-IPSERVICESK9-M), Version 12.2(55)SE3, RELEASE SOFTWARE (fc1)
Thanks!
DifanHey Smitesh thanks for the reply. However my switch doesn't support the aaa_server trap...
#snmp-server enable traps ?
auth-framework Enable SNMP CISCO-AUTH-FRAMEWORK-MIB traps
bgp Enable BGP traps
Mine is a 3750 switch. Is this command for routers?
Thanks,
Difan -
Hello All,
We are planning to implement SNMP monitoring in our network. Are there any recommended SNMP traps that should be enabled on the devices so we dont get clobbered with thousands of traps.
We have the following devices on our network-
Cisco 7206 with ATM interface, running BGP, EIGRP, PBR.
Cisco 6509, 6513 switches- Running EIGRP, Cisco FWSM
Cisco 1841 routers- have serial links, running BGP, Frame relay.
Cisco 2800 router- acting as DHCP server
Cisco ASA - 1) Perimiter firewall, 2) SSLVPN firewall.
We wish to monitor not only the external parameters like the circuits, routing protocols etc,, but also hardware and environmental parameters if possible.
If someone can recommend a list of traps that should be enabled for these devices, I wold much appreciate it.
Regards,
Imran.Clearly you should test and refine this list based on your run time experience, but if you enable these trap keywords, that should provide you with a good set of signal to manage.
General:
snmp
entity
envmon
cpu
memory
EIGRP:
eigrp
BGP:
bgp
Frame-relay:
frame-relay
Some of your routing and DHCP management may only be possible with IP SLA and the Embedded Event Manager. In that case, you may want to enable the following two keywords, which will allow you to build IP SLA collectors and EEM policies that can generate SNMP traps:
ipsla
event-manager
For the ASA, enable the following trap keywords:
entity
ipsec
snmp -
Questions on Receiving SNMP Traps
Hi:
- I have more questions on receiving SNMP traps:
1) the OEM plug-in can receive traps now, but when I click the metric, I see:
Error getting data for target test20. Exception: ORA-20216: ORA-06512: at "SYSMAN.EMD_MNTR", line 817 ORA-01403: no data found ORA-06512: at line 1
- the push descriptor looks like:
<PushDescriptor RECVLET_ID="SNMPTrap">
<Property NAME="MatchEnterprise" SCOPE="GLOBAL">...</Property>
<Property NAME="MatchGenericTrap" SCOPE="GLOBAL">6</Property> <Property NAME="MatchSpecificTrap" SCOPE="GLOBAL">31</Property> <Property NAME="MatchAgentAddr" SCOPE="INSTANCE">target_ip</Property>
<Property NAME="EventsnChasFanIndexOID" SCOPE="GLOBAL">...</Property>
<Property NAME="ContextsnChasFanDescriptionOID" SCOPE="GLOBAL">...</Property>
<Property NAME="SeverityCode" SCOPE="GLOBAL">WARNING</Property>
</PushDescriptor>
- is the Key Property needed ?
2) The alerts for some reason do not filter back to the all targets home page.
- When I click the Home tab and goto to the 'All Targets' pane, I do not see the alert generated by the OEM plug-in.
- What I am doing wrong ?
3) Is it okay to receive traps with the metric usage set to either: HIDDEN or HIDDEN_COLLECT ?
- Does this cause the errors I see in Q 1) ?
Thanks
John
Edited by: user8826739 on Feb 23, 2010 7:05 AMHi John,
Can you post the full definition of the metric? You would need to use the Key property for each key column in the metric description.
With the SNMP receivelet you can set up definitons for data points or alerts. I would assume (as I've never tried this ;) that if you set up the definition to be a data point, you would see data from the All Metrics page. To me, it wouldn't make sense for a metric that used the PushDescriptor SNMPTrap to have data to be viewed as the result of the SNMP trap coming is would be an alert. I will have to look into that. My gut reaction is that a metric with PushDescriptor SNMPTrap shouldn't even appear on the All Metrics page ...
To be clear are you saying that you don't see the Warning number under "All Targets Alerts" increase by 1 when you SNMP trap is caught and alert is generated? When this occurs do you see the alert on the target instance homepage?
In regards to HIDDEN and HIDDEN_COLLECT, I don't know what effect they would have on a metric defined for an SNMP trap to raise an alert. You definitely wouldn't want to use HIDDEN as this setting is for temporary metrics that are used in the caclulation of other metrics. HIDDEN metrics are not collected (or hence uploaded to the OMS) and don't appear in the UI. HIDDEN_COLLECT are collected, but do not show up in the UI and are not uploaded. I've never used this settings with SNMP trap metrics that are for alerts. If your metrics for the SNMP trap alerts do show up on the All Metrics page (I'd have to get something set up to look at this), then it could make sense to use the HIDDEN_COLLECT as the alert would still be generated, but the metric itself wouldn't be shown in the UI.
Let me find out the expected behavior from someone on the agent team.
Dave -
What is the minimum server layer OEM version supports SNMP trap reception ?
Hi:
- I have been trying to enable SNMP trap reception on an OEM plug-in.
- I turned on debug channel for recvlets.snmp and saw:
2009-10-16 16:07:42,808 Thread-3028552624 ERROR recvlets.snmp: Duplicate threshold : test900, oracle_guide, interfaces, status
and
2009-10-16 16:09:08,382 Thread-3021634480 INFO recvlets.snmp: Trap received is to convert Data Point
2009-10-16 16:09:08,379 Thread-3021634480 INFO recvlets.snmp: Sending Data Point ...
2009-10-16 16:09:08,379 Thread-3021634480 INFO recvlets.snmp: Listening for TRAP
So, it looks like the OEM agent can receive traps but no data point or alert appears.
And, the agent always issues an error about duplicate thresholds.
- Does the agent have to be patched ?
My agent is:
Oracle Enterprise Manager 10g Release 5 Grid Control 10.2.0.5.0.
Copyright (c) 1996, 2009 Oracle Corporation. All rights reserved.
Agent Version : 10.2.0.5.0
OMS Version : 10.2.0.1.0
Protocol Version : 10.2.0.0.0
Agent is Running and Ready
- on the server layer, the oms is:
Oracle Enterprise Manager 10g Release 10.2.0.1.0
Copyright (c) 1996, 2005 Oracle Corporation. All rights reserved.
Oracle Management Server is Up.
Is a patch needed for OMS ?
Should OMS be version 10.2.0.5.0 ?
Thanks
John
Edited by: user8826739 on Feb 23, 2010 7:17 AM10.2.0.5 should be fine ...
Dave -
Creating SNMP Trap Monitors in 2012 R2
Hello,
For the past week or so I have been attempting to create a MP for my company's UPSs to be monitored in SCOM 2012 R2. I have created a custom MP with custom datasources and objects. All seems to go according to the plan until I attempt to create a SNMP
Trap monitor for those objects. I am able to verify that the device is discovered and is sending the traps successfully with a view. The problem seems to lie within the setup of the monitor. I have followed the steps as much as I can from this page http://technet.microsoft.com/en-us/library/hh563870.aspx
to create a monitor that will be triggered by an incoming trap saying the UPS is on Battery Power.
This is the initial or trigger event information received by SCOM:
<EventData>
<DataItem type="System.SnmpData" time="2014-07-03T08:48:07.6990732-07:00" sourceHealthServiceId="26DF02E5-DEA0-BED0-443B-3605A05D4790">
<Source>10.51.85.40</Source>
<Destination>127.0.0.1</Destination>
<ErrorCode>1</ErrorCode>
<Version>1</Version>
<SnmpVarBinds>
<SnmpVarBind>
<OID>.1.3.6.1.2.1.1.3.0</OID>
<Syntax>67</Syntax>
<Value VariantType="19">17567220</Value>
</SnmpVarBind>
<SnmpVarBind>
<OID>.1.3.6.1.6.3.1.1.4.1.0</OID>
<Syntax>6</Syntax>
<Value VariantType="8">.1.3.6.1.4.1.318.0.5</Value>
</SnmpVarBind>
<SnmpVarBind>
<OID>.1.3.6.1.4.1.318.2.3.3.0</OID>
<Syntax>4</Syntax>
<Value VariantType="8">UPS: On battery power in response to an input power problem.</Value>
</SnmpVarBind>
<SnmpVarBind>
<OID>.1.3.6.1.6.3.1.1.4.3.0</OID>
<Syntax>6</Syntax>
<Value VariantType="8">.1.3.6.1.4.1.318</Value>
</SnmpVarBind>
</SnmpVarBinds>
</DataItem>
</EventData>
This is the event should signal that everything is operating normally once again.
<EventData>
<DataItem type="System.SnmpData" time="2014-07-03T08:48:12.9133769-07:00" sourceHealthServiceId="26DF02E5-DEA0-BED0-443B-3605A05D4790"><Source>10.51.85.40</Source>
<Destination>127.0.0.1</Destination>
<ErrorCode>1</ErrorCode>
<Version>1</Version>
<SnmpVarBinds>
<SnmpVarBind>
<OID>.1.3.6.1.2.1.1.3.0</OID>
<Syntax>67</Syntax>
<Value VariantType="19">17567730</Value>
</SnmpVarBind>
<SnmpVarBind>
<OID>.1.3.6.1.6.3.1.1.4.1.0</OID>
<Syntax>6</Syntax>
<Value VariantType="8">.1.3.6.1.4.1.318.0.9</Value>
</SnmpVarBind>
<SnmpVarBind>
<OID>.1.3.6.1.4.1.318.2.3.3.0</OID>
<Syntax>4</Syntax>
<Value VariantType="8">UPS: No longer on battery power.</Value>
</SnmpVarBind>
<SnmpVarBind>
<OID>.1.3.6.1.6.3.1.1.4.3.0</OID>
<Syntax>6</Syntax>
<Value VariantType="8">.1.3.6.1.4.1.318</Value>
</SnmpVarBind>
</SnmpVarBinds>
</DataItem>
</EventData>
You may notice that these traps are being sent as SNMP v1. I am unable to change that on the UPS so i have modified the monitors to account for that. Here is the code for the monitor:
<UnitMonitor ID="UIGeneratedMonitorc2c65f3c85fe42f48ce8d2580c57bbae" Accessibility="Public" Enabled="true" Target="APC.MP.UPS" ParentMonitorID="Health!System.Health.AvailabilityState" Remotable="true" Priority="Normal" TypeID="SNL!System.NetworkManagement.SnmpTrapProvider.2SingleEvent2StateMonitorType" ConfirmDelivery="false">
<Category>Custom</Category>
<AlertSettings AlertMessage="UIGeneratedMonitorc2c65f3c85fe42f48ce8d2580c57bbae_AlertMessageResourceID">
<AlertOnState>Warning</AlertOnState>
<AutoResolve>true</AutoResolve>
<AlertPriority>Normal</AlertPriority>
<AlertSeverity>Error</AlertSeverity>
</AlertSettings>
<OperationalStates>
<OperationalState ID="UIGeneratedOpStateId2750c1ab2cd14b4a8a8e9f4633eba0b0" MonitorTypeStateID="SecondEventRaised" HealthState="Success" />
<OperationalState ID="UIGeneratedOpStateId5753748399984d08953c1a46895df99c" MonitorTypeStateID="FirstEventRaised" HealthState="Warning" />
</OperationalStates>
<Configuration>
<FirstIP>$Target/Property[Type="SNL!System.NetworkManagement.Node"]/SNMPAddress$</FirstIP>
<FirstVersion>1</FirstVersion>
<FirstOIDProps>
<OIDProp>.1.3.6.1.4.1.318</OIDProp>
</FirstOIDProps>
<FirstExpression>
<SimpleExpression>
<ValueExpression>
<XPathQuery Type="String">SnmpVarBinds/SnmpVarBind[OID=".1.3.6.1.6.3.1.1.4.1.0"]/Value</XPathQuery>
</ValueExpression>
<Operator>Equal</Operator>
<ValueExpression>
<Value Type="String">.1.3.6.1.4.1.318.0.5</Value>
</ValueExpression>
</SimpleExpression>
</FirstExpression>
<SecondIP>$Target/Property[Type="SNL!System.NetworkManagement.Node"]/SNMPAddress$</SecondIP>
<SecondVersion>1</SecondVersion>
<SecondOIDProps>
<OIDProp>.1.3.6.1.4.1.318</OIDProp>
</SecondOIDProps>
<SecondExpression>
<SimpleExpression>
<ValueExpression>
<XPathQuery Type="String">SnmpVarBinds/SnmpVarBind[OID=".1.3.6.1.6.3.1.1.4.1.0"]/Value</XPathQuery>
</ValueExpression>
<Operator>Equal</Operator>
<ValueExpression>
<Value Type="String">.1.3.6.1.4.1.318.0.9</Value>
</ValueExpression>
</SimpleExpression>
</SecondExpression>
</Configuration>
</UnitMonitor>
I tried the following things while attempting to troubleshoot this issue:
Leaving First
SnmpTrapProvider and Second
SnmpTrapProvider blank while creating the monitor.
Adding "" and also '' around the value as it is a string and perhaps that was the cause.
Changing the First and Second SNMPTrapProvider to .1.3.6.1.6.3.1.1.4.1.0 since that is the specific OID I am looking for the value of.
Reading every page of the internet and bashing my head on the keyboard.
I am guessing that the issue will reside in the the monitor creation and definition, but I have not found anything that clearly describes how to fill out the SNMP Trap Monitor wizard given the trap info. Especially since the trap I am receiving does
not seem to contain the usual OID with a common Int or string value. Hopefully someone can provide assistance as I am nearing my wits end with this problem.Firstly, thank you Michael Skov, knowing that the First and Second SnmpTrapProvider or <FirstOIDProps> in the xml, needed to be blank got me pointed in the right direction. I figured I would come back and share my final working code snippet in case
others run across a similar issue.
<UnitMonitor ID="UIGeneratedMonitorf9f671e5456c44fd807d6ec2bd09621d" Accessibility="Public" Enabled="true" Target="Disc!APC.Disc.UPS" ParentMonitorID="Health!System.Health.PerformanceState" Remotable="true" Priority="Normal" TypeID="NetworkManagement!System.NetworkManagement.SnmpTrapProvider.2SingleEvent2StateMonitorType" ConfirmDelivery="false">
<Category>Custom</Category>
<AlertSettings AlertMessage="UIGeneratedMonitorf9f671e5456c44fd807d6ec2bd09621d_AlertMessageResourceID">
<AlertOnState>Warning</AlertOnState>
<AutoResolve>true</AutoResolve>
<AlertPriority>Normal</AlertPriority>
<AlertSeverity>Warning</AlertSeverity>
</AlertSettings>
<OperationalStates>
<OperationalState ID="UIGeneratedOpStateId8700c95344254f87a60c92d30d4a3953" MonitorTypeStateID="SecondEventRaised" HealthState="Success" />
<OperationalState ID="UIGeneratedOpStateId7bf68c6cfe3d4faabe83e630781c7327" MonitorTypeStateID="FirstEventRaised" HealthState="Warning" />
</OperationalStates>
<Configuration>
<FirstIP>$Target/Property[Type="NetworkManagement!System.NetworkManagement.Node"]/SNMPAddress$</FirstIP>
<FirstVersion>1</FirstVersion>
<FirstOIDProps />
<FirstExpression>
<SimpleExpression>
<ValueExpression>
<XPathQuery Type="String">SnmpVarBinds/SnmpVarBind[OID=".1.3.6.1.6.3.1.1.4.1.0"]/Value</XPathQuery>
</ValueExpression>
<Operator>Equal</Operator>
<ValueExpression>
<Value Type="String">.1.3.6.1.4.1.318.0.5</Value>
</ValueExpression>
</SimpleExpression>
</FirstExpression>
<SecondIP>$Target/Property[Type="NetworkManagement!System.NetworkManagement.Node"]/SNMPAddress$</SecondIP>
<SecondVersion>1</SecondVersion>
<SecondOIDProps />
<SecondExpression>
<SimpleExpression>
<ValueExpression>
<XPathQuery Type="String">SnmpVarBinds/SnmpVarBind[OID=".1.3.6.1.6.3.1.1.4.1.0"]/Value</XPathQuery>
</ValueExpression>
<Operator>Equal</Operator>
<ValueExpression>
<Value Type="String">.1.3.6.1.4.1.318.0.9</Value>
</ValueExpression>
</SimpleExpression>
</SecondExpression>
</Configuration>
</UnitMonitor> -
Hi,
I'm trying very hard to set up a Sun Fire V245 to send SNMP traps when certain hardware or software related events occur. I've been looking at sma_snmp (net-snmp) and the Fault Management Daemon (SUNWfmd) but they seem to be very limited in their capabilities. I have manged to get some traps sent for filesystem fill-ups and high load averages but that is about it.
Most of all I would like the system to send traps when there is a HW failure such as a faulty FRU or if there are disk failures.
If anyone can point me to some documentation about this, I would be most grateful.
/MikaelMikael,
I struggled through the same thing with a Netra 240 recently. The Sun docs are garbage when it comes to this. I opened a ticket with Sun and after 3 days and 6 hours on the phone I finally got hold of someone who knew how to spell SNMP. Yes, it was that bad!
Here's the scoop. In Solaris 10 you run Net-SNMP, a.k.a. SMA, snmpd. The old snmpdx is obsoleted and you shouldn't configure it at all.
Now to get the hardware related traps for the Sunfire and Netra series servers... (what you are really looking for).
You have to load and configure an additional SNMP daemon for the hardware specific traps.
(The first doc is rather old, the last one 819-7978-12 is pretty new and is somewhat more relevant.)
Sun� SNMP Management Agent for Sun Fire� and Netra� Systems: Sun Doc number 817-2559-13
Sun� SNMP Management Agent Addendum for the Netra� 240 Server: Sun Doc Number 817-6238-10
Sun� SNMP Management Agent Administration Guide for Sun Blade� /Sun Fire�/Sun SPARC� Enterprise/Netra� Servers: Sun Doc Number 819-7978-12
And finally the SMA/net-snmp/snmpd guide for the standard Solaris related traps:
Solaris System Management Agent Administration Guide: Sun Doc Number 817�3000�11
There are problems with all of the above documents. None of the Netra/Sunfire docs specifically talk about Solaris 10 so read them with caution. They also talk about configuring and running snmpdx and never reference SMA/net-snmp. This is odd because the instructions I got from Sun (finally) were not to run snmpdx, only to run sma/snmpd and additionally run the sunfire/netra snmpd agent.
The SMA document (817-3000-11) has an undocumented bug, which Sun knows about and is working on but will not reveal to the public. In the section titled "Migration From the Sun Fire Management Agent" it references using a script called masfcnv to convert the sunfire/netra specific snmp config and daemon to work with and through SMA. Since they all use the same ports (161/162) there is some conflict and the masfcnv is script is meant to resolve this by making sma/snmpd a proxy agent to requests toward the sunfire/netra specific hardware daemon.
The problem is the masfcnv script doesn't work properly. In fact, if you run the script you will destroy your other snmp configurations and may have to uninstall and reinstall the packages to clean everything up. This script hasn't ever worked and Sun is working on a fix but they neglect to mention this in the document which is IMO gross negligence and is a reflection of Sun's overall state of affairs (but that's another ranting thread).
So what you must do is configure SMA/net-snmp (or whatever you want to call it), and also configure the sunfire/netra specific snmp (after downloading and installing that package).
Since traps are sent to the remote trapsink using destination port 162, both net-snmp and the netra specific snmp daemons can co-exist here (port 162 is not an open listening port on the machine).
Port 161 is used for receiving SNMP Get requests and can only be bound to one daemon at a time. So either it is used by net-snmp or the netra snmp daemon, but not both. Since my boxes have not been fully integrated still I can't figure out which daemon 161 is bound to. At any rate, in my application the customer is only interested in receiving traps so the outcome here isn't that important.
I realize this isn't complete but I'm no expert here and haven't worked through all the test scenarios on a fully configured system. Hopefully though this will help clear some of the confusion propogated through Sun's stupid documents. Good luck!
/Frank -
Hi,
how can i make my Solaris 10 generate SNMP trap on specific event?
like high CPU,Load or lack of disk space ?
thanks
Ramit should be possible to define the "index" in each /etc/hostname. file
I have never done this, but when the system boots it reads the content of these files and passes them to "ifconfig" to configure the NICs
search this page for "index":
http://docs.oracle.com/cd/E19253-01/816-5166/ifconfig-1m/index.html -
SCOM 2012 SNMP Trap - Does anyone have it working?
I am wondering if anyone out there has had any luck with getting SNMP Traps to be captured by SCOM 2012? Probes work fine.
We have been unable to get SCOM 2012 to receive a SNMP Trap from network devices. We currently have a case open with Microsoft, but they dont have any answers as of yet.
Here are the cliff notes version of what we have done so far.
Discovery - OK
The nodes discover without issue. I made sure they were set to SNMP only. I did this to verify we were talking SNMP and not just ICMP.
Open Ports/Firewall Issues
No firewalls are in place on the SCOM server and none exist between devices we are trying to get traps from. Using a port tool, I can see that UDP 162 is listening as expected and its the System Center Management Host Process that is running the
process. We have tried having SNMP installed, but disabled, installed and running, and uninstalled. Currently we have the SNMP service installed and running. The SNMP Trap Service is NOT installed.
Data Validation
Using Wireshark running on the SCOM box I have been able to validate the OIDs we are searching for are hitting the SCOM server. I installed an SNMP Trap generator and Receiver on my local machine as well as Jalasoft SNMP Simulator. I was able
to discover my local machine as a network device and if I send a TRAP from the TRAP generator on my local machine to the receiver on my local machine I can validate the data is coming through ok.
What has been done on SCOM side
The simplest place to look for data is with an Event Collection Rule and then an Event View Monitor. We have set up an Event Based Monitor to search for an OID that I know to be accurate and then I set up an Event monitor to look for
anything hitting that Collection Rule. The Event monitor showed nothing so we changed the EVent Monitor to look for anything that hit Node which should show any SNMP traps that have hit from network devices. No results.
We tried to run WFAnalyzer from the 2007R2 Authoring Console, but it wont run against 2012 and from what I have found the 2012 edition doesnt exist anywhere yet.
So has anyone succesfully received a SNMP TRAP into SCOM 2012?Hi,
As this thread has been quiet for a while, we assume that the issue has been resolved. At this time, we will mark it as "Answered" as the previous steps should be helpful for many similar scenarios.
In addition, we’d love to hear your feedback about the solution. By sharing your experience you can help other community members facing similar problems.
Thanks,
Yog Li
TechNet Community Support
How could you possibly mark this as answered? No answer was given, it was quiet for a couple of days including one of which was a holiday in the US. The previous steps are NOT helpful. The question remains, Does anyone have it working?
People have given troubleshooting advice, but nobody has actually answered the simple question. Do they have it actually WORKING? -
SNMP Trap Translation Wrong For Hebrew Language
SR 3-4956842281
sev 2
Cus ISRAEL CREDIT CARDS LTD
=====================
Customer is using OMS 10.2.0.5 on linux server.
They have created an user defined metric on DB cluster instance with alert message written in hebrew.
The OMS console showed the alert in hebrew as expected.
However when they send this alert with snmp trap notification to a second system (HP openview for windows) then the message appeared not cleared (with question marks). This second system get messages in hebrew from other systems without any problems.
+Does setting LANG variable at OMS level will impact this
+Any tracing which can help to find the cause of the issueClosing as issue found at HP openview parameter settings
-
Can a WLC have multiple SNMP Trap Receivers with the same cummunity string?
My Monitoring team want me to send traps to three different trap collectors with the same SNMP Community string.
I have 2106's, 2504, 4400's, 5500's, 7510 all running either version 6 or 7.
Is this possible on a Wireless controller? If so, how?Read this from my friends blog ..
http://mrncciew.com/2013/02/14/configuring-snmp-on-wlc/
"Also you can configure SNMP trap receiver where WLC can send its snmp trap messages. Community Name means SNMP trap receiver name & that does not have any significance like snmp community value."
It doesnt appear to have the same significants .. But I havent tested it
"Satisfaction does not come from knowing the solution, it comes from knowing why." - Rosalind Franklin
"I'm in a serious relationship with my Wi-Fi. You could say we have a connection."
Maybe you are looking for
-
What can i do?
-
Apple TV- Importing Music DVD's That I Own- Physical DVD's
What is the procedure to import Music DVD's into iTunes and down to an ATV? Do I need a ripper in addition to something like MacTheRipper or Handbrake?
-
I'm attempting to create a chart that displays the top 10 of an item over time. The problem I'm having is that if I create a chart that is on change of the item first (with top 10) and time second, it gives me the top 10 items for each time slot. I
-
How to query UML models with OCL?
Hello everyone, I am working on using OCL to query UML models. Besides diverse examples, I don't know how certain UML metamodel elements are accessed via OCL when an instance model is given. Where am I supposed to look after this information?
-
Cinematic Color Plug In-After Effects?
I recently purchased the product. I am not sure if there is any way to get the "Cinema" color without purchasing the Magic Bullet plug in which is semi-expensive. I am just interested in playing around at this point-I am new to video. Are there any o