Configure WCS to limit SNMP Trap to only Rogue AP alert

Hello all,
Is there a way to limit SNMP traps sent by WCS to only Rogue AP Alert? I know I can configure WCS to send email notification for Rogue AP Alert, but couldn't find anything similar for SNMP traps.
Also, where can I find WCS MIBS and OID for Rogue AP Alert?
Thanks.

https://tools.cisco.com/bugsearch/bug/CSCue09354 may be this is root of problem, when I use native vlan on access port WLC can found rogue ap on wired network... but i use version 7.4.121

Similar Messages

Manually configure WCS as an SNMP Trap Receiver?

If I discover a WLC through the WCS, do I still need to manually configure the WCS as an SNMP trap receiver on the WLC?

The WCS machine must be configured as an SNMP trap receiver to have full management functionality through the WCS.

Cisco Prime SNMP Traps Best Pratice

The Cisco Prime documentation recommends configuring switches to send SNMP traps. However it does not give any more details.
I was wondering what sorts of SNMP traps people in the community are using with Cisco Prime 2.1. I'm looking for some sort of best practice or for an idea of what traps would be the most useful to configure on the switches, to send to Prime.

Hi ,
Snmp traps need to be configured only on device end , there is no config need to be done on PI.
you can enable all the traps that you want. for e.g
snmp-server enable traps syslog
snmp-server enable traps ipsec start stop
snmp-server enable traps memory-threshold
snmp-server enable traps interface-threshold
snmp-server enable traps connection-limit-reached
snmp-server enable traps cpu threshold rising
etc......
and you can monitor then in PI (Administration > System Settings > Severity Configuration, Link down)
check the below link as well:
https://supportforums.cisco.com/discussion/11919481/prime-infrastructure-20-link-status-alarms
Thanks-
Afroz
***Ratings Encourages Contributors ***

LMS 3.2.1 integration with Clarity NMS for snmp trap forwarding

Our client have integrated Clarity NMS to Ciscoworks LMS 3.2.1. So far they are receiving raw alarms/snmp traps but it lacks information/inventory of the originating device. Kindly see sample raw alarms below:
2420: 2011-11-25 12:10:46 Received trap ==> Received SNMPv1 Trap
Community=ciscoworks
Enterprise=1.3.6.1.6.3.1.1.5
Generip trap type=2
Specific Trap Type=0
Trap From=10.220.10.1
Trap ID=1.3.6.1.6.3.1.1.5.2
Trap Time=-1436283373
1.3.6.1.2.1.2.2.1.1.83=83
1.3.6.1.2.1.2.2.1.2.83=GigabitEthernet1/40
1.3.6.1.2.1.2.2.1.3.83=6
1.3.6.1.4.1.9.2.2.1.1.20.83=Lost Carrier
EndTrap
10933: 2011-11-24 11:57:53 Received trap ==> Received SNMPv1 Trap
Community=ciscoworks
Enterprise=1.3.6.1.4.1.9.1.291
Generip trap type=2
Specific Trap Type=0
Trap From=10.220.10.1
Trap ID=1.3.6.1.4.1.9.1.291.2
Trap Time=1628056965
1.3.6.1.2.1.2.2.1.1.8=8
1.3.6.1.2.1.2.2.1.2.8=E1 0/0/0
1.3.6.1.2.1.2.2.1.3.8=18
EndTrap
As you can see, those raw alarms doesn’t contain any information about the originating equipment or the physical card, port related information where those alarms were generated. Instead those alarms received are just NMS level alarms.
How do we resolve this so that the inventory of the equipment would be part of the trap to be received by Clarity from Ciscoworks.

Hi,
Is the issue you have the source IP address of the forwarded trap? Per RFC it is the IP of the actual device sending the trap. The originating IP should be contained within the packet. I have included some additional information you may find helpful.
Q. What is the difference between SNMP Raw Trap Forwarding and SNMP Trap alert/event Trap Forwarding? Does DFM support both?
A. You can configure raw trap forwarding at DFM > Other configuration > SNMP Trap forwarding, and processed event/alert trap forwarding at DFM > Notification Services > SNMP Trap Forwarding. Processed trap is "when DFM receives certain SNMP traps, it analyzes the data found in fields (Enterprise/Generic trap identifier/Specific Trap identifier/variable−bindings) of each SNMP trap message, and changes the property value of the object property (if required)". Raw trap is the trap that the device forwards to DFM and DFM has yet to process it. For more information, refer to the DFM User Guide. Yes, DFM supports both ways of trap forwarding.
http://www.cisco.com/en/US/products/sw/cscowork/ps2421/products_qanda_item09186a0080a9b35b.shtml
DFM will only forward SNMP traps from devices in the DFM inventory. It will not change the trap format—it will forward the raw trap in the format in which the trap was received from the device. However, you must enable SNMP on your devices and you must do one of the following:
Configure SNMP to send traps directly to DFM
Integrate SNMP trap receiving with an NMS or a trap daemon
The versions of SNMP traps supported by DFM are described in SNMP and ICMP Polling. For information on forwarding processed and pass-through traps, see Processed and Pass-Through Traps, and Unidentified Traps and Events.
Pass-through traps are traps that DFM receives from devices that are not in the DFM inventory, and DFM has not processed. Forwarding these traps is controlled using Configuration > Other Configurations > SNMP Trap Forwarding. These traps are shown in the Alerts and Activities display because of their relevance to fault monitoring. Pass-through traps are displayed as follows:
As one of the following events:
> InformAlarm
> MinorAlarm
> MajorAlarm
With the device type and the device name from which it was generated.
If DFM does not know which device generated the trap, it ignores the trap. Pass-through traps will be cleared after a default interval of 10 minutes to one hour
http://www.cisco.com/en/US/docs/net_mgmt/ciscoworks_device_fault_manager/3.2/user/guide/dfm32ug_Book.html

Phantom SNMP Traps

Hi,
I've got most of my devices spouting SNMP traps for various different things, and Ciscoworks forwards these traps on via email, as you do.
For most things it works great, however since we've created a script to pull on the configs off the devices (Simply don't trust Ciscoworks), we're always spammed with SNMP traps like the one below:
ALERT ID                = 000071P
TIME                    = Mon 10-Jan-2011 16:19:07 GMT
STATUS                  = Active
SEVERITY                = Critical
MANAGED OBJECT          = lrouter-loo-0.mwam.local
MANAGED OBJECT TYPE     = Switches and Hubs
EVENT DESCRIPTION       = router1-loo-0.mwam.local: Cisco Configuration Management Trap:InformAlarm; PORT-lon-cr1-loo-0.mwam.local/10113 [Gi1/0/13] [Trunk to router2-gig-1-0-24]:OperationallyDown;
CUSTOMER IDENTIFICATION = networks-info
I know one port is down, and that's expected, I just haven't cleared the alert and turned off the monitoring in DFM.
We're using:
snmp-server enable traps config-copy
snmp-server enable traps config
on all of our devices, but only 4 out of 80+ devices throw this trap out when their config is copied by the script.
I've googled extensively, but I haven't come across any real help.
Has anyone got any idea what the situation is with this? I'm getting bored of deleting a bunch of emails every time our script runs, and I don't want to create a rule for fear of filtering real alerts.
Any ideas would be appreciated
Cheers

This isn't a trap. This is a DFM alert, which consists of multiple atomic events. In this case, it looks like the alert consists of two events. The first is a CISCO-CONFIG-MAN-MIB trap (i.e. ciscoConfigManEvent). If you look at the associated event in the DFM Alerts and Acitivities Display, I'll bet it will indicate the configuration was copied (per your script). The other event indicates that port Gi1/0/13 is operationally down on this switch. The two events are unrelated, but apply to the same device.

No SNMP traps from sun x4150 ILOM server

Hi all,
I have set up the ILOM alerts with SNMP traps (v2c,public) according to the ILOM user guide and pressed the "send test alerts". Nothing shows up in the SNMP trap monitor (using MG-SOFT software). When I add another alert of IPMI pet type (same destination ip as of SNMP trap alert) I see events in the trap monitor. It looks like the ILOM does not generate SNMP traps but only IPMI traps.
In the ILOM user guide there is an explicit example of traps sent from the ILOM (in addition to the fact that the ILOM features include SNMP traps AS WELL as IPMI) so it seems this is possible...
my ILOM version is
SP Firmware Version 2.0.2.6
Does anyone have any idea of any step I have missed ?
Thanks in advance.
Lior

Once the Network Device (Linux server in this case) is discovered you will still need a rule that targets that class and accepts incoming SNMP Traps for that OID, or All OIDs if you prefer. I found 2 links that may be of help, the first is just a basic
overview of the SNMP listener in SCOM 2012 as it has changed from the OS Listener in 2007 to a dedicated one.
http://systemcentertech.com/2012/05/17/scom-2012-built-in-snmp-trap-listener/
The second link covers SNMP setup, but starting at Step 7 there is a great how-to on creating your own SNMP rule which will be needed to collect your traps.
http://scom-2012.blogspot.com/2012/07/setting-up-snmp-monitoring-in-scom-2012.html
www.Practice2Perfect.com

Sending as SNMP trap

Hello expert,
Currently my SolMan system serve as central ccms monitoring, some of the alerts are sending email alert as auto reaction method.
But recently there is request to send the alert to 3rd party non SAP monitoring tool. I am thinking of SNMP traps. but question is each MTE can only have 1 auto reaction method, if i change it to use SNMP traps, so my exisitng email alert is not able to working parallel?
please advise.
thank you
kelly

Dear Kelly,
You may find the following document useful when using CCMS and SNMP Traps.
> https://websmp109.sap-ag.de/~form/sapnet?_FRAME=CONTAINER&_OBJECT=011000358700001606922004E
Regards,
Paul

SNMP Traps and DCNM 6.1(2)

Hello Everyone,
I have DCNM 6.1(2) installed on a Windows Server 2008 R2 to monitor and manage 4 Nexus 7018 (12VDC's).
I currently have one problem left. All snmp traps send from the Nexus Switches are all dropped and none processed, and i currently rely on the syslog messages, but would prefer the snmp traps.
I start wondering if the snmp traps are only for SAN devices?
Or If I am doing something totally wrong. Port for the traps is 2162. Discovery via snmpv3 works... Traps are sent and recieved but dropped.
Perhaps someone could shed some light into this.
Thanks
Pol

Hi,
Yes, DCNM for SAN supports forwarding of alerts using Cisco Call Home, EMC Call Home, email, and Simple Network Management Protocol (SNMP) traps.
DCNM LAN supprts Syslog and E-Mail.

SNMP Traps by Nexus 5010

I (my customer) does not get SNMP Traps from the N5k when he unplugs one power supply (only logs). He gets only traps when he turns both power supplies off. If I check show snmp trap all trap entity are enabled (rmon Trap are off). NX-OS is 4.2(1)N2(1).
How he will get traps if one power supplies is off or fails?

Hi
Thanks for your support.
First I like to mention that the issue is when an Nexus2k behind the 5k (FEX) looses the power on one power-supply.
The trap I get if both power supplies are disconected is:
"Power Status Change Event.
The power operational status of a FRAU at entPhysicalTable index has changed to offEnvPower.
Power Admin Status: . "
4 seconds later I get than also the FRU Removal Event.
like mentioned eralier we also would like to get snmp traps when only one power supply goes down, but can't not figure out the config for that.
K.R.
Markus

TimesTen SNMP traps

Hello,
I have TT over Windows 32 bit (stand alone).
I'm trying to configure SNMP traps in order to maintain Alerts for the TimesTen database.
I've followed the doc *"Oracle Times Ten In-Memory Database Error Messages and SNMP Traps"*,
and comfigured the snmp.ini file.
However, when I'm trying to use the utility snmptrapd.exe in order to start listening to the snmp traps and doing my tests, I'm getting an error: snmptrapd.exe is not a valid Win32 application, and in the CMD window I also see *"Access is denied"* error.
My user in the Administrators group.
Why do I receive the error and how can I overcome it ?
Thanks in advance,
Roni.

Hi Roni,
Getting this executable working independently of TimesTen is the first thing to look at.
- Where did you get the snmptrapd.exe executable from?
- Make sure that you get this executable from a known reputable source.
There are viruses out there that use this name.
- The MKS version of this utility is supported on Windows 2000, Windows XP, Windows Server 2003 and Vista.
- Make sure that you have the correct version of the executable for your Windows platform.
Doug

127.0.0.1 IP address in SNMP trap

Hi,
In Weblogic 9.1, SNMP trap agent address is being sent as 127.0.0.1 IP address. Did anyone see this issue ?
Please let me know how this can be fixed
Thanks --GR

Patch needed - CR278615:
DIAGNOSIS: In the SNMP traps being sent out by WLS, the agent ID always comes out 127.0.0.1. If the trap listener was on a remote machine as the WLS server was, it wouldnt make much sense.
RESOLUTION: Initialize the agent address from the server's configuration.
RELEASE NOTE: SNMP trap data sent out by WebLogic Server Traps used to carry the local loopback address (127.0.0.1) of the SNMP agent machine, that is, the admininstration server machine - instead of its actual network IP address. This problem has been resolved.

Questions on Receiving SNMP Traps

Hi:
- I have more questions on receiving SNMP traps:
1) the OEM plug-in can receive traps now, but when I click the metric, I see:
Error getting data for target test20. Exception: ORA-20216: ORA-06512: at "SYSMAN.EMD_MNTR", line 817 ORA-01403: no data found ORA-06512: at line 1
- the push descriptor looks like:
<PushDescriptor RECVLET_ID="SNMPTrap">
<Property NAME="MatchEnterprise" SCOPE="GLOBAL">...</Property>
<Property NAME="MatchGenericTrap" SCOPE="GLOBAL">6</Property> <Property NAME="MatchSpecificTrap" SCOPE="GLOBAL">31</Property> <Property NAME="MatchAgentAddr" SCOPE="INSTANCE">target_ip</Property>
<Property NAME="EventsnChasFanIndexOID" SCOPE="GLOBAL">...</Property>
<Property NAME="ContextsnChasFanDescriptionOID" SCOPE="GLOBAL">...</Property>
<Property NAME="SeverityCode" SCOPE="GLOBAL">WARNING</Property>
</PushDescriptor>
- is the Key Property needed ?
2) The alerts for some reason do not filter back to the all targets home page.
- When I click the Home tab and goto to the 'All Targets' pane, I do not see the alert generated by the OEM plug-in.
- What I am doing wrong ?
3) Is it okay to receive traps with the metric usage set to either: HIDDEN or HIDDEN_COLLECT ?
- Does this cause the errors I see in Q 1) ?
Thanks
John
Edited by: user8826739 on Feb 23, 2010 7:05 AM

Hi John,
Can you post the full definition of the metric? You would need to use the Key property for each key column in the metric description.
With the SNMP receivelet you can set up definitons for data points or alerts. I would assume (as I've never tried this ;) that if you set up the definition to be a data point, you would see data from the All Metrics page. To me, it wouldn't make sense for a metric that used the PushDescriptor SNMPTrap to have data to be viewed as the result of the SNMP trap coming is would be an alert. I will have to look into that. My gut reaction is that a metric with PushDescriptor SNMPTrap shouldn't even appear on the All Metrics page ...
To be clear are you saying that you don't see the Warning number under "All Targets Alerts" increase by 1 when you SNMP trap is caught and alert is generated? When this occurs do you see the alert on the target instance homepage?
In regards to HIDDEN and HIDDEN_COLLECT, I don't know what effect they would have on a metric defined for an SNMP trap to raise an alert. You definitely wouldn't want to use HIDDEN as this setting is for temporary metrics that are used in the caclulation of other metrics. HIDDEN metrics are not collected (or hence uploaded to the OMS) and don't appear in the UI. HIDDEN_COLLECT are collected, but do not show up in the UI and are not uploaded. I've never used this settings with SNMP trap metrics that are for alerts. If your metrics for the SNMP trap alerts do show up on the All Metrics page (I'd have to get something set up to look at this), then it could make sense to use the HIDDEN_COLLECT as the alert would still be generated, but the metric itself wouldn't be shown in the UI.
Let me find out the expected behavior from someone on the agent team.
Dave

Regarding SNMP trap on Backup Unity connection failure

Hi,
if backup of Unity connection failed, would a backup failure produce an SNMP trap?
thanks,
Kamran

RTMT has alerts for DRF backup failures... and can be set to trigger emails, but I am not aware of any SNMP Traps generated by DRS Backup failing.
Kind regards,
Craig

Configuring SNMP Trap receiver on AIP-SSM sensor

I receive the following error message from my ASA5520 firewall when attempting to forward SNMP traps from my AIP-SSM20 sensor to a server on my Inside interface that is configured to receive SNMP traps:
ASA-4-418001: Through-the-device packet to/from management-only network is denied: udp src management: 10.3.21.2/32768 dst Inside: PPC0ES/162
Can I reconfigure the management IP address of the AIP-SSM sensor to connect to the Inside interface instead of the management vlan or does my SNMP server have to reside on the management vlan with the sensor?

Hi Subodh,
Yes, the AIP-SSM can operate in either inline (IPS) or promiscuous (IDS) mode. I would recommend you start by reviewing the following config guide, which shows you how to configure the ASA to pass traffic to the SSM for inspection:
http://www.cisco.com/en/US/products/ps6120/products_configuration_example09186a00807335ca.shtml
If you have any other specific questions, feel free to post back.
Hope that helps.
-Mike

Disable snmp trap link-status only on access ports?

Hello,
I am searching for a way to disable the snmp trap link-status only on access ports.
The problem is that we have a lot of new devices which have no port scheme, so I can't say that everytime the router uplink on a switch is on port X or Y.
So I have to figure out where my uplinks to routers, accesspoints or other switches are and set all other ports to
no snmp trap link-status
no logging event link-status
spanning-tree portfast
Campus Manager knows the uplinks between the devices, but there is no way to perform such a change, right?
The next problem is, that there is nothing configured on the ports, so I can't search for a string by using compliance check in RME.
Is there any posibility to get the topology informations from CM together with the configuration feature from RME?
Thanks a lot!
Sven

Hello,
thanks for your reply.
I thought of something like you wrote...
There is a best practice report for disabling cdp on access ports.
Creating this report for a switch and click on "fix" the CM will configure the command "no cdp enable" on every access port.
So I will have a difference between uplinks and access ports.
The problem with that solution is, that I can't fix all my switches with one job.
And with >1000 switches it is not really possible to click every device.
Any further advice?
Thanks!
Sven

Configure WCS to limit SNMP Trap to only Rogue AP alert

Similar Messages

Maybe you are looking for