IPM 4.2 and SNMP trap.

Hello at all.
We are using IPM 4.2 to configure SLA operations on 7201 with software 12.4(24)T4, downgraded from 15.0 because IPM cannot configure collectors.
When we receive a trap the tag is empty for all collectors.
Performing a SNMP Walk on rttMonCtrlAdminTag we can see the tag.
When we manually define a collector the originated trap has tag populated correctly.
In this last case we can use tag with more than 15 chars also.
Regards.
Andrea

As stated in the other IP SLA thread, you are seeing CSCte85239.  The bug was filed against 12.4(15)T, and wasn't fixed until 15.1(3)T.  However, as you found, the 15.0(1)M4 image was not affected by the bug as it must have been branched before the bug was introduced.
As a workaround, given that you have EEM 3.0 support in 12.4(24)T, you could create an applet that sends a customized trap with all of the necessary data.  See https://supportforums.cisco.com/docs/DOC-11745 for details on how to create customized traps using EEM.  Essentially, you will create an EEM applet (or Tcl) policy that intercepts the required IP SLA reaction condition, then runs the necessary show commands to extract the parameters you need to generate the trap you want.  This one policy could be defined outside of IPM, but it could be used for all collectors on the device.

Similar Messages

  • SolMan and SNMP traps?

    Hi experts,
    I'm searching some information about the possebilities with SolMan and SNMP traps.
    I know that it is possible to send SNMP traps from SolMan to e.g. an external monitoring tool, to send alert information (CCMS/RZ20) to this monitoring tool.
    But is it possibel to recieve SNMP traps in SolMan and e.g. create Service Desk tickets out of them?
    Thanks
    Thomas

    Thomas,
                 Can you please share your experience about sending SNMP traps to solution manager? I am trying to find information on how to configure Solution Manager for receiving the SNMP traps. Please guide me on this.
    Thanks
    DG

  • 3750 Cluster and SNMP traps

    I have a 3750 cluster and I want to know what are the recommended snmp traps to be sent.  We definitely want to know when one of the switches in the cluster fails.
    I've read about snmp-server enable traps stackwise and snmp-server enable traps cluster.    What do these traps actually do?

    stackwise would be useful, here's a description:
    http://tools.cisco.com/Support/SNMP/do/BrowseOID.do?objectInput=ciscoStackWiseMIB&translate=Translate&submitValue=SUBMIT
    also have a look at:
    http://www.cisco.com/en/US/docs/switches/lan/catalyst4500/12.1/13ew/command/reference/S1.html#wp1126420

  • SF300/SG300 and SNMP Traps

    Hello,
    as mentioned in the documentation, the SF300/SG300 series switches are capable of sending SNMP-Traps.
    What kind of SNMP traps are they sending? I need "Link Up / Link Down" Traps. Do the switches send such traps or is it possible to configure these switches to send them?
    Thanks a lot,
    Marco

    Hi,
    Here is a link to the Data Sheet on the 300's:
    http://www.cisco.com/en/US/prod/collateral/switches/ps5718/ps10898/data_sheet_c78-610061.html
    It states that SNMP versions 1, 2c, and 3 with support for traps, and SNMP version 3 user-based security model (USM)
    So you should be able to configure "Link Up / Link Down" Traps. See chapter 19 Configuring SNMP:
    http://www.cisco.com/en/US/docs/switches/lan/csbms/sf30x_sg30x/administration_guide/78-19308-01.pdf
    Thanks,
    Nick

  • ACE and ANM, Syslog and SNMP Traps

    Hi guys.. another ACE/ANM question.
    I configured the ACE devices to send Syslog and SNMP messages to the ANM server. But i got a couple of questions:
    Whats the difference between using the:
    logging history 4 (this would send logging messages as SNMP traps according to doc)
    And:
    snmp-server host x.x.x.x traps version 2c public
    snmp-server trap-source vlan 1000
    This of course I think should do the same..
    The funny and weird thing, in the ANM Event viewer, I can only see syslog messages, not one snmp event.
    Thanks!
    Omar
    PS: ACE ver A2.4
          ANM Ver 4.2

    Hi Omar,
    Let's see if I can clarify your questions.
    As you mentioned, the "logging history 4" command specifies that, syslog messages of severity 4 and higher will be sent as SNMP traps. After you configure it, you need the "snmp-server host x.x.x.x traps version 2c public" command to specify what will be the destination IP and SNMP community for these traps.
    It would only make sense to use the "logging history 4" command if your monitoring application doesn't support receiving syslog messages. However, since ANM is able to get syslog messages from the ACE without issues, I would just configure a destination for syslog message instead (with "logging host x.x.x.x")
    I hope this makes this point more clear.
    Now, moving on to why you are not seeing any SNMP traps in your ANM, the first things you would need to check are:
    -- Did you enable traps? You would use the "ACE(config)# snmp-server enable traps" command for this
    -- Are traps being sent? You can use the "show snmp" command and check if the "Trap PDUs" counter increases
    -- Is ANM getting these traps? This is the most complicated step. For this, I would recommend getting a traffic capture on the ANM server (if it's installed on linux) or as close as possible to it if it's a ANM appliance
    I hope this helps
    Daniel

  • SM21 and SNMP-traps?

    Hello!
    We have some troube with forklifter terminals that often lose connection to SAP. In SM21 I see the entry "lost connection to user xy". Is there a way to send out an SNMP trap when this error occurs? I could then use a tool like PRTG to create statistics over a longer timeframe.
    kind regards, Peter

    Thomas,
                 Can you please share your experience about sending SNMP traps to solution manager? I am trying to find information on how to configure Solution Manager for receiving the SNMP traps. Please guide me on this.
    Thanks
    DG

  • Grid Control Scripts and SNMP Traps

    Hi guys,
    Does anyone knows here where i could find some good Grid Control Scripts for monitoring purposes?
    Thanks!

    The database monitoring is done by GC (thats a reason why GC is used) and you can create a SMS if something is wrong with the DB.
    If you create backups using RMAN a lot of backup info can be found in the repository. So you can create a User Defined Metric checking for instance if the last backup date is before sysdate -1. If yes you will see a warning/alert.
    Eric

  • LMS 3.2.1 integration with Clarity NMS for snmp trap forwarding

    Our client have integrated Clarity NMS to Ciscoworks LMS 3.2.1. So far they are receiving raw alarms/snmp traps but it lacks information/inventory of the originating device. Kindly see sample raw alarms below:
    2420: 2011-11-25 12:10:46 Received trap ==> Received SNMPv1 Trap
    Community=ciscoworks
    Enterprise=1.3.6.1.6.3.1.1.5
    Generip trap type=2
    Specific Trap Type=0
    Trap From=10.220.10.1
    Trap ID=1.3.6.1.6.3.1.1.5.2
    Trap Time=-1436283373
    1.3.6.1.2.1.2.2.1.1.83=83
    1.3.6.1.2.1.2.2.1.2.83=GigabitEthernet1/40
    1.3.6.1.2.1.2.2.1.3.83=6
    1.3.6.1.4.1.9.2.2.1.1.20.83=Lost Carrier
    EndTrap
    10933: 2011-11-24 11:57:53 Received trap ==> Received SNMPv1 Trap
    Community=ciscoworks
    Enterprise=1.3.6.1.4.1.9.1.291
    Generip trap type=2
    Specific Trap Type=0
    Trap From=10.220.10.1
    Trap ID=1.3.6.1.4.1.9.1.291.2
    Trap Time=1628056965
    1.3.6.1.2.1.2.2.1.1.8=8
    1.3.6.1.2.1.2.2.1.2.8=E1 0/0/0
    1.3.6.1.2.1.2.2.1.3.8=18
    EndTrap
    As you can see, those raw alarms doesn’t contain any information about the originating equipment or the physical card, port related information where those alarms were generated. Instead those alarms received are just NMS level alarms.
    How do we resolve this so that the inventory of the equipment would be part of the trap to be received by Clarity from Ciscoworks.

    Hi,
    Is the issue you have the source IP address of the forwarded trap?  Per RFC it is the IP of the actual device sending the trap.  The originating IP should be contained within the packet. I have included some additional information you may find helpful.
    Q. What is the difference between SNMP Raw Trap Forwarding and SNMP Trap alert/event Trap Forwarding? Does DFM support both?
    A. You can configure raw trap forwarding at DFM > Other configuration > SNMP Trap forwarding, and processed event/alert trap forwarding at DFM > Notification Services > SNMP Trap Forwarding. Processed trap is "when DFM receives certain SNMP traps, it analyzes the data found in fields (Enterprise/Generic trap identifier/Specific Trap identifier/variable−bindings) of each SNMP trap message, and changes the property value of the object property (if required)". Raw trap is the trap that the device forwards to DFM and DFM has yet to process it. For more information, refer to the DFM User Guide. Yes, DFM supports both ways of trap forwarding.
    http://www.cisco.com/en/US/products/sw/cscowork/ps2421/products_qanda_item09186a0080a9b35b.shtml
    DFM will only forward SNMP traps from devices in the DFM inventory. It will not change the trap format—it will forward the raw trap in the format in which the trap was received from the device. However, you must enable SNMP on your devices and you must do one of the following:
    Configure SNMP to send traps directly to DFM
    Integrate SNMP trap receiving with an NMS or a trap daemon
    The versions of SNMP traps supported by DFM are described in SNMP and ICMP Polling. For information on forwarding processed and pass-through traps, see Processed and Pass-Through Traps, and Unidentified Traps and Events.
    Pass-through traps are traps that DFM receives from devices that are not in the DFM inventory, and DFM has not processed. Forwarding these traps is controlled using Configuration > Other Configurations > SNMP Trap Forwarding. These traps are shown in the Alerts and Activities display because of their relevance to fault monitoring. Pass-through traps are displayed as follows:
    As one of the following events:
    > InformAlarm
    > MinorAlarm
    > MajorAlarm
    With the device type and the device name from which it was generated.
    If DFM does not know which device generated the trap, it ignores the trap. Pass-through traps will be cleared after a default interval of 10 minutes to one hour
    http://www.cisco.com/en/US/docs/net_mgmt/ciscoworks_device_fault_manager/3.2/user/guide/dfm32ug_Book.html

  • Sending as SNMP trap

    Hello expert,
    Currently my SolMan system serve as central ccms monitoring, some of the alerts are sending email alert as auto reaction method.
    But recently there is request to send the alert to 3rd party non SAP monitoring tool. I am thinking of SNMP traps. but question is each MTE can only have 1 auto reaction method, if i change it to use SNMP traps, so my exisitng email alert is not able to working parallel?
    please advise.
    thank you
    kelly

    Dear Kelly,
    You may find the following document useful when using CCMS and SNMP Traps.
    > https://websmp109.sap-ag.de/~form/sapnet?_FRAME=CONTAINER&_OBJECT=011000358700001606922004E
    Regards,
    Paul

  • Snmp trap versus syslog message

    Hi,
    Most network devices will send snmp traps and syslog messages to a central server.
    For analyzing purpose this server runs software to display the messages or traps.
    My question is, what is the difference between syslog messages and snmp traps?
    What is best practise?
    Thank you very much.
    Hansruedi

    From the very basic level, traps and syslog differ in the encoding.  Syslog messages are typically text messages sent within a UDP packet.  There is a bit of binary encoding to indicate the syslog facility and severity.  SNMP traps have encoded ASN.1 fields (called variable bindings).  These varbinds are not ASCII text like syslog messages.  Instead they are encoded object identifiers that can be translated into object names using MIB definitions.
    More syslog messages exist than SNMP traps because syslog messages do not have as much governance associated with them.  However, we typically recommend that customers enable both as there are some details available in traps that you may not get in syslog messages.  Traps can also be processed in a more programmatic fashion because of the documentation that goes into the MIBs that define them.

  • TimesTen SNMP traps

    Hello,
    I have TT over Windows 32 bit (stand alone).
    I'm trying to configure SNMP traps in order to maintain Alerts for the TimesTen database.
    I've followed the doc *"Oracle Times Ten In-Memory Database Error Messages and SNMP Traps"*,
    and comfigured the snmp.ini file.
    However, when I'm trying to use the utility snmptrapd.exe in order to start listening to the snmp traps and doing my tests, I'm getting an error: snmptrapd.exe is not a valid Win32 application, and in the CMD window I also see *"Access is denied"* error.
    My user in the Administrators group.
    Why do I receive the error and how can I overcome it ?
    Thanks in advance,
    Roni.

    Hi Roni,
    Getting this executable working independently of TimesTen is the first thing to look at.
    - Where did you get the snmptrapd.exe executable from?
    - Make sure that you get this executable from a known reputable source.
    There are viruses out there that use this name.
    - The MKS version of this utility is supported on Windows 2000, Windows XP, Windows Server 2003 and Vista.
    - Make sure that you have the correct version of the executable for your Windows platform.
    Doug

  • Syslog traps vs SNMP traps

    Concerning the Syslog logging and SNMP traps, what is the difference.
    I have seen that syslog is more for troubleshooting, but does syslog, when set to log "debugging", offer the same level of information that SNMP traps do?
    For example, can you get real time config changes via syslog as you can with SNMP?
    If so, why use both?

    syslog will send whatever you can see on the CLI of the device at a maximum of a debug level as you say.
    for SNMP traps related to configuration changes, you can use the mibs depending on the events you want to know about.
    If we take for example the config traps, they are part of
    CISCO-CONFIG-MAN-MIB. That mib can send traps with the following OIDs:
    ftp://ftp.cisco.com/pub/mibs/oid/CISCO-CONFIG-MAN-MIB.oid
    When you will go through that you will realize that the CONFIG mib and the syslog provide you with the same information: the CONFIG mib will not have more information than the syslog message.
    If you use the snmp object navigator, you will find for every OID what the function is:
    http://tools.cisco.com/Support/SNMP/do/BrowseOID.do?local=en
    A good paper about what traps are part of which mib:
    http://www.cisco.com/en/US/tech/tk648/tk362/technologies_tech_note09186a0080094a05.shtml
    SNMP traps are a good way to gather information from the router without spiking the cpu with turning on CLI debug level. The CLI debug level is usually the most complete information you can get from a router anyways.

  • Syslog & SNMP Traps:- Does LMS 3.1 need to receive both?

    Do my switches need to send both syslog and SNMP traps to LMS 3.1 or should I configure for either syslog or SNMP Traps, but not both?
    Thanks
    James

    Well "needs to", no
    Syslog
    RME configuration management works better if it can detect config changes via syslog.
    The syslog reports depend on it, so do the "automated actions" since they are based on syslog messages
    Traps
    Fault management can interpret a few traps but does most of its detecting via snmp get.
    LMS will work without it but I think it is worthwhile to configure the devices to send traps and syslog.
    Cheers,
    Michel

  • SNMP Trap and logical hostname

    Consider a case in which a cluster node has two public network interface in a IPMP group and a logical hostname (ip addr) is also assigned to one of the interfaces.
    If an SNMP trap is generated from this cluster node, what would be the source IP address in the IP header of the trap?
    Is there a way to restrict the source IP addr to one of the interfaces?

    There is only IPMP group so I'm not sure what you mean by active/standby groups. If your question meant to ask whether the interfaces within the group are in active/standby, the answer is no.
    Even if they were active/standby and the trap always travels over the active interface, the question still remains whether the source IP address would be the physical address or the logical address, assuming the logical address is also assigned to the same interface.

  • SNMP TRAPS and SLA

    HI
    I am trying to configure IP SLA to send SNMP TRAPS but looks like doing some mistake ..
    i have following configured
    /* Style Definitions */
    table.MsoNormalTable
    {mso-style-name:"Table Normal";
    mso-tstyle-rowband-size:0;
    mso-tstyle-colband-size:0;
    mso-style-noshow:yes;
    mso-style-parent:"";
    mso-padding-alt:0cm 5.4pt 0cm 5.4pt;
    mso-para-margin:0cm;
    mso-para-margin-bottom:.0001pt;
    mso-pagination:widow-orphan;
    font-size:12.0pt;
    font-family:"Times New Roman";
    mso-ascii-font-family:Cambria;
    mso-ascii-theme-font:minor-latin;
    mso-fareast-font-family:"Times New Roman";
    mso-fareast-theme-font:minor-fareast;
    mso-hansi-font-family:Cambria;
    mso-hansi-theme-font:minor-latin;}
    ip sla monitor 2
    type echo protocol ipIcmpEcho 150.1.3.3 source-ipaddr 1.1.98.7
    frequency 10!
    ip sla monitor schedule 2 start-time now recurring
    /* Style Definitions */
    table.MsoNormalTable
    {mso-style-name:"Table Normal";
    mso-tstyle-rowband-size:0;
    mso-tstyle-colband-size:0;
    mso-style-noshow:yes;
    mso-style-parent:"";
    mso-padding-alt:0cm 5.4pt 0cm 5.4pt;
    mso-para-margin:0cm;
    mso-para-margin-bottom:.0001pt;
    mso-pagination:widow-orphan;
    font-size:12.0pt;
    font-family:"Times New Roman";
    mso-ascii-font-family:Cambria;
    mso-ascii-theme-font:minor-latin;
    mso-fareast-font-family:"Times New Roman";
    mso-fareast-theme-font:minor-fareast;
    mso-hansi-font-family:Cambria;
    mso-hansi-theme-font:minor-latin;}
    ip sla reaction-configuration 2 react rtt threshold-type immediate action-type trapOnly  
    ip sla logging traps
    /* Style Definitions */
    table.MsoNormalTable
    {mso-style-name:"Table Normal";
    mso-tstyle-rowband-size:0;
    mso-tstyle-colband-size:0;
    mso-style-noshow:yes;
    mso-style-parent:"";
    mso-padding-alt:0cm 5.4pt 0cm 5.4pt;
    mso-para-margin:0cm;
    mso-para-margin-bottom:.0001pt;
    mso-pagination:widow-orphan;
    font-size:12.0pt;
    font-family:"Times New Roman";
    mso-ascii-font-family:Cambria;
    mso-ascii-theme-font:minor-latin;
    mso-fareast-font-family:"Times New Roman";
    mso-fareast-theme-font:minor-fareast;
    mso-hansi-font-family:Cambria;
    mso-hansi-theme-font:minor-latin;}
    snmp-server community public RO
    snmp-server enable traps rtr
    snmp-server host 1.1.128.226 public
    1.1.98.7 is the loopback ip on my network. To test the snmp traps, i enabled debug snmp packets and shutdown loopback interface (1.1.98.7)
    I don't see any snmp message in debug output ..
    am i missing something or it is not possible to get traps directly from ip sla .. do i need EEM for this?

    sorry, it actually worked .. i just gave a restart to ip sla and it worked.
    looks like router was already in threshold stage when i was activating reaction-config ..
    but i am still confused which command is actualluy generating these traps since i have taken out some of the snmp config out and i stil get traps ..
    below is the oputput of traps which i get when i restart ip sla .
    *Feb 15 17:10:43.453: SNMP: 150.150.1.1 queue overflow, dropping packet
    *Feb 15 17:10:43.453: SNMP: Queuing packet to 150.150.1.1
    *Feb 15 17:10:43.453: SNMP: V1 Trap, ent rttMonNotificationsPrefix, addr 65.65.2.2, gentrap 6, spectrap 3
    rttMonCtrlAdminTag.1 = 
    rttMonHistoryCollectionAddress.1 = 41 41  03 03   
    rttMonCtrlOperOverThresholdOccurred.1 = 1
    *Feb 15 17:10:43.497: SNMP: 150.150.1.1 queue overflow, dropping packet
    *Feb 15 17:10:43.501: SNMP: Queuing packet to 150.150.1.1
    *Feb 15 17:10:43.501: SNMP: V1 Trap, ent rttMonNotificationsPrefix, addr 65.65.2.2, gentrap 6, spectrap 5
    rttMonCtrlAdminTag.1 = 
    rttMonHistoryCollectionAddress.1 = 41 41  03 03   
    rttMonReactVar.1 = 1
    rttMonReactOccurred.1 = 1
    rttMonReactValue.1 = 12
    rttMonReactThresholdRising.1 = 5
    rttMonReactThresholdFalling.1 = 1
    rttMonEchoAdminLSPSelector.1 = 00 00  00 00  
    *Feb 15 17:10:43.585: SNMP: 150.150.1.1 queue overflow, dropping packet
    *Feb 15 17:10:43.585: SNMP: Queuing packet to 150.150.1.1
    *Feb 15 17:10:43.585: SNMP: V1 Trap, ent rttMonNotificationsPrefix, addr 65.65.2.2, gentrap 6, spectrap 5
    rttMonCtrlAdminTag.1 = 
    rttMonHistoryCollectionAddress.1 = 41 41  03 03   
    rttMonReactVar.1 = 1
    rttMonReactOccurred.1 = 1
    rttMonReactValue.1 = 12
    rttMonReactThresholdRising.1 = 5
    rttMonReactThresholdFalling.1 = 1
    rttMonEchoAdminLSPSelector.1 = 00 00  00 00 
    below is my running config and sh ver
    R2#sh ver
    Cisco IOS Software, 2800 Software (C2800NM-ADVENTERPRISEK9-M), Version 12.4(24)T1, RELEASE SOFTWARE (fc3)
    Technical Support: http://www.cisco.com/techsupport
    Copyright (c) 1986-2009 by Cisco Systems, Inc.
    Compiled Fri 19-Jun-09 15:13 by prod_rel_team
    ROM: System Bootstrap, Version 12.4(1r) [hqluong 1r], RELEASE SOFTWARE (fc1)
    R2 uptime is 8 hours, 9 minutes
    System returned to ROM by power-on
    System image file is "flash:c2800nm-adventerprisek9-mz.124-24.T1.bin"
    This product contains cryptographic features and is subject to United
    States and local country laws governing import, export, transfer and
    use. Delivery of Cisco cryptographic products does not imply
    third-party authority to import, export, distribute or use encryption.
    Importers, exporters, distributors and users are responsible for
    compliance with U.S. and local country laws. By using this product you
    agree to comply with applicable laws and regulations. If you are unable
    to comply with U.S. and local laws, return this product immediately.
    A summary of U.S. laws governing Cisco cryptographic products may be found at:
    http://www.cisco.com/wwl/export/crypto/tool/stqrg.html
    If you require further assistance please contact us by sending email to
    [email protected].
    Cisco 2811 (revision 53.50) with 237568K/24576K bytes of memory.
    Processor board ID FTX0952C333
    2 FastEthernet interfaces
    4 Serial(sync/async) interfaces
    1 Virtual Private Network (VPN) Module
    DRAM configuration is 64 bits wide with parity enabled.
    239K bytes of non-volatile configuration memory.
    62720K bytes of ATA CompactFlash (Read/Write)
    Configuration register is 0x2102
    R2#            
    R2#sh run
    Building configuration...
    Current configuration : 2233 bytes
    version 12.4
    service timestamps debug datetime msec
    service timestamps log datetime msec
    no service password-encryption
    hostname R2
    boot-start-marker
    boot-end-marker
    no aaa new-model
    memory-size iomem 10
    dot11 syslog
    ip source-route
    ip cef
    ipv6 unicast-routing
    ipv6 cef
    multilink bundle-name authenticated
    voice-card 0
    vtp domain 29
    vtp mode transparent
    archive
    log config
      hidekeys
    interface Loopback0
    ip address 65.65.2.2 255.255.255.0
    interface FastEthernet0/0
    shutdown
    duplex auto
    speed auto
    interface FastEthernet0/1
    ip address 65.65.128.193 255.255.255.224
    shutdown
    duplex auto
    speed auto
    interface Serial0/2/0
    ip address 65.65.13.2 255.255.255.224
    encapsulation ppp
    clock rate 2000000
    interface Serial0/3/0
    no ip address
    shutdown
    router ospf 65
    router-id 65.65.2.2
    log-adjacency-changes
    network 65.65.2.2 0.0.0.0 area 1
    network 65.65.13.2 0.0.0.0 area 1
    network 65.65.128.193 0.0.0.0 area 1
    ip forward-protocol nd
    no ip http server
    no ip http secure-server
    ip sla 1
    icmp-echo 65.65.3.3 source-ip 65.65.2.2
    request-data-size 1500
    frequency 10
    ip sla schedule 1 life forever start-time now
    ip sla reaction-configuration 1 react rtt threshold-value 5 1 threshold-type immediate action-type trapOnly
    snmp-server community public RO
    snmp-server host 150.150.1.1 public
    control-plane
    mgcp fax t38 ecm
    mgcp behavior g729-variants static-pt
    line con 0
    line aux 0
    line vty 0 4
    login
    scheduler allocate 20000 1000
    end
    R2#                                 
    R2#

Maybe you are looking for