LMS 3.2 not forwarding SNMP Traps

I am using LMS 3.2 and under DFM... Notification Services... SNMP Trap Notification, I have a Subscription set up to forward Traps to Unicenter 11.1.  I have tried a combination of sending Alerts and Events, Critical and Informational, Active and Cleared messages.
At this time I have it set to send:
Alerts Informational and Cleared
Events Critical and Informational, Active and Cleared.
Every Trap that is forwarded from LMS I get in the Unicenter console Twice.   Also, I occasionally get a clear in Unicenter, but normally clears are not being forwaded.
Any ideas on this issue?
Thanks
-Scott

You should first install the consolidated DFM 3.2 patch from http://tools.cisco.com/support/downloads/go/ImageList.x?relVer=3.2.0&mdfid=282640771&sftType=CiscoWorks+Device+Fault+Manager+Patches&optPlat=Windows&nodecount=2&edesignator=null&modelName=CiscoWorks+Device+Fault+Manager+3.2&treeMdfId=268439477&treeName=Network+Management&modifmdfid=&imname=&hybrid=Y&imst=N&lr=Y (patch for CSCta56151).  If the problem persists after that, post the NMSROOT/log/dfmLogs/NOS/nos.log after reproducing the problem with a new event/alert.

Similar Messages

  • Cisco WLC 5508 not sending SNMP Traps

    Hello Everyone.
    I'm having a weird error on our WLC environment. We have an HA with two cisco WLC 5508 and i cannot get SNMP Traps working on a Windows PC running Kiwi Syslog server (free ed.).
    I can receive correctly Syslog messages, but not traps.
    I Tried also to send SNMP Traps from WLC to a different PC using Linux with snmptrapd and it works fine.
    I tried then to send from my Linux box a snmp trap to my Windows PC, and it works fine, but i still cannot receive anything from WLC.
    Using Wireshark to detect traffic, i cannot see any packet on udp port 162.
    I cannot figure out any problem with my scenario, but i can see the following errors on syslog:
    *rmgrTrasport: Mar 30 16:08:22.602: #RMGR-3-INVALID_PING_RESPONSE: rmgr_utils.c:270 Ping response from <my_windows_PC> is invalid. Ip address do not match.
    My WLC Version is 7.6.130.0
    Thank you for your support.

    I have gone through your query and found the following fruitful links ,please let me know if it helps and mark it correct answer if it is.
    https://www.manageengine.com/network-monitoring/help/userguide/processing_traps.html
    https://rscciew.wordpress.com/2014/10/12/snmp-configuration-on-wlc/
    Thanks :)

  • LMS 3.2.1 integration with Clarity NMS for snmp trap forwarding

    Our client have integrated Clarity NMS to Ciscoworks LMS 3.2.1. So far they are receiving raw alarms/snmp traps but it lacks information/inventory of the originating device. Kindly see sample raw alarms below:
    2420: 2011-11-25 12:10:46 Received trap ==> Received SNMPv1 Trap
    Community=ciscoworks
    Enterprise=1.3.6.1.6.3.1.1.5
    Generip trap type=2
    Specific Trap Type=0
    Trap From=10.220.10.1
    Trap ID=1.3.6.1.6.3.1.1.5.2
    Trap Time=-1436283373
    1.3.6.1.2.1.2.2.1.1.83=83
    1.3.6.1.2.1.2.2.1.2.83=GigabitEthernet1/40
    1.3.6.1.2.1.2.2.1.3.83=6
    1.3.6.1.4.1.9.2.2.1.1.20.83=Lost Carrier
    EndTrap
    10933: 2011-11-24 11:57:53 Received trap ==> Received SNMPv1 Trap
    Community=ciscoworks
    Enterprise=1.3.6.1.4.1.9.1.291
    Generip trap type=2
    Specific Trap Type=0
    Trap From=10.220.10.1
    Trap ID=1.3.6.1.4.1.9.1.291.2
    Trap Time=1628056965
    1.3.6.1.2.1.2.2.1.1.8=8
    1.3.6.1.2.1.2.2.1.2.8=E1 0/0/0
    1.3.6.1.2.1.2.2.1.3.8=18
    EndTrap
    As you can see, those raw alarms doesn’t contain any information about the originating equipment or the physical card, port related information where those alarms were generated. Instead those alarms received are just NMS level alarms.
    How do we resolve this so that the inventory of the equipment would be part of the trap to be received by Clarity from Ciscoworks.

    Hi,
    Is the issue you have the source IP address of the forwarded trap?  Per RFC it is the IP of the actual device sending the trap.  The originating IP should be contained within the packet. I have included some additional information you may find helpful.
    Q. What is the difference between SNMP Raw Trap Forwarding and SNMP Trap alert/event Trap Forwarding? Does DFM support both?
    A. You can configure raw trap forwarding at DFM > Other configuration > SNMP Trap forwarding, and processed event/alert trap forwarding at DFM > Notification Services > SNMP Trap Forwarding. Processed trap is "when DFM receives certain SNMP traps, it analyzes the data found in fields (Enterprise/Generic trap identifier/Specific Trap identifier/variable−bindings) of each SNMP trap message, and changes the property value of the object property (if required)". Raw trap is the trap that the device forwards to DFM and DFM has yet to process it. For more information, refer to the DFM User Guide. Yes, DFM supports both ways of trap forwarding.
    http://www.cisco.com/en/US/products/sw/cscowork/ps2421/products_qanda_item09186a0080a9b35b.shtml
    DFM will only forward SNMP traps from devices in the DFM inventory. It will not change the trap format—it will forward the raw trap in the format in which the trap was received from the device. However, you must enable SNMP on your devices and you must do one of the following:
    Configure SNMP to send traps directly to DFM
    Integrate SNMP trap receiving with an NMS or a trap daemon
    The versions of SNMP traps supported by DFM are described in SNMP and ICMP Polling. For information on forwarding processed and pass-through traps, see Processed and Pass-Through Traps, and Unidentified Traps and Events.
    Pass-through traps are traps that DFM receives from devices that are not in the DFM inventory, and DFM has not processed. Forwarding these traps is controlled using Configuration > Other Configurations > SNMP Trap Forwarding. These traps are shown in the Alerts and Activities display because of their relevance to fault monitoring. Pass-through traps are displayed as follows:
    As one of the following events:
    > InformAlarm
    > MinorAlarm
    > MajorAlarm
    With the device type and the device name from which it was generated.
    If DFM does not know which device generated the trap, it ignores the trap. Pass-through traps will be cleared after a default interval of 10 minutes to one hour
    http://www.cisco.com/en/US/docs/net_mgmt/ciscoworks_device_fault_manager/3.2/user/guide/dfm32ug_Book.html

  • LMS 3.2 snmp trap forwardig to HP-open view

    Hi,
    I want to forward snmp traps from cisco LMS to HP-open view. Both applications are installed on different servers.
    From previous post in this forum, I found a similar post that recommand using snmp forwording in DFM.
    What I want to know is do I need any integration or packages to install on both platforms to do this? Also, will DFM forward all traps that it receives from installed devices or it will forward some of them.
    Thank you
    BR,
    ZS

    Chris;
       current version of Java is 1.6.0 Update 20
    Additional information to the issue:  a WS-C3750 has been discovered (connected to another 6509 that is running hybrid) and added to the topology map as it one would expect.
    craig

  • SNMP traps from HP NNMi - SCOM

    Hi,
    We wan't to forward snmp traps from hp nnmi to scom.
    I have found a description of a solution for this here: http://social.technet.microsoft.com/Forums/systemcenter/en-US/19c29988-dfe8-4918-b0d5-f3124bcfea95/operations-manager-and-hewlett-packard-nnmi?forum=operationsmanagergeneral
    I have added a server as snmp device. By using snmptrapgen I have also confirmed that the traps are received from scom.
    In NNM I have specified that all traps are to be forwarded to the server which is discovered as a network device. I have also activated the snmp services and set the correct settings. These traps have not been received in scom.
    Have I understood this correctly? If NNMi just forwards the traps, will not the traps have source IPs which is not registered as network devices in SCOM, and therefor be discarded? 
    I would very much like to hear from people how have done a simular type of integration :)
    Thanks in advance, Best Regards

    Yes, I think the Network Devices need to be discovered first in order to receive traps and generate alerts.
    Juke Chou
    TechNet Community Support

  • No SNMP traps from sun x4150 ILOM server

    Hi all,
    I have set up the ILOM alerts with SNMP traps (v2c,public) according to the ILOM user guide and pressed the "send test alerts". Nothing shows up in the SNMP trap monitor (using MG-SOFT software). When I add another alert of IPMI pet type (same destination ip as of SNMP trap alert) I see events in the trap monitor. It looks like the ILOM does not generate SNMP traps but only IPMI traps.
    In the ILOM user guide there is an explicit example of traps sent from the ILOM (in addition to the fact that the ILOM features include SNMP traps AS WELL as IPMI) so it seems this is possible...
    my ILOM version is
    SP Firmware Version     2.0.2.6
    Does anyone have any idea of any step I have missed ?
    Thanks in advance.
    Lior

    Once the Network Device (Linux server in this case) is discovered you will still need a rule that targets that class and accepts incoming SNMP Traps for that OID, or All OIDs if you prefer.  I found 2 links that may be of help, the first is just a basic
    overview of the SNMP listener in SCOM 2012 as it has changed from the OS Listener in 2007 to a dedicated one.
    http://systemcentertech.com/2012/05/17/scom-2012-built-in-snmp-trap-listener/
    The second link covers SNMP setup, but starting at Step 7 there is a great how-to on creating your own SNMP rule which will be needed to collect your traps.
    http://scom-2012.blogspot.com/2012/07/setting-up-snmp-monitoring-in-scom-2012.html
    www.Practice2Perfect.com

  • SNMP Traps by Nexus 5010

    I (my customer) does not get SNMP Traps from the N5k when he unplugs one power supply (only logs). He gets only traps when he turns both power supplies off. If I check show snmp trap all trap entity are enabled (rmon Trap are off). NX-OS is 4.2(1)N2(1).
    How he will get traps if one power supplies is off or fails?

    Hi
    Thanks for your support.
    First I like to mention that the issue is when an Nexus2k behind the 5k (FEX) looses the power on one power-supply.
    The trap I get if both power supplies are disconected is:
    "Power Status Change Event.
    The power operational status of a FRAU at entPhysicalTable index has changed to offEnvPower.
    Power Admin Status: . "
    4 seconds later I get than also the FRU Removal Event.
    like mentioned eralier we also would like to get snmp traps when only one power supply goes down, but can't not figure out the config for that.
    K.R.
    Markus

  • Configuring SNMP Trap receiver on AIP-SSM sensor

    I receive the following error message from my ASA5520 firewall when attempting to forward SNMP traps from my AIP-SSM20 sensor to a server on my Inside interface that is configured to receive SNMP traps:
    ASA-4-418001: Through-the-device packet to/from management-only network is denied: udp src management: 10.3.21.2/32768 dst Inside: PPC0ES/162
    Can I reconfigure the management IP address of the AIP-SSM sensor to connect to the Inside interface instead of the management vlan or does my SNMP server have to reside on the management vlan with the sensor?

    Hi Subodh,
    Yes, the AIP-SSM can operate in either inline (IPS) or promiscuous (IDS) mode. I would recommend you start by reviewing the following config guide, which shows you how to configure the ASA to pass traffic to the SSM for inspection:
    http://www.cisco.com/en/US/products/ps6120/products_configuration_example09186a00807335ca.shtml
    If you have any other specific questions, feel free to post back.
    Hope that helps.
    -Mike

  • EBGP PEER FLAP SNMP TRAP

    Hi
    Whenever there is a bgp neighbour flap, we are not getting snmp traps on the HP NNMI Server.. I believe during the neighbour flap, the device is unable to communicate with NNMI and drop the trap..
    So I would like to write a custom EEM SCRIPT that can match a syslog pattern and generate a customised SNMP trap and send it to NNMI. May be I can delay the trap generation or sending so that the device restores the connectivity and then send an alert
    Here are my questions:
    Is this a good idea?
    Can you give me a sample configuration with the MIB Values to be generated?
    What MIB Should be loaded on the server?
    I am curious how others are monitoring this kind of bgp flaps...
    Sent from Cisco Technical Support iPad App

    After i enabled snmp inform using following command
    snmp-server host 100.190.19.33 informs version 2c XXXX
    I see it is contineously incrementing snmp inform sent messages on the router..I am not sure what it is sending..I would like to be specific like sending only BGP snmp informs to the NMS..is it possible ?
    DR1#show snmp
    Chassis: FHK0850F0HL
    4338622 SNMP packets input
        0 Bad SNMP version errors
        746076 Unknown community name
        0 Illegal operation for community name supplied
        0 Encoding errors
        35020739 Number of requested variables
        0 Number of altered variables
        3303916 Get-request PDUs
        97632 Get-next PDUs
        0 Set-request PDUs
        0 Input queue packet drops (Maximum queue size 1000)
    6639622 SNMP packets output
        0 Too big errors (Maximum packet size 1500)
        546341 No such name errors
        0 Bad values errors
        0 General errors
        3592535 Response PDUs
        3047076 Trap PDUs
    SNMP Dispatcher:
       queue 0/75 (current/max), 0 dropped
    SNMP Engine:
       queue 0/1000 (current/max), 0 dropped
    SNMP logging: enabled
        Logging to 10.45.224.19.162, 0/10, 761350 sent, 347 dropped.
        Logging to 10.48.176.1.162, 0/10, 759955 sent, 1886 dropped.
        Logging to 100.190.19.25.162, 0/10, 761329 sent, 368 dropped.
        Logging to 100.190.19.33.162, 0/10, 761367 sent, 474 dropped.
    SNMP Manager-role output packets
        0 Get-request PDUs
        0 Get-next PDUs
        0 Get-bulk PDUs
        0 Set-request PDUs
        11 Inform-request PDUs
        0 Timeouts
        0 Drops
    SNMP Manager-role input packets
        0 Inform request PDUs
        0 Trap PDUs
        11 Response PDUs
        0 Responses with errors
    SNMP informs: enabled
        Informs in flight 0/25 (current/max)
        Logging to 100.190.19.33.162
            11 sent, 0 in-flight, 0 retries, 0 failed, 0 dropped

  • LMS 4.0 SNMP Traps Forwarding

    Hello,
    I have installed a new version of CiscoWorks LMS 4.0.
    I would like to forward certain SNMP traps to another server. Not all traps but only the traps of devices which are down.
    Is it possible to filter the traps and then forward the traps who match the filter to a server?
    Thanks,
    Best Regards,
    Joris

    If you enable trap forwarding in LMS, all traps received by LMS will be forwarded to the external NMS.
    You can, however, look at NMSROOT/objects/smarts/conf/trapd/trapd.conf.  You can modify this file to specify exactly what traps to forward.  The comments in the file should help you figure out the syntax.  However, direct modification of this file is not supported by TAC, so be sure to save a backup just in case.

  • CiscoWorks LMS: not receveing certain SNMP traps

    CiscoWorks LMS 4.0.1 (I know it's old and unsupported).
    Problem: not receiving certain SNMP traps.
    For example: I receive trap like "STP new root" but not like "port put to err-disabled" or my custom traps (produced by EEM scripts).
    I've investigated my situation and found out that switch sends traps and they reach* LMS but somehow LMS ignores them (there's no trace of them in GUI). I've read that some traps just pass through LMS but my traps are very important and I need to know about them.
    * I did Wireshark capture on LMS machine.
    I'd like to know how to debug receiving of SNMP traps in LMS:
    which specific debugs need to be enabled,
    which specific log files need to be examined.

    LMS uses DFM to process certain traps.
    All traps it deems unimportant are dropped.
    If you want to use the LMS GUI you can have you device send a SYSLOG message rather than a trap.
    use logging source command to make the management interface send the message.
    Then there is a GUI that allows you to launch an action on a message
    Cheers,
    Michel

  • Added a Northbound SNMP Trap Receiver in Cisco PI 1.3, but not getting traps

    Hi;
    I tried going into the Administration, System Settings, Notification Receivers menu and adding a receiver. The receiver was our  Zenoss 4.2.3 Resource Manager system. Zenoss has no problems  receiving traps from  IOS devices such as switches; that is routine for us. For example, we  see snmpTrap_Linkdown events from 2960s,etc.
    However, even with all the possible events and severities checked in the PI GUI for the receiver, we did not get anything.
    As a quick test I added my desktop computer as a receiver and ran Wireshark. Nothing comes through from Cisco PI. 
    This is supposed to be UDP 162 stuff, so there ought not be a need for a handshake or need  to permit anything on the receiver side. I would expect to  see a total  fire-hose of traps after the receiver is added. But that reasoning conflicts with the need to set the SNMP Community string for the Notification Receiver...
    I downloaded the logs from Cisco PI and grepped through all of them for the IPs & names of the test receivers, but found no messages.
    Any idea what might be wrong? Do I need to restart something after adding the receiver?
    I did notice that even if I supply a ficticious IP and name for the receiver, after it is added the "Operational Status" still says "Up" ...
    I sure wish NCS came with a better help system - I can't find anything in the Cisco config guides that explains what a "Northbound" receiver is.
    So confused,
    Steve

    Hi Matt, thanks for taking the time to reply.
    >> Not sure why you are trying to do this with PI, this is really more of an ISE function
    We don't have ISE and won't be getting it ... still trying to afford the > $100K for PI licenses. Our Content Filter vendor suggested using PI.
    >>Is PI set to forward traps for client authentication?
    I have all traps and severities checked. Not sure last week nothing showed up in Wireshark. Today I am seeing some UDP info from PI hitting my test workstation. However, when I associate and dissassociate my laptop, nothing comes through. Most of what I see are rogue notifications.
    >> Are the controllers that PI is managing also set to forward the same traps?
    In Configure,Controllers, , Management, TrapControl, all possible boxes are checked.
    >> Is PI configured correctly to forward the traps you want?
    Please see answer above.
    >> Does your content filter have the right MIBs to decipher the traps correctly?
    The content filter vendor says they will customize their software as needed, but the first step is to see traps getting forwarded, and right now, it appeards that PI is not forwarding what I would expect from the GUI settings. Let's worry about MIB stuff after we are getting the raw trap data.
    Thanks,
    Steve
    Message was edited by: Stephen Crye, elaborated & provided latest info.

  • Syslog & SNMP Traps:- Does LMS 3.1 need to receive both?

    Do my switches need to send both syslog and SNMP traps to LMS 3.1 or should I configure for either syslog or SNMP Traps, but not both?
    Thanks
    James

    Well "needs to", no
    Syslog
    RME configuration management works better if it can detect config changes via syslog.
    The syslog reports depend on it, so do the "automated actions" since they are based on syslog messages
    Traps
    Fault management can interpret a few traps but does most of its detecting via snmp get.
    LMS will work without it but I think it is worthwhile to configure the devices to send traps and syslog.
    Cheers,
    Michel

  • Cisco Prime Infrastructure 1.4 SNMP Traps are not converted into Alarms

    Hi everybody,
    I just configured SNMP Traps on a Cisco Catalyst 3750-x to send to our Cisco Prime Infrastructure 1.4 Appliance.
    Now I forced the Switch to send some traps (Power off a Power Supply, Interface errdisable). The only events I see in Alarms & Events on PI is the same information message everytime:
    Configuration management event has been recorded in ccmHistoryEventTable.
    I think the forced traps should be converted into alarms? Why can't I see them?
    Thanks,
    Marc

    Ok, I started debugging as you said. I get the following output:
    Mar 13 09:28:13.711: SNMP: V2 Trap, reqid 11689, errstat 0, erridx 0
     sysUpTime.0 = 198609846
     snmpTrapOID.0 = ciscoSyslogMIB.2.0.1
     clogHistoryEntry.2.1688 = PM
     clogHistoryEntry.3.1688 = 5
     clogHistoryEntry.4.1688 = ERR_RECOVER
     clogHistoryEntry.5.1688 = Attempting to recover from bpduguard err-disable state on Gi1/0/13
     clogHistoryEntry.6.1688 = 198609844
    Mar 13 09:28:13.737: SNMP: Queuing packet to xx.xx.xx.xx
    Looks like the Switch is sending SNMP Traps from the ciscoSyslogMIB. Is this why PI can't show the Traps and convert it into a alarm?
    After this test I configured logging (syslog) to the PI. Now the errors are showed but still not converted into alarms. I just want to be notified by email when such errors occurs.
    Thanks,
    Marc

  • I can not make IP SLA to signal SNMP traps upon timeout

    Hello team.
    I want SNMP traps to be sent every time an IP SLA (ICMP) object times out. For that purpose, I carried out the following
    ip sla monitor logging traps
    ip sla monitor 1
    type echo protocol ipIcmpEcho 10.1.1.254
    timeout 1000
    frequency 15
    ip sla monitor schedule 1 life forever start-time now
    snmp-server enable traps rtr
    snmp-server host 10.1.1.10 mycommunity
    But no SNMP trap is sent when the IP SLA object times out. ¿ Am I missing something?
    Any help will be greatly appreciated.
    Rogelio Alvez
    Argentina

    SNMP traps for IP SLAs are handled through the system logging (syslog) process. This means that system logging messages for IP SLAs violations are generated when the specified conditions are met, then sent as SNMP traps using the CISCO-SYSLOG-MIB. The ip sla monitor logging traps command is used to enable the generation of these IP SLAs specific traps. The generation of IP SLAs specific logging messages is dependant on the configuration of the standard set of logging commands (for example, logging on). IP SLAs logging messages are generated at the "informational" system logging severity level.
    The command ip sla monitor logging traps is sometime hidden and may not show with ?, so just copy and paste in global config mode and have logging on and check if any traps are generated.
    -Thanks
    Vinod
    **Encourage Contributors. RATE them**

Maybe you are looking for