LMS 4.2.1 - unidentified traps in fault monitor

MY LMS, under fault monitor, shows many messages (actually hundreds), "Unidentified Trap Generic Trap:6 Specific Target:1 EnterpriseOid:.1.3.6.1.4.1.9.9.41.2"
This OID leads me down the CISCO-SYSLOG-MIB.my, to ciscoSyslogMIBNotification.
vestigaiton looks like this MIB actually doesn't do anything (other than generate a fault message on LMS).
Anyone have any ideas how I can get rid of this fault in LMS, such as adding the CISCO-SYSLOG-MIB.my to my LMS so that it can at least identify the OID being sent.
Along these lines, I have downloaded the above referenced MIB, and have tried in LMS to upload it, but the "upload MIB" functionality ONLY allows the loading of MIBS which already exist on LMS (only choose a server side path).
Any ideas would be aprpeciated.
Joe

Hi Joe,
check the below link for more results on Unidentified traps:
http://www.cisco.com/en/US/docs/net_mgmt/ciscoworks_device_fault_manager/3.1
/user/guide/TrapFwd.html#wpxref57860
It looks like "snmp-server enable traps syslog" is enabled on your devices, and this will appears as Unidentified trap , you can stop this by change the configuration on the Device , or disable the "InformAlarm" from the notification Group under : Admin > Network > Notification and Action Settings > Fault Notification Group From the following Link you can check the traps that will generate "INFORM ALARM" event :
I hope this will help
Thanks-
Afroz

Similar Messages

LMS 4.2.3 Unidentified Trap Generic Trap:6 Specific Trap:1 EnterpriseOid:.1.3.6.1.4.1.9.9.41.2

Hi All,
We are seeing unidentified traps continuously on the LMS 4.2.3.
Unidentified Trap Generic Trap:6 Specific Trap:1 EnterpriseOid:.1.3.6.1.4.1.9.9.41.2
What are these traps and how to avoid the same. as these traps are coming from all the devices in the network.
Regards,
Channa

Hello Channa,
the 'Unidentified Trap' Alerts that you provided :
NOTIFICATION ORIGINATOR = Fault Management Module
The EnterpriseOid in this Alert tells me that this is the cisco syslog trap :
.1.3.6.1.4.1.9.9.41.2.0.1
clogMessageGenerated OBJECT-TYPE
        -- FROM CISCO-SYSLOG-MIB
        TRAP
        VARBINDS       { clogHistFacility, clogHistSeverity,
clogHistMsgName, clogHistMsgText, clogHistTimestamp }
        DESCRIPTION    "When a syslog message is generated by the device a
               clogMessageGenerated notification is sent. The
               sending of these notifications can be enabled/disabled
               via the clogNotificationsEnabled object."
This tells me that you have configured this device with 'snmp-server enable trap syslog' , which means that every syslog message that is generated on the device will also be sent as an snmp trap.
Is there a specific reason why the sending of syslog messages as an snmp trap has been enabled on this device (and others) ?
To stop LMS generating an Alert for every syslog message I would recommend that you disable this device from sending syslog traps to LMS. If there are multiple devices sending syslog traps to LMS then the sending of these traps to LMS should be disabled on all such devices.
Thanks-
Afroz
***Ratings Encourages Contributors ****

Cannot suppress unidentified trap in LMS Fault Monitor

Hello,
We have Ciscoworks LMS upgraded from version 4.0.1 to Cisco Prime 4.1.
DFM is displaying in "Fault Monitor", "Device Fault Summary Tab" an entry which says "Unidentified Trap". In the lower pane titled "Fault for unidentified trap" we have no event to own or clear, so we cannot suppress this line from DFM.
Any fix available ?
Best regards
C.Barbu

There have been known issues with Fault Monitoring Alerts caused by steal entries in EPM database. To fix this, please run the below commands on your server's command prompt (this will delete all the data from the EPM database):
+ Stop daemon manager :
net stop crmdmgtd
+ Re-initialize EPM db as below :
NMSROOT\bin\perl.exe NMSROOT\bin\dbRestoreOrig.pl dsn=dfmEpm dmprefix=EPM
example:
C:\progra1\CSCOpx\bin\perl.exe C:\progra1\CSCOpx\bin\dbRestoreOrig.pl dsn=dfmEpm dmprefix=EPM
+ Start daemon manager:
net start crmdmgtd

Unidentified traps and interface down alerts LMS 4.2

Hi all,
Sometimes we have unidentified traps in our log, we don't know where they come from.
In high severity faults we see an active alert with device name “Unidentified” event name unresponsive but with a certain ip address.
What are these alerts about? Can I filter them?
A second issue I have is that I get interface down alerts. But when we log on to the device, there is no interface down at all. We can also ping the device from the lms server at that time. I have been told that the admin state and operational state has to be up.
Thanks,
Best Regards,
Joris

Hi Joris,
Generic trap support is a new feature introduced in LMS 4.2 release. look at the below
document also.
http://www.cisco.com/en/US/docs/net_mgmt/ciscoworks_lan_management_solution/4.2/user/guide/lms_monitor/TrapFwd.html#wpxref13049
LMS 4.2 release onwards DFM will display any unprocessed traps comming from device in
fault monitor screen as unidentified trap under Inform alarm.
For the other issue , it could be a DFM database issue , try to REDISCOVER those devices in
DFM and see how it works
Thanks
Afroz

Fault Monitor in LMS 4

Hi all,
Ciscoworks LMS 4 is very complicated tool for me and it is very hard to configure any cisco device what I need to monitor.
Currently I have 3750-X configured, properly discovered and added to DCR.
I would like to receive SMTP messages(mail) from LMS if some event occurs. For example when link UPDOWN occurs or when LOGIN_FAILED occurs and so on. Is it possible to configure this?
I tried to configure it in Monitor > Monitoring Tools > Fault Monito, but without siccess. LMS tell me that there are no devices available.
How can I configure some notification so it is able to send me message via smtp?
Thank you for answer.
Jan

Hi Joe,
check the below link for more results on Unidentified traps:
http://www.cisco.com/en/US/docs/net_mgmt/ciscoworks_device_fault_manager/3.1
/user/guide/TrapFwd.html#wpxref57860
It looks like "snmp-server enable traps syslog" is enabled on your devices, and this will appears as Unidentified trap , you can stop this by change the configuration on the Device , or disable the "InformAlarm" from the notification Group under : Admin > Network > Notification and Action Settings > Fault Notification Group From the following Link you can check the traps that will generate "INFORM ALARM" event :
I hope this will help
Thanks-
Afroz

Unidentified Trap -unknown bug

An unknown bug which has OID as such:
EVENT ID = 00005CX
TIME = Thu 28-Jun-2012 16:32:13 SGT
STATUS = Active
SEVERITY = Informational
MANAGED OBJECT = Device_Hostnamexxxxxx
MANAGED OBJECT TYPE = Switches and Hubs
EVENT DESCRIPTION = InformAlarm::Component=xxxx.xxxx.com:
Unidentified Trap Generic Trap:6 Specific Trap:1
EnterpriseOid:.1.3.6.1.4.1.9.9.41.2;Description=Generic Trap:6 Specific Trap:1
VarBinds:{ .1.3.6.1.4.1.9.9.41.1.2.3.1.2.544239:LINEPROTO,
.1.3.6.1.4.1.9.9.41.1.2.3.1.3.544239:6,
.1.3.6.1.4.1.9.9.41.1.2.3.1.4.544239:UPDOWN,
.1.3.6.1.4.1.9.9.41.1.2.3.1.5.544239:Line protocol on Interface FastEthernet3/48,
changed state to down, .1.3.6.1.4.1.9.9.41.1.2.3.1.6.544239:975111759 };
NOTIFICATION ORIGINATOR = Fault Management Module

So what do we do about these alerts that often get triggered?
Unidentified Trap Generic Trap:enterpriseSpecific Specific Trap:1 EnterpriseOid:.iso.org.dod.internet.private.enterprises.cisco.ciscoMgmt.41.2
Description
Generic Trap:6 Specific Trap:1 VarBinds:{ .1.3.6.1.4.1.9.9.41.1.2.3.1.2.23652:LINK, .1.3.6.1.4.1.9.9.41.1.2.3.1.3.23652:4, .1.3.6.1.4.1.9.9.41.1.2.3.1.4.23652:UPDOWN, .1.3.6.1.4.1.9.9.41.1.2.3.1.5.23652:Interface FastEthernet1/0/39, changed state to up, .
on the interface I have configured "no snmp trap link-status," but I keep getting these info alarms.

LMS 4.2 Fault Monitor - Device Name and Frequency of Events

Hi all,
I've just installed LMS 4.2, like it a lot so far. But I'm running into a few problems, and I'm hoping someone out here has a suggestion.
In the Fault Monitor, the Device Name column shows the device's IP address rather than the host name. We need for it to show the host name, for ease of troubleshooting; most folks don't have the IP addresses memorized. Likewise, when an email is sent out for an event, the managed device field also shows up as the device's IP address.
The devices were all discovered with their IP addresses rather than a host name...should LMS have automatically found their host names? Regardless, I manually updated all of the device's host names, yet they still display as an IP address in the fault monitor.
Also, it appears I need to figure out some way to throttle alerts. One particular device will report an event (ie a temperature out of range) dozens of times in a polling period...several per second, even though it's the same alert. Any suggestions on where I can throttle this? My inbox is exploding.
If anyone has any ideas, I would appreciate it!
Jen

I am having the IP vs. device name issue as well. The funny thing is if you hover over the IP of the device in Fault Monitor, you can see the device name listed. I was on a conference call with Cisco recently and pointed this out. One of the reps said the faults and alerts showing IP address issue should be fixed in version 4.2.3, but I don't know if he was basing this on first-hand knowledge or was just assuming. Does anyone know if this is the case?
As for throttling alerts. I had a false positive alert from a device that I put in a custom fault group and changed the threshold on to keep them from firing. You probably have already resolved this issue, but I didn't see a resolution listed here. You would have to determine if raising a threshold for a device is adequate for your situation.
Thank you,
Mark

Not able to see devices in fault monitor LMS 4.0

I can see devices in the managed group ,but cannot see devices in fault monitor,its show no device available

Balbir,
LMS 4.0 is now obsolete. We recommend to use LMS 4.2.x to have the support.
In LMS 4.x the devices are by default managed by each module like fault monitor. Please share a screenshot where you're expecting and don't see devices.
When was this installed? Was it working ever? You can also try to reset your fault Monitor module by reinitializing the DataBase for Fault.
Check the commands from here:
LMS Database Troubleshooting
-Thanks
Vinod
**Encourage Contributors. RATE Them.**

Cisco Works LMS 4.0 - Fault Monitor Issue

Hi!,
I have a little problem with the LMS application. when I try to access to the screen of: Monitor --> Monitoring Tools --> Fault Monitor, the application shows an error message that only said: "Sorry an error occurred" and thats all.
Any idea of what can I try in order to solve this?,
Thanks,

Hi Duong!, thanks for your reply. The services was restarted but the problem still exist (the process DFMCTMStartup is allways down although I started manually)
And the only change that I see is that the Fault Monitor Screen show first a message "There are no faults available" but I Have marked 46 Faults!"

LMS 4.2.2 Fault Monitor suspend device

Hello to everyone,
might sound strange but i´m looking for two hours now and can not find a way to suspend a device in the Fault Monitor. We´re using LMS 4.2.2
Can someone point me to the right direction? Thank you.
Regards,
Chris

Ok, found it: Inventory -> Manage Device State -> Device Count -> Suspend!!

LMS 4.0: Fault Monitoring Device Administration stuck in learning

Hello Members,
i have a problem with Fault Monitoring Device Administration. i have two devices which stuck in learning mode for almost forever. When the job is done the devices report an error SNMP timeout. I run a credential verfication job and the credentials for the devices are correct.
any ideas?
regards
alex

Assuming these are the only four devices using SNMPv3 in LMS, then the engineID is a non-issue. However, if any other device has the same engineID as those two non-working devices, the problem could still be a duped engineID. Debugging with logs is fairly complex. The easiest way to identify the problem is to use a sniffer. Start a sniffer trace filtering on all traffic to one of the failing devices. Then, rediscover the device in Fault Monitoring under Admin > Collection Settings > Fault > Fault Monitoring Device Administration. When it goes to a Questioned state, look at the sniffer trace.
If you see SNMP report packets indicating an error of notInWindow, that points to the duplicate engineID problem. ICMP packets without responses points to problems with ping.

LMS CiscoWorks 3.2 CPU 100 % on devices monitored

HI,
it's possible that LMS CiscoWorks influenced devices performance? On devices monitored from CiscoWorks CPU reached peaks of 100% of utilization.
If i stop Ciscoworks they work normally.
Thanks

Yes, it is possible. Device bugs can exist that cause high CPU when certain MIB objects are polled. There may also be other factors that can lead to high CPU when a device is polled with SNMP. For example, routers will large ARP caches may see CPU spikes when User Tracking polls the devices during acquisition. In these cases, SNMP views can be applied to restrict those MIB branches from being polled.
To determine what MIB objects are leading to CPU spikes, the output of "show stack PID" is required when the CPU is spiking (where PID is the process ID of the SNMP ENGINE and IP SNMP processes). In addition to this, the show version and show region output are required.

Ciscoworks LMS 4.0 DFM Custom Traps

Hello,
We want to use Ciscoworks LMS 4.0 for Access Control List Monitoring. i.e. if we end the ACLs with "log" entry, we may send the ACL deny logs to the Ciscoworks as Syslog or Snmp Trap format.
With "debug snmp packets" command we may observe the packets are sent to the LMS, but the traps don't show up as alarms. Is it possible to observe any trap entry with LMS DFM Fault Manager by customizing the module, because we think the engine of the DFM analyzes the traps and shows some of the traps, not all of the traps are observable.
The command output is as below:
Thanks in Advance,
Best Regards,
Mar 2 10:28:30.028: SNMP: Queuing packet to 10.10.10.1
.Mar 2 10:28:30.028: SNMP: V1 Trap, ent ciscoSyslogMIB.2, addr 10.10.20.1, gen trap 6, spectrap 1
clogHistoryEntry.2.742 = SEC
clogHistoryEntry.3.742 = 7
clogHistoryEntry.4.742 = IPACCESSLOGDP
clogHistoryEntry.5.742 = list 191 denied icmp 10.10.10.1 -> 10.10.20.1 (0/0), 10 packets
clogHistoryEntry.6.742 = 69082382

DFM consumes the traps and decides based on its built-in code-book what to do - rise one of the predefined Events or just silently ignore it. The best DFM can do is forward the trap as-is to another trap receiver.
Perhaps the LMS Syslog-Server can do what you want and lauch automated actions (like scripts or e-mail) based on certain criteria.
But you should take care of the underlying syslog file and keep its size under control with logrot.pl utility.
The online help of LMS should give you more details on the syslog capabilities or this link to the LMS 4.0 Administration Guide:
http://www.cisco.com/en/US/docs/net_mgmt/ciscoworks_lan_management_solution/4.0/user/guide/admin/useNotif.html#wp1075603

ZFS on solaris10 panics HP Proliant server BAD TRAP page fault in kernel

When installing Solaris 9/10 on a HP Proliant DL 380 G5
the system resets when choosing ZFS as a root file system,
even after CPQary3 device driver has been installed.
The CPQary3 device driver is the latest version 2.3.0,is neccessary because of the presence of a HP Smart Array E200 Controller
and is installed sucessfully during the installation from DVD
When choosing UFS as a root file system, the OS installs fine.
But when zfs is used to configure a zps pool after the installation, the system resets again
Has anyone experienced the same problems ? knows how to solve this ?
Solaris installs fine when choosing UFS as a root file system.
After that, a second disk partition is created of type Other to hold a zfs pool with the following command:
zpool create datapool c0t0d0p2
After that the system PANICS: here is an extract from the /var/adm/messages files:
Mar 14 16:36:49 solarisintel ^Mpanic[cpu1]/thread=fffffe800069bc60:
Mar 14 16:36:49 solarisintel genunix: [ID 335743 kern.notice] BAD TRAP: type=e (#pf Page fault) rp=fffffe800069b940 addr=238 occurred in
module "unix" due to a NULL pointer dereference
Mar 14 16:36:49 solarisintel unix: [ID 100000 kern.notice]
Mar 14 16:36:49 solarisintel unix: [ID 839527 kern.notice] sched:
Mar 14 16:36:49 solarisintel unix: [ID 753105 kern.notice] #pf Page fault
Mar 14 16:36:49 solarisintel unix: [ID 532287 kern.notice] Bad kernel fault at addr=0x238
Mar 14 16:36:49 solarisintel unix: [ID 243837 kern.notice] pid=0, pc=0xfffffffffb8406fb, sp=0xfffffe800069ba38, eflags=0x10246
Mar 14 16:36:49 solarisintel unix: [ID 211416 kern.notice] cr0: 8005003b<pg,wp,ne,et,ts,mp,pe> cr4: 6f0<xmme,fxsr,pge,mce,pae,pse>
Mar 14 16:36:49 solarisintel unix: [ID 354241 kern.notice] cr2: 238 cr3: 11ada000 cr8: c
Mar 14 16:36:49 solarisintel unix: [ID 592667 kern.notice] rdi: 238 rsi: 4 rdx: fffffe800069bc60
Mar 14 16:36:49 solarisintel unix: [ID 592667 kern.notice] rcx: 14 r8: 0 r9: 0
Mar 14 16:36:49 solarisintel unix: [ID 592667 kern.notice] rax: 0 rbx: 238 rbp: fffffe800069ba60
Mar 14 16:36:49 solarisintel unix: [ID 592667 kern.notice] r10: 0 r11: 1 r12: 100000
Mar 14 16:36:49 solarisintel unix: [ID 592667 kern.notice] r13: 0 r14: 4 r15: ffffffffb3a61af0
Mar 14 16:36:49 solarisintel unix: [ID 592667 kern.notice] fsb: 0 gsb: ffffffff9b2ac800 ds: 43
Mar 14 16:36:49 solarisintel unix: [ID 592667 kern.notice] es: 43 fs: 0 gs: 1c3
Mar 14 16:36:49 solarisintel unix: [ID 592667 kern.notice] trp: e err: 2 rip: fffffffffb8406fb
Mar 14 16:36:49 solarisintel unix: [ID 592667 kern.notice] cs: 28 rfl: 10246 rsp: fffffe800069ba38
Mar 14 16:36:49 solarisintel unix: [ID 266532 kern.notice] ss: 30
Mar 14 16:36:49 solarisintel unix: [ID 100000 kern.notice]
Mar 14 16:36:49 solarisintel genunix: [ID 655072 kern.notice] fffffe800069b850 unix:die+da ()
Mar 14 16:36:49 solarisintel genunix: [ID 655072 kern.notice] fffffe800069b930 unix:trap+5e6 ()
Mar 14 16:36:49 solarisintel genunix: [ID 655072 kern.notice] fffffe800069b940 unix:cmntrap+140 ()
Mar 14 16:36:49 solarisintel genunix: [ID 655072 kern.notice] fffffe800069ba60 unix:mutex_enter+b ()
Mar 14 16:36:49 solarisintel genunix: [ID 655072 kern.notice] fffffe800069ba70 zfs:zio_buf_alloc+1d ()
Mar 14 16:36:49 solarisintel genunix: [ID 655072 kern.notice] fffffe800069baa0 zfs:zio_vdev_io_start+120 ()
Mar 14 16:36:49 solarisintel genunix: [ID 655072 kern.notice] fffffe800069bad0 zfs:zio_execute+7b ()
Mar 14 16:36:49 solarisintel genunix: [ID 655072 kern.notice] fffffe800069baf0 zfs:zio_nowait+1a ()
Mar 14 16:36:49 solarisintel genunix: [ID 655072 kern.notice] fffffe800069bb60 zfs:vdev_probe+f0 ()
Mar 14 16:36:49 solarisintel genunix: [ID 655072 kern.notice] fffffe800069bba0 zfs:vdev_open+2b1 ()
Mar 14 16:36:49 solarisintel genunix: [ID 655072 kern.notice] fffffe800069bbc0 zfs:vdev_open_child+21 ()
Mar 14 16:36:49 solarisintel genunix: [ID 655072 kern.notice] fffffe800069bc40 genunix:taskq_thread+295 ()
Mar 14 16:36:49 solarisintel genunix: [ID 655072 kern.notice] fffffe800069bc50 unix:thread_start+8 ()
Mar 14 16:36:49 solarisintel unix: [ID 100000 kern.notice]
Mar 14 16:36:49 solarisintel genunix: [ID 672855 kern.notice] syncing file systems...
Mar 14 16:36:49 solarisintel genunix: [ID 904073 kern.notice] done
Mar 14 16:36:50 solarisintel genunix: [ID 111219 kern.notice] dumping to /dev/dsk/c0t0d0s1, offset 108593152, content: kernel
Mar 14 16:36:54 solarisintel genunix: [ID 100000 kern.notice]
Mar 14 16:36:54 solarisintel genunix: [ID 665016 kern.notice] ^M100% done: 210699 pages dumped,
Mar 14 16:36:54 solarisintel genunix: [ID 851671 kern.notice] dump succeeded
Mar 14 16:38:21 solarisintel genunix: [ID 540533 kern.notice] ^MSunOS Release 5.10 Version Generic_142910-17 64-bit
I will try again now with solaris 10 5/09 (U7)
Chris.
Edited by: user5485639 on 14-Mar-2011 08:42

What do you mean after the driver is installed?
S10/U9 has the Compaq Array3 driver pre-installed. No more adding it to the jumpstart tree or "adding a driver" necessary.
I have setup several DL360 G3's and G4's which use the same controller.

LMS 4.2 and SNMPv3 traps

Hello,
Does LMS4.2 or better the DFM of LMSv4.2 support SNMPv3 traps? I read in lms42rel.pdf => In this release, Trap support is provided for SNMPv3 configured devices, SNMPv2 configured devices, unknown devices, and non-Cisco devices.
If yes, do we need to provide the SNMP Engine-IDs of target devices sending traps so that LMS can decrypt the traps or will LMS deploy the Engine-IDs from the poll cache to the DFM trap receiver? If manual Engine-ID maintanance is required, where in LMS can we type in the Engine-ID's?
thx for answers in advance,
Steffen

Seems the SNMP v3 config is not correct.
Please see my comments inline (in bold blue) as per your config, in what i think is incorrect:
snmp-server view LMS iso included     --> correct
snmp-server view LMS ####at excluded     --> dont know if #'s are by mistake
snmp-server view NMS snmpUsmMIB excluded --> Not sure if NMS is typo or you made a new view after LMS.
snmp-server view LMS snmpVacmMIB excluded      --> correct
snmp-server view LMS snmpCommunityMIB excluded     --> correct
snmp-server group LMS v3 priv read v3read write v3write notify LMS `--> Incorrerect, as after read and write you should have a SNMP View which is configured with "snmp-server view" command, which is either LMS or NMS in your case. There is no v3read or v3write configured.
snmp-user LMS LMS v3 auth md5 authPW priv aes 128 privPW      -->Not sure if "snmp-user" is again a typo, else everything is correct.
snmp-server host x.x.x.x traps version 3 priv NMS      --> There is no user as 'NMS'. after priv it should be either "SNMPv1/v2c community string or SNMPv3 user name". I dont see any username as NMS, as per config it should be LMS.
-Thanks

LMS 4.2.1 - unidentified traps in fault monitor

Similar Messages

Maybe you are looking for