Syslog & SNMP Traps:- Does LMS 3.1 need to receive both?

Do my switches need to send both syslog and SNMP traps to LMS 3.1 or should I configure for either syslog or SNMP Traps, but not both?
Thanks
James

Well "needs to", no
Syslog
RME configuration management works better if it can detect config changes via syslog.
The syslog reports depend on it, so do the "automated actions" since they are based on syslog messages
Traps
Fault management can interpret a few traps but does most of its detecting via snmp get.
LMS will work without it but I think it is worthwhile to configure the devices to send traps and syslog.
Cheers,
Michel

Similar Messages

SCOM 2012 SNMP Trap - Does anyone have it working?

I am wondering if anyone out there has had any luck with getting SNMP Traps to be captured by SCOM 2012? Probes work fine.
We have been unable to get SCOM 2012 to receive a SNMP Trap from network devices. We currently have a case open with Microsoft, but they dont have any answers as of yet.
Here are the cliff notes version of what we have done so far.
Discovery - OK
The nodes discover without issue. I made sure they were set to SNMP only. I did this to verify we were talking SNMP and not just ICMP.
Open Ports/Firewall Issues
No firewalls are in place on the SCOM server and none exist between devices we are trying to get traps from. Using a port tool, I can see that UDP 162 is listening as expected and its the System Center Management Host Process that is running the
process. We have tried having SNMP installed, but disabled, installed and running, and uninstalled. Currently we have the SNMP service installed and running. The SNMP Trap Service is NOT installed.
Data Validation
Using Wireshark running on the SCOM box I have been able to validate the OIDs we are searching for are hitting the SCOM server. I installed an SNMP Trap generator and Receiver on my local machine as well as Jalasoft SNMP Simulator. I was able
to discover my local machine as a network device and if I send a TRAP from the TRAP generator on my local machine to the receiver on my local machine I can validate the data is coming through ok.
What has been done on SCOM side
The simplest place to look for data is with an Event Collection Rule and then an Event View Monitor. We have set up an Event Based Monitor to search for an OID that I know to be accurate and then I set up an Event monitor to look for
anything hitting that Collection Rule. The Event monitor showed nothing so we changed the EVent Monitor to look for anything that hit Node which should show any SNMP traps that have hit from network devices. No results.
We tried to run WFAnalyzer from the 2007R2 Authoring Console, but it wont run against 2012 and from what I have found the 2012 edition doesnt exist anywhere yet.
So has anyone succesfully received a SNMP TRAP into SCOM 2012?

Hi,
As this thread has been quiet for a while, we assume that the issue has been resolved. At this time, we will mark it as "Answered" as the previous steps should be helpful for many similar scenarios.
In addition, we’d love to hear your feedback about the solution. By sharing your experience you can help other community members facing similar problems.
Thanks,
Yog Li
TechNet Community Support
How could you possibly mark this as answered? No answer was given, it was quiet for a couple of days including one of which was a holiday in the US. The previous steps are NOT helpful. The question remains, Does anyone have it working?
People have given troubleshooting advice, but nobody has actually answered the simple question. Do they have it actually WORKING?

CiscoWorks LMS: not receveing certain SNMP traps

CiscoWorks LMS 4.0.1 (I know it's old and unsupported).
Problem: not receiving certain SNMP traps.
For example: I receive trap like "STP new root" but not like "port put to err-disabled" or my custom traps (produced by EEM scripts).
I've investigated my situation and found out that switch sends traps and they reach* LMS but somehow LMS ignores them (there's no trace of them in GUI). I've read that some traps just pass through LMS but my traps are very important and I need to know about them.
* I did Wireshark capture on LMS machine.
I'd like to know how to debug receiving of SNMP traps in LMS:
which specific debugs need to be enabled,
which specific log files need to be examined.

LMS uses DFM to process certain traps.
All traps it deems unimportant are dropped.
If you want to use the LMS GUI you can have you device send a SYSLOG message rather than a trap.
use logging source command to make the management interface send the message.
Then there is a GUI that allows you to launch an action on a message
Cheers,
Michel

Questions on Receiving SNMP Traps

Hi:
- I have more questions on receiving SNMP traps:
1) the OEM plug-in can receive traps now, but when I click the metric, I see:
Error getting data for target test20. Exception: ORA-20216: ORA-06512: at "SYSMAN.EMD_MNTR", line 817 ORA-01403: no data found ORA-06512: at line 1
- the push descriptor looks like:
<PushDescriptor RECVLET_ID="SNMPTrap">
<Property NAME="MatchEnterprise" SCOPE="GLOBAL">...</Property>
<Property NAME="MatchGenericTrap" SCOPE="GLOBAL">6</Property> <Property NAME="MatchSpecificTrap" SCOPE="GLOBAL">31</Property> <Property NAME="MatchAgentAddr" SCOPE="INSTANCE">target_ip</Property>
<Property NAME="EventsnChasFanIndexOID" SCOPE="GLOBAL">...</Property>
<Property NAME="ContextsnChasFanDescriptionOID" SCOPE="GLOBAL">...</Property>
<Property NAME="SeverityCode" SCOPE="GLOBAL">WARNING</Property>
</PushDescriptor>
- is the Key Property needed ?
2) The alerts for some reason do not filter back to the all targets home page.
- When I click the Home tab and goto to the 'All Targets' pane, I do not see the alert generated by the OEM plug-in.
- What I am doing wrong ?
3) Is it okay to receive traps with the metric usage set to either: HIDDEN or HIDDEN_COLLECT ?
- Does this cause the errors I see in Q 1) ?
Thanks
John
Edited by: user8826739 on Feb 23, 2010 7:05 AM

Hi John,
Can you post the full definition of the metric? You would need to use the Key property for each key column in the metric description.
With the SNMP receivelet you can set up definitons for data points or alerts. I would assume (as I've never tried this ;) that if you set up the definition to be a data point, you would see data from the All Metrics page. To me, it wouldn't make sense for a metric that used the PushDescriptor SNMPTrap to have data to be viewed as the result of the SNMP trap coming is would be an alert. I will have to look into that. My gut reaction is that a metric with PushDescriptor SNMPTrap shouldn't even appear on the All Metrics page ...
To be clear are you saying that you don't see the Warning number under "All Targets Alerts" increase by 1 when you SNMP trap is caught and alert is generated? When this occurs do you see the alert on the target instance homepage?
In regards to HIDDEN and HIDDEN_COLLECT, I don't know what effect they would have on a metric defined for an SNMP trap to raise an alert. You definitely wouldn't want to use HIDDEN as this setting is for temporary metrics that are used in the caclulation of other metrics. HIDDEN metrics are not collected (or hence uploaded to the OMS) and don't appear in the UI. HIDDEN_COLLECT are collected, but do not show up in the UI and are not uploaded. I've never used this settings with SNMP trap metrics that are for alerts. If your metrics for the SNMP trap alerts do show up on the All Metrics page (I'd have to get something set up to look at this), then it could make sense to use the HIDDEN_COLLECT as the alert would still be generated, but the metric itself wouldn't be shown in the UI.
Let me find out the expected behavior from someone on the agent team.
Dave

How to enable the "SNMP TRAP" Funcation in Prime Infrasructure 2.0 for receiveing the Third Party Device's SNMP TRAP

I already uploaded the third party device's MIB to PI2.0, but could not recive the third party device's SNMP TRAP properly .
what do I need check for the PI ? or what do I need to setup for the PI?
Thanks

Duplicate post of :
https://supportforums.cisco.com/discussion/12148626/how-enable-snmp-trap-funcation-prime-infrasructure-20-receiveing-third-party
-Thanks
Vinod

Enterprise Manager Grid Control can send SNMP Traps to third-party?

GC 11.1
It looks like a simple config, but I've got into a confusion about it.
I'm trying to figure out the configuration to send SNMP traps to a third party server.
My scenario is:
Node A (managed, monitored) ---- GC box------ SNMP box (final destination).
My understanding is that the traps (notification methods) configured on GC box are generated by the Agent on Node A, then received by the GC and distributed as e-mails.
What is the config to set the traps from A to reach SNMP box?
There is the help page from the GC page (confused about interpretation):
"Add SNMP Trap pageThe Add SNMP Trap page enables you to provide the name of the host (machine) on which the SNMP Master Agent is running and other details so that SNMP traps can be sent through Notification Rules.
An example is shown below.
Name HP OpenView Console
Description Notification method to send trap to HP openview console
SNMP Trap Host Name litleguy.us.oracle.com
SNMP Host Port 162
SNMP Community public
This SNMP host will receive your SNMP traps.
Note: A Test Trap button exists for you to test your setup."
Any suggestions are highly appreciated.
Thx,

Please reply with the specific questions around this.
11.1
EM can send SNMP traps to specific designated receivers. You create an advanced notification method (of type SNMP Trap) with the appropriate details about the receiver.
(See Setup->Notification Methods)
In the notification rules UI, you specify the alerts you are interested in forwarding and select the SNMP trap advanced notification method you created earlier.
The SNMP receiver should be provided the correct MIB that defines the SNMP trap. There were some bugs with the MIB definition in one of the releases (don't recall which one off hand), so if the traps you are receiving don't match what the receiver expects - please let us know and we can point to the right one.
regards

LMS 3.2.1 integration with Clarity NMS for snmp trap forwarding

Our client have integrated Clarity NMS to Ciscoworks LMS 3.2.1. So far they are receiving raw alarms/snmp traps but it lacks information/inventory of the originating device. Kindly see sample raw alarms below:
2420: 2011-11-25 12:10:46 Received trap ==> Received SNMPv1 Trap
Community=ciscoworks
Enterprise=1.3.6.1.6.3.1.1.5
Generip trap type=2
Specific Trap Type=0
Trap From=10.220.10.1
Trap ID=1.3.6.1.6.3.1.1.5.2
Trap Time=-1436283373
1.3.6.1.2.1.2.2.1.1.83=83
1.3.6.1.2.1.2.2.1.2.83=GigabitEthernet1/40
1.3.6.1.2.1.2.2.1.3.83=6
1.3.6.1.4.1.9.2.2.1.1.20.83=Lost Carrier
EndTrap
10933: 2011-11-24 11:57:53 Received trap ==> Received SNMPv1 Trap
Community=ciscoworks
Enterprise=1.3.6.1.4.1.9.1.291
Generip trap type=2
Specific Trap Type=0
Trap From=10.220.10.1
Trap ID=1.3.6.1.4.1.9.1.291.2
Trap Time=1628056965
1.3.6.1.2.1.2.2.1.1.8=8
1.3.6.1.2.1.2.2.1.2.8=E1 0/0/0
1.3.6.1.2.1.2.2.1.3.8=18
EndTrap
As you can see, those raw alarms doesn’t contain any information about the originating equipment or the physical card, port related information where those alarms were generated. Instead those alarms received are just NMS level alarms.
How do we resolve this so that the inventory of the equipment would be part of the trap to be received by Clarity from Ciscoworks.

Hi,
Is the issue you have the source IP address of the forwarded trap? Per RFC it is the IP of the actual device sending the trap. The originating IP should be contained within the packet. I have included some additional information you may find helpful.
Q. What is the difference between SNMP Raw Trap Forwarding and SNMP Trap alert/event Trap Forwarding? Does DFM support both?
A. You can configure raw trap forwarding at DFM > Other configuration > SNMP Trap forwarding, and processed event/alert trap forwarding at DFM > Notification Services > SNMP Trap Forwarding. Processed trap is "when DFM receives certain SNMP traps, it analyzes the data found in fields (Enterprise/Generic trap identifier/Specific Trap identifier/variable−bindings) of each SNMP trap message, and changes the property value of the object property (if required)". Raw trap is the trap that the device forwards to DFM and DFM has yet to process it. For more information, refer to the DFM User Guide. Yes, DFM supports both ways of trap forwarding.
http://www.cisco.com/en/US/products/sw/cscowork/ps2421/products_qanda_item09186a0080a9b35b.shtml
DFM will only forward SNMP traps from devices in the DFM inventory. It will not change the trap format—it will forward the raw trap in the format in which the trap was received from the device. However, you must enable SNMP on your devices and you must do one of the following:
Configure SNMP to send traps directly to DFM
Integrate SNMP trap receiving with an NMS or a trap daemon
The versions of SNMP traps supported by DFM are described in SNMP and ICMP Polling. For information on forwarding processed and pass-through traps, see Processed and Pass-Through Traps, and Unidentified Traps and Events.
Pass-through traps are traps that DFM receives from devices that are not in the DFM inventory, and DFM has not processed. Forwarding these traps is controlled using Configuration > Other Configurations > SNMP Trap Forwarding. These traps are shown in the Alerts and Activities display because of their relevance to fault monitoring. Pass-through traps are displayed as follows:
As one of the following events:
> InformAlarm
> MinorAlarm
> MajorAlarm
With the device type and the device name from which it was generated.
If DFM does not know which device generated the trap, it ignores the trap. Pass-through traps will be cleared after a default interval of 10 minutes to one hour
http://www.cisco.com/en/US/docs/net_mgmt/ciscoworks_device_fault_manager/3.2/user/guide/dfm32ug_Book.html

LMS 3.2 snmp trap forwardig to HP-open view

Hi,
I want to forward snmp traps from cisco LMS to HP-open view. Both applications are installed on different servers.
From previous post in this forum, I found a similar post that recommand using snmp forwording in DFM.
What I want to know is do I need any integration or packages to install on both platforms to do this? Also, will DFM forward all traps that it receives from installed devices or it will forward some of them.
Thank you
BR,
ZS

Chris;
current version of Java is 1.6.0 Update 20
Additional information to the issue: a WS-C3750 has been discovered (connected to another 6509 that is running hybrid) and added to the topology map as it one would expect.
craig

NX-OS snmp-trap strdata does not return string sent from device to object server

NX-OS snmp-trap strdata does not return string sent from device to object server
Applet was created:
   event manage applet TEST_VPC
   description "%ETHPORT-5-IF_DOWN_ADMIN_DOWN"
   event syslog occurs 1 priority 4 pattern "%ETHPORT-5-IF_DOWN_ADMIN_DOWN"
   action 1.0 snmp-trap strdata "Loopback0 is admin down"
after event is generated (link admin down), trap is sent to snmp server, but string does not appear in received messages:
2014-03-17T04:29:26: Debug: D-P_M-105-000: 1 trap in queue
2014-03-17T04:29:26: Debug: D-P_M-105-000: V2/V3 trap/inform received
2014-03-17T04:29:26: Information: I-P_M-104-000: Number of items in the trap queue is 0
2014-03-17T04:29:26: Debug: D-UNK-000-000: [Event Processor] ReqId: 1427018637
2014-03-17T04:29:26: Debug: D-UNK-000-000: [Event Processor] community: xxxx
2014-03-17T04:29:26: Debug: D-UNK-000-000: [Event Processor] IPaddress: x.x.x.x
2014-03-17T04:29:26: Debug: D-UNK-000-000: [Event Processor] PeerIPaddress: x.x.x.x
2014-03-17T04:29:26: Debug: D-UNK-000-000: [Event Processor] ReceivedPort: 162
2014-03-17T04:29:26: Debug: D-UNK-000-000: [Event Processor] ReceivedTime: 1395044966
2014-03-17T04:29:26: Debug: D-UNK-000-000: [Event Processor] Protocol: UDP
2014-03-17T04:29:26: Debug: D-UNK-000-000: [Event Processor] SNMP_Version: 2
2014-03-17T04:29:26: Debug: D-UNK-000-000: [Event Processor] UpTime: 1166940388
2014-03-17T04:29:26: Debug: D-UNK-000-000: [Event Processor] Uptime: 1:30:03.88
2014-03-17T04:29:26: Debug: D-UNK-000-000: [Event Processor] .1.3.6.1.2.1.1.3.0: (1166940388) 135 days, 1:30:03.88
2014-03-17T04:29:26: Debug: D-UNK-000-000: [Event Processor] notify: .1.3.6.1.4.1.9.9.43.2.0.2
2014-03-17T04:29:26: Debug: D-UNK-000-000: [Event Processor] .1.3.6.1.6.3.1.1.4.1.0: .1.3.6.1.4.1.9.9.43.2.0.2
2014-03-17T04:29:26: Debug: D-UNK-000-000: [Event Processor] OID1: .1.3.6.1.4.1.9.9.43.1.1.1.0
2014-03-17T04:29:26: Debug: D-UNK-000-000: [Event Processor] 1: (1166939868) 135 days, 1:29:58.68
2014-03-17T04:29:26: Debug: D-UNK-000-000: [Event Processor] 1_raw: (1166939868) 135 days, 1:29:58.68
2014-03-17T04:29:26: Debug: D-UNK-000-000: [Event Processor] 1_text: (1166939868) 135 days, 1:29:58.68
2014-03-17T04:29:26: Debug: D-UNK-000-000: [Event Processor] 1_hex: (1166939868) 135 days, 1:29:58.68
2014-03-17T04:29:26: Debug: D-UNK-000-000: [Event Processor] .1.3.6.1.4.1.9.9.43.1.1.1.0: (1166939868) 135 days, 1:29:58.68
2014-03-17T04:29:26: Debug: D-UNK-000-000: [Event Processor] OID2: .1.3.6.1.4.1.9.9.43.1.1.6.1.6.36
2014-03-17T04:29:26: Debug: D-UNK-000-000: [Event Processor] 2: 4
2014-03-17T04:29:26: Debug: D-UNK-000-000: [Event Processor] 2_raw: 4
2014-03-17T04:29:26: Debug: D-UNK-000-000: [Event Processor] 2_text: 4
2014-03-17T04:29:26: Debug: D-UNK-000-000: [Event Processor] 2_hex: 4
2014-03-17T04:29:26: Debug: D-UNK-000-000: [Event Processor] .1.3.6.1.4.1.9.9.43.1.1.6.1.6.36: 4
2014-03-17T04:29:26: Debug: D-UNK-000-000: [Event Processor] Node: xxx
2014-03-17T04:29:26: Debug: D-UNK-000-000: [Event Processor] PeerAddress: xxxx
2014-03-17T04:29:26: Debug: D-UNK-000-000: [Event Processor] EventCount: 360
2014-03-17T04:29:26: Debug: D-UNK-000-000: [Event Processor] Processing alert {0 remaining}
please help figure this out

This is a CISCO-CONFIG-MAN-MIB trap, not an EEM trap. I don't think your EEM applet is being triggered since you have that priority argument in there. Try removing that and leave the syslog pattern alone. You will see the string as a varbind in the trap.

Syslog traps vs SNMP traps

Concerning the Syslog logging and SNMP traps, what is the difference.
I have seen that syslog is more for troubleshooting, but does syslog, when set to log "debugging", offer the same level of information that SNMP traps do?
For example, can you get real time config changes via syslog as you can with SNMP?
If so, why use both?

syslog will send whatever you can see on the CLI of the device at a maximum of a debug level as you say.
for SNMP traps related to configuration changes, you can use the mibs depending on the events you want to know about.
If we take for example the config traps, they are part of
CISCO-CONFIG-MAN-MIB. That mib can send traps with the following OIDs:
ftp://ftp.cisco.com/pub/mibs/oid/CISCO-CONFIG-MAN-MIB.oid
When you will go through that you will realize that the CONFIG mib and the syslog provide you with the same information: the CONFIG mib will not have more information than the syslog message.
If you use the snmp object navigator, you will find for every OID what the function is:
http://tools.cisco.com/Support/SNMP/do/BrowseOID.do?local=en
A good paper about what traps are part of which mib:
http://www.cisco.com/en/US/tech/tk648/tk362/technologies_tech_note09186a0080094a05.shtml
SNMP traps are a good way to gather information from the router without spiking the cpu with turning on CLI debug level. The CLI debug level is usually the most complete information you can get from a router anyways.

ACE and ANM, Syslog and SNMP Traps

Hi guys.. another ACE/ANM question.
I configured the ACE devices to send Syslog and SNMP messages to the ANM server. But i got a couple of questions:
Whats the difference between using the:
logging history 4 (this would send logging messages as SNMP traps according to doc)
And:
snmp-server host x.x.x.x traps version 2c public
snmp-server trap-source vlan 1000
This of course I think should do the same..
The funny and weird thing, in the ANM Event viewer, I can only see syslog messages, not one snmp event.
Thanks!
Omar
PS: ACE ver A2.4
ANM Ver 4.2

Hi Omar,
Let's see if I can clarify your questions.
As you mentioned, the "logging history 4" command specifies that, syslog messages of severity 4 and higher will be sent as SNMP traps. After you configure it, you need the "snmp-server host x.x.x.x traps version 2c public" command to specify what will be the destination IP and SNMP community for these traps.
It would only make sense to use the "logging history 4" command if your monitoring application doesn't support receiving syslog messages. However, since ANM is able to get syslog messages from the ACE without issues, I would just configure a destination for syslog message instead (with "logging host x.x.x.x")
I hope this makes this point more clear.
Now, moving on to why you are not seeing any SNMP traps in your ANM, the first things you would need to check are:
-- Did you enable traps? You would use the "ACE(config)# snmp-server enable traps" command for this
-- Are traps being sent? You can use the "show snmp" command and check if the "Trap PDUs" counter increases
-- Is ANM getting these traps? This is the most complicated step. For this, I would recommend getting a traffic capture on the ANM server (if it's installed on linux) or as close as possible to it if it's a ANM appliance
I hope this helps
Daniel

LMS 3.2 not forwarding SNMP Traps

I am using LMS 3.2 and under DFM... Notification Services... SNMP Trap Notification, I have a Subscription set up to forward Traps to Unicenter 11.1. I have tried a combination of sending Alerts and Events, Critical and Informational, Active and Cleared messages.
At this time I have it set to send:
Alerts Informational and Cleared
Events Critical and Informational, Active and Cleared.
Every Trap that is forwarded from LMS I get in the Unicenter console Twice. Also, I occasionally get a clear in Unicenter, but normally clears are not being forwaded.
Any ideas on this issue?
Thanks
-Scott

You should first install the consolidated DFM 3.2 patch from http://tools.cisco.com/support/downloads/go/ImageList.x?relVer=3.2.0&mdfid=282640771&sftType=CiscoWorks+Device+Fault+Manager+Patches&optPlat=Windows&nodecount=2&edesignator=null&modelName=CiscoWorks+Device+Fault+Manager+3.2&treeMdfId=268439477&treeName=Network+Management&modifmdfid=&imname=&hybrid=Y&imst=N&lr=Y (patch for CSCta56151). If the problem persists after that, post the NMSROOT/log/dfmLogs/NOS/nos.log after reproducing the problem with a new event/alert.

Generate SNMP Traps report from LMS database

Hi Experts,
Just wondering how LMS handle all SNMP traps received by LMS? Are the traps keep into a database on the server? Is there a way to extract them out as a report?
Regards,
Yi Shyuan

Hello,
Thank you for your answer, unfortunately this isn't what I was looking for.
My idea was to generate fake-positives traps to test efficiently our NMS station.
Traps that I would like to tests would be Temperature, Fan, Board.
I found that chaning the yellow level of the temp sensor to the lower threshold can provide some start point, but I would like to ensure when a real event arrives that my NMS will react accordingly.
Thanks

Snmp trap versus syslog message

Hi,
Most network devices will send snmp traps and syslog messages to a central server.
For analyzing purpose this server runs software to display the messages or traps.
My question is, what is the difference between syslog messages and snmp traps?
What is best practise?
Thank you very much.
Hansruedi

From the very basic level, traps and syslog differ in the encoding. Syslog messages are typically text messages sent within a UDP packet. There is a bit of binary encoding to indicate the syslog facility and severity. SNMP traps have encoded ASN.1 fields (called variable bindings). These varbinds are not ASCII text like syslog messages. Instead they are encoded object identifiers that can be translated into object names using MIB definitions.
More syslog messages exist than SNMP traps because syslog messages do not have as much governance associated with them. However, we typically recommend that customers enable both as there are some details available in traps that you may not get in syslog messages. Traps can also be processed in a more programmatic fashion because of the documentation that goes into the MIBs that define them.

LMS 4.0 SNMP Traps Forwarding

Hello,
I have installed a new version of CiscoWorks LMS 4.0.
I would like to forward certain SNMP traps to another server. Not all traps but only the traps of devices which are down.
Is it possible to filter the traps and then forward the traps who match the filter to a server?
Thanks,
Best Regards,
Joris

If you enable trap forwarding in LMS, all traps received by LMS will be forwarded to the external NMS.
You can, however, look at NMSROOT/objects/smarts/conf/trapd/trapd.conf. You can modify this file to specify exactly what traps to forward. The comments in the file should help you figure out the syntax. However, direct modification of this file is not supported by TAC, so be sure to save a backup just in case.

Syslog & SNMP Traps:- Does LMS 3.1 need to receive both?

Similar Messages

Maybe you are looking for