Syslog traps vs SNMP traps

Concerning the Syslog logging and SNMP traps, what is the difference.
I have seen that syslog is more for troubleshooting, but does syslog, when set to log "debugging", offer the same level of information that SNMP traps do?
For example, can you get real time config changes via syslog as you can with SNMP?
If so, why use both?

syslog will send whatever you can see on the CLI of the device at a maximum of a debug level as you say.
for SNMP traps related to configuration changes, you can use the mibs depending on the events you want to know about.
If we take for example the config traps, they are part of
CISCO-CONFIG-MAN-MIB. That mib can send traps with the following OIDs:
ftp://ftp.cisco.com/pub/mibs/oid/CISCO-CONFIG-MAN-MIB.oid
When you will go through that you will realize that the CONFIG mib and the syslog provide you with the same information: the CONFIG mib will not have more information than the syslog message.
If you use the snmp object navigator, you will find for every OID what the function is:
http://tools.cisco.com/Support/SNMP/do/BrowseOID.do?local=en
A good paper about what traps are part of which mib:
http://www.cisco.com/en/US/tech/tk648/tk362/technologies_tech_note09186a0080094a05.shtml
SNMP traps are a good way to gather information from the router without spiking the cpu with turning on CLI debug level. The CLI debug level is usually the most complete information you can get from a router anyways.

Similar Messages

Snmp trap versus syslog message

Hi,
Most network devices will send snmp traps and syslog messages to a central server.
For analyzing purpose this server runs software to display the messages or traps.
My question is, what is the difference between syslog messages and snmp traps?
What is best practise?
Thank you very much.
Hansruedi

From the very basic level, traps and syslog differ in the encoding. Syslog messages are typically text messages sent within a UDP packet. There is a bit of binary encoding to indicate the syslog facility and severity. SNMP traps have encoded ASN.1 fields (called variable bindings). These varbinds are not ASCII text like syslog messages. Instead they are encoded object identifiers that can be translated into object names using MIB definitions.
More syslog messages exist than SNMP traps because syslog messages do not have as much governance associated with them. However, we typically recommend that customers enable both as there are some details available in traps that you may not get in syslog messages. Traps can also be processed in a more programmatic fashion because of the documentation that goes into the MIBs that define them.

CCMS agents, alert monitoring, SNMP traps

Hi Guys,
I have a question. There is a requirement about monitoring. Any documenation or links will be really appreciated.
My client needs me to use CCMS agents, alert monitoring for both ABAP and JAVA stacks, SNMP traps, sending SNMP traps, interface CCMS with third party monitoring tools. Mostly, the ,monitoring is done thru RZ20.
Anybody can point me in right direction or material.
Thanks
Venky

Hi,
Check these CCMS Weblogs. Really good ones...
/people/federico.babelis2/blog/2006/04/26/ccms-rule-based-monitors-configuration-guide-for-dummies
/people/aravindh.prasanna/blog/2005/12/23/configuring-scenario-specific-e-mail-alerts-in-xi-ccms-part--1
/people/aravindh.prasanna/blog/2006/02/20/configuring-scenario-specific-e-mail-alerts-in-xi-ccms-part-3
Feel free to revert back.
--Ragu

ACE and ANM, Syslog and SNMP Traps

Hi guys.. another ACE/ANM question.
I configured the ACE devices to send Syslog and SNMP messages to the ANM server. But i got a couple of questions:
Whats the difference between using the:
logging history 4 (this would send logging messages as SNMP traps according to doc)
And:
snmp-server host x.x.x.x traps version 2c public
snmp-server trap-source vlan 1000
This of course I think should do the same..
The funny and weird thing, in the ANM Event viewer, I can only see syslog messages, not one snmp event.
Thanks!
Omar
PS: ACE ver A2.4
ANM Ver 4.2

Hi Omar,
Let's see if I can clarify your questions.
As you mentioned, the "logging history 4" command specifies that, syslog messages of severity 4 and higher will be sent as SNMP traps. After you configure it, you need the "snmp-server host x.x.x.x traps version 2c public" command to specify what will be the destination IP and SNMP community for these traps.
It would only make sense to use the "logging history 4" command if your monitoring application doesn't support receiving syslog messages. However, since ANM is able to get syslog messages from the ACE without issues, I would just configure a destination for syslog message instead (with "logging host x.x.x.x")
I hope this makes this point more clear.
Now, moving on to why you are not seeing any SNMP traps in your ANM, the first things you would need to check are:
-- Did you enable traps? You would use the "ACE(config)# snmp-server enable traps" command for this
-- Are traps being sent? You can use the "show snmp" command and check if the "Trap PDUs" counter increases
-- Is ANM getting these traps? This is the most complicated step. For this, I would recommend getting a traffic capture on the ANM server (if it's installed on linux) or as close as possible to it if it's a ANM appliance
I hope this helps
Daniel

Syslog equivalent to "snmp-server enable traps fru-ctrl"?

Does "[no] snmp-server enable traps fru-ctrl" toggle cefcMIBNotificationEnables of CISCO-ENTITY-FRU-CONTROL-MIB such that traps/notifications concerning cefcModuleOperStatus get generated?
Are there syslog equivalents to the traps/notifications above? If so, can anyone post a sample entry, so I know what it looks like and what keywords to search for?

It depends on the platform and IOS release. There is the %ENTITY_ALARM-6-INFO syslog which signifies an entity change. This would come closest to the cefcModuleStatusChange trap.
Generally speaking, card insert and removal operations, the OIR syslog messages are supported across platforms:
%OIR-6-INSCARD : Card is inserted
%OIR-6-REMCARD : Card is removed
Other platforms and card types may provide additional details if a module fails (e.g. %FECPM-1-INITFAIL for a NM module in a 2600/3600).

Syslog & SNMP Traps:- Does LMS 3.1 need to receive both?

Do my switches need to send both syslog and SNMP traps to LMS 3.1 or should I configure for either syslog or SNMP Traps, but not both?
Thanks
James

Well "needs to", no
Syslog
RME configuration management works better if it can detect config changes via syslog.
The syslog reports depend on it, so do the "automated actions" since they are based on syslog messages
Traps
Fault management can interpret a few traps but does most of its detecting via snmp get.
LMS will work without it but I think it is worthwhile to configure the devices to send traps and syslog.
Cheers,
Michel

SNMP traps from Cisco 4404

I have a Cisco 4404 WLC that sends its system logs to a syslog server (kiwicat), but I'm interested in getting the snmp traps sent over there as well. I've configured the syslog server to accept the snmp on the right ports and I've confirmed that the syslog server can receive then by sending traps manually from other devices.
I cannot seem to actually get the WLC to send the traps to the server. the syslog stuff gets through ok, but not the snmp. I've added the syslog server as an SNMP trap reciever and configured it as much as it needs to be and the only difference it seems to have made is to add more things to the main trap log on the 'monitor' tab on the WLC. Am i missing something really basic?
p.s. the WLC and the syslog server are separated by a firewall, but the syslog rules have been altered to also allow the snmp, should it attempt to go through.
Any help would be gratefully received.

Yes, I think the Network Devices need to be discovered first in order to receive traps and generate alerts.
Juke Chou
TechNet Community Support

Prime Infrastructure 2.1 - Fan-Failure SNMP-Trap Issue

Hello,
I am facing the following Prime Infrastructure (v2.1) issue:
- A Fan-Failure SNMP-Trap from a Cisco 3650 switch doesn't appear on Prime, but a Link-Failure from the same switch does.
- The both events appears on Prime with Syslog.
- The command "snmp-server enable traps envmon fan shutdown supply temperature status" is set up.
- The switch is in "Managed" state in PI, I have checked the ACL at the "snmp-server community" command, it is okay.
- I have set up an SNMP-Trace for the switch on PI, but only "SNMP Null was returned for class com.cisco.server.managedobjects.bridge.Fan3KStats attribute fanIndex" arrived. Please find the log below.
07/02/14 12:39:53.211 TRACE [presence-9] [] Adding attributes for object Fan3KStats[151206060_,1012]
07/02/14 12:39:53.211 TRACE [presence-9] [] Index name : fanIndex
07/02/14 12:39:53.211 TRACE [presence-9] [] Index Value : 1012
07/02/14 12:39:53.211 TRACE [presence-9] [] Device MIB table index: .1012
07/02/14 12:39:53.211 TRACE [presence-9] [] MIB table row index: .1012
07/02/14 12:39:53.211 TRACE [presence-9] []     OID for : fanIndex = 1.3.6.1.2.1.47.1.1.1.1.1.1012
07/02/14 12:39:53.211 TRACE [presence-9] []     OID for : fanOperStatus = 1.3.6.1.4.1.9.9.13.1.4.1.3.1012
07/02/14 12:39:53.211 TRACE [presence-9] [] Get fragment
07/02/14 12:39:53.211 TRACE [presence-9] [] Creating PDU: Get
07/02/14 12:39:53.211 TRACE [presence-9] []     VarBind OID=1.3.6.1.2.1.47.1.1.1.1.1.1010
07/02/14 12:39:53.211 TRACE [presence-9] []     VarBind OID=1.3.6.1.4.1.9.9.13.1.4.1.3.1010
07/02/14 12:39:53.211 TRACE [presence-9] []     VarBind OID=1.3.6.1.2.1.47.1.1.1.1.1.1011
07/02/14 12:39:53.211 TRACE [presence-9] []     VarBind OID=1.3.6.1.4.1.9.9.13.1.4.1.3.1011
07/02/14 12:39:53.211 TRACE [presence-9] []     VarBind OID=1.3.6.1.2.1.47.1.1.1.1.1.1012
07/02/14 12:39:53.211 TRACE [presence-9] []     VarBind OID=1.3.6.1.4.1.9.9.13.1.4.1.3.1012
07/02/14 12:39:53.218 TRACE [presence-9] [] Error Status: 0
07/02/14 12:39:53.218 TRACE [presence-9] [] Error index: 0
07/02/14 12:39:53.218 TRACE [presence-9] [] SNMP Null was returned for class com.cisco.server.managedobjects.bridge.Fan3KStats attribute fanIndex
07/02/14 12:39:53.218 TRACE [presence-9] []     Setting attribute: fanOperStatus
07/02/14 12:39:53.218 TRACE [presence-9] []     SnmpInt Value : ?
07/02/14 12:39:53.218 TRACE [presence-9] [] GetMultiAttributes, storing result, class=com.cisco.server.managedobjects.bridge.Fan3KStats, attr=fanOperStatus
07/02/14 12:39:53.218 TRACE [presence-9] [] SNMP Null was returned for class com.cisco.server.managedobjects.bridge.Fan3KStats attribute fanIndex
07/02/14 12:39:53.218 TRACE [presence-9] []     Setting attribute: fanOperStatus
07/02/14 12:39:53.218 TRACE [presence-9] []     SnmpInt Value : ?
07/02/14 12:39:53.218 TRACE [presence-9] [] GetMultiAttributes, storing result, class=com.cisco.server.managedobjects.bridge.Fan3KStats, attr=fanOperStatus
07/02/14 12:39:53.218 TRACE [presence-9] [] SNMP Null was returned for class com.cisco.server.managedobjects.bridge.Fan3KStats attribute fanIndex
07/02/14 12:39:53.218 TRACE [presence-9] []     Setting attribute: fanOperStatus
07/02/14 12:39:53.218 TRACE [presence-9] []     SnmpInt Value : ?
07/02/14 12:39:53.218 TRACE [presence-9] [] GetMultiAttributes, storing result, class=com.cisco.server.managedobjects.bridge.Fan3KStats, attr=fanOperStatus
07/02/14 12:39:53.218 TRACE [presence-9] [] GetMultiAttributes, assembling attributes
07/02/14 12:39:53.218 TRACE [presence-9] []     MIB lookup, OID for: powerSupplyIndex = 1.3.6.1.2.1.47.1.1.1.1.1
07/02/14 12:39:53.218 TRACE [presence-9] []     GetMultiAttributes needs class=com.cisco.server.managedobjects.bridge.PowerSupply3kStats, field=powerSupplyIndex
07/02/14 12:39:53.218 TRACE [presence-9] []     MIB lookup, OID for: powerSupplyOperStatus = 1.3.6.1.4.1.9.9.13.1.5.1.3
07/02/14 12:39:53.218 TRACE [presence-9] []     GetMultiAttributes needs class=com.cisco.server.managedobjects.bridge.PowerSupply3kStats, field=powerSupplyOperStatus
07/02/14 12:39:53.218 TRACE [presence-9] [] GetMultiAttributes invoked
07/02/14 12:39:53.218 TRACE [presence-9] [] GetMultiAttributes building OIDs for next PDU
07/02/14 12:39:53.218 TRACE [presence-9] [] Adding attributes for object PowerSupply3kStats[151206060_,1009]
- The switch sends the SNMP Trap, based on the followings:
Jul 7 13:38:30 UTC: SNMP: Packet sent via UDP to IP_ADDRESS
Jul 7 13:38:30 UTC: %PLATFORM_THERMAL-6-FRU_FAN_OIR: Switch 1: System fan 1 removed
Jul 7 13:38:30 UTC: %PLATFORM_THERMAL-1-FRU_FAN_NOT_PRESENT: Switch 1: System fan 1 not present
Jul 7 13:38:30 UTC: SNMP: Queuing packet to IP_ADDRESS
Jul 7 13:38:30 UTC: SNMP: V2 Trap, reqid 33202, errstat 0, erridx 0
sysUpTime.0 = 576753333
snmpTrapOID.0 = ciscoEnvMonMIBNotifications.8
ciscoEnvMonFanStatusEntry.2.1010 = Switch 1 - FAN 1, NotExist
ciscoEnvMonFanStatusEntry.3.1010 = 5
Jul 7 13:38:30 UTC: SNMP: Queuing packet to IP_ADDRESS
Jul 7 13:38:30 UTC: SNMP: V2 Trap, reqid 33203, errstat 0, erridx 0
sysUpTime.0 = 576753333
snmpTrapOID.0 = ciscoEnvMonMIBNotifications.8
ciscoEnvMonFanStatusEntry.2.1010 = Switch 1 - FAN 1, NotExist
ciscoEnvMonFanStatusEntry.3.1010 = 5
Jul 7 13:38:30 UTC: SNMP: Queuing packet to IP_ADDRESS
Jul 7 13:38:30 UTC: SNMP: V2 Trap, reqid 33204, errstat 0, erridx 0
sysUpTime.0 = 576753333
snmpTrapOID.0 = ciscoEnvMonMIBNotifications.8
ciscoEnvMonFanStatusEntry.2.1010 = Switch 1 - FAN 1, NotExist
ciscoEnvMonFanStatusEntry.3.1010 = 5
Jul 7 13:38:30 UTC: SNMP: Queuing packet to IP_ADDRESS
Jul 7 13:38:30 UTC: SNMP: V2 Trap, reqid 33205, errstat 0, erridx 0
sysUpTime.0 = 576753333
snmpTrapOID.0 = ciscoEnvMonMIBNotifications.8
ciscoEnvMonFanStatusEntry.2.1010 = Switch 1 - FAN 1, NotExist
ciscoEnvMonFanStatusEntry.3.1010 = 5
Jul 7 13:38:31 UTC: SNMP: Packet sent via UDP to IP_ADDRESS
Jul 7 13:38:31 UTC: SNMP: Packet sent via UDP to IP_ADDRESS
Jul 7 13:38:31 UTC: SNMP: Packet sent via UDP to IP_ADDRESS
Jul 7 13:38:31 UTC: SNMP: Packet sent via UDP to IP_ADDRESS
Jul 7 13:38:45 UTC: SNMP: Packet sent via UDP to IP_ADDRESS
Jul 7 13:38:51 UTC: %PLATFORM_THERMAL-6-FRU_FAN_OIR: Switch 1: System fan 1 inserted
Jul 7 13:38:54 UTC: SNMP: Queuing packet to IP_ADDRESS
Jul 7 13:38:54 UTC: SNMP: V2 Trap, reqid 33206, errstat 0, erridx 0
sysUpTime.0 = 576755733
snmpTrapOID.0 = ciscoEnvMonMIBNotifications.8
ciscoEnvMonFanStatusEntry.2.1010 = Switch 1 - FAN 1, Normal
ciscoEnvMonFanStatusEntry.3.1010 = 1
Jul 7 13:38:54 UTC: SNMP: Queuing packet to IP_ADDRESS
Jul 7 13:38:54 UTC: SNMP: V2 Trap, reqid 33207, errstat 0, erridx 0
sysUpTime.0 = 576755733
snmpTrapOID.0 = ciscoEnvMonMIBNotifications.8
ciscoEnvMonFanStatusEntry.2.1010 = Switch 1 - FAN 1, Normal
ciscoEnvMonFanStatusEntry.3.1010 = 1
Jul 7 13:38:54 UTC: SNMP: Queuing packet to IP_ADDRESS
Jul 7 13:38:54 UTC: SNMP: V2 Trap, reqid 33208, errstat 0, erridx 0
sysUpTime.0 = 576755733
snmpTrapOID.0 = ciscoEnvMonMIBNotifications.8
ciscoEnvMonFanStatusEntry.2.1010 = Switch 1 - FAN 1, Normal
ciscoEnvMonFanStatusEntry.3.1010 = 1
Jul 7 13:38:54 UTC: SNMP: Queuing packet to IP_ADDRESS
Jul 7 13:38:54 UTC: SNMP: V2 Trap, reqid 33209, errstat 0, erridx 0
sysUpTime.0 = 576755733
snmpTrapOID.0 = ciscoEnvMonMIBNotifications.8
ciscoEnvMonFanStatusEntry.2.1010 = Switch 1 - FAN 1, Normal
ciscoEnvMonFanStatusEntry.3.1010 = 1
Jul 7 13:38:55 UTC: SNMP: Packet sent via UDP to IP_ADDRESS
Jul 7 13:38:55 UTC: SNMP: Packet sent via UDP to IP_ADDRESS
Jul 7 13:38:55 UTC: SNMP: Packet sent via UDP to IP_ADDRESS
Jul 7 13:38:55 UTC: SNMP: Packet sent via UDP to IP_ADDRESS
It seems like PI and the switch doesn't understand each other concerning the fan...
Thanks for any ideas, comments and feedbacks,
Csaba

I have the very same problem.
The switch has a power supply error (one of the two is down). There is the syslog message in PI about it, but no event has created, so nor alarm is there as well.
When I check the status of the switch in the Device Work Center, and choose the Environment in Device Details I can see that PI has not realized the power supply error.
However when I click on the Sync for this very device the power supply status is updated, but still no event or alarm.
This is the case with the FANs as well.

Cisco Prime Infrastructure 1.4 SNMP Traps are not converted into Alarms

Hi everybody,
I just configured SNMP Traps on a Cisco Catalyst 3750-x to send to our Cisco Prime Infrastructure 1.4 Appliance.
Now I forced the Switch to send some traps (Power off a Power Supply, Interface errdisable). The only events I see in Alarms & Events on PI is the same information message everytime:
Configuration management event has been recorded in ccmHistoryEventTable.
I think the forced traps should be converted into alarms? Why can't I see them?
Thanks,
Marc

Ok, I started debugging as you said. I get the following output:
Mar 13 09:28:13.711: SNMP: V2 Trap, reqid 11689, errstat 0, erridx 0
sysUpTime.0 = 198609846
snmpTrapOID.0 = ciscoSyslogMIB.2.0.1
clogHistoryEntry.2.1688 = PM
clogHistoryEntry.3.1688 = 5
clogHistoryEntry.4.1688 = ERR_RECOVER
clogHistoryEntry.5.1688 = Attempting to recover from bpduguard err-disable state on Gi1/0/13
clogHistoryEntry.6.1688 = 198609844
Mar 13 09:28:13.737: SNMP: Queuing packet to xx.xx.xx.xx
Looks like the Switch is sending SNMP Traps from the ciscoSyslogMIB. Is this why PI can't show the Traps and convert it into a alarm?
After this test I configured logging (syslog) to the PI. Now the errors are showed but still not converted into alarms. I just want to be notified by email when such errors occurs.
Thanks,
Marc

Cisco WLC 5508 not sending SNMP Traps

Hello Everyone.
I'm having a weird error on our WLC environment. We have an HA with two cisco WLC 5508 and i cannot get SNMP Traps working on a Windows PC running Kiwi Syslog server (free ed.).
I can receive correctly Syslog messages, but not traps.
I Tried also to send SNMP Traps from WLC to a different PC using Linux with snmptrapd and it works fine.
I tried then to send from my Linux box a snmp trap to my Windows PC, and it works fine, but i still cannot receive anything from WLC.
Using Wireshark to detect traffic, i cannot see any packet on udp port 162.
I cannot figure out any problem with my scenario, but i can see the following errors on syslog:
*rmgrTrasport: Mar 30 16:08:22.602: #RMGR-3-INVALID_PING_RESPONSE: rmgr_utils.c:270 Ping response from <my_windows_PC> is invalid. Ip address do not match.
My WLC Version is 7.6.130.0
Thank you for your support.

I have gone through your query and found the following fruitful links ,please let me know if it helps and mark it correct answer if it is.
https://www.manageengine.com/network-monitoring/help/userguide/processing_traps.html
https://rscciew.wordpress.com/2014/10/12/snmp-configuration-on-wlc/
Thanks :)

I can not make IP SLA to signal SNMP traps upon timeout

Hello team.
I want SNMP traps to be sent every time an IP SLA (ICMP) object times out. For that purpose, I carried out the following
ip sla monitor logging traps
ip sla monitor 1
type echo protocol ipIcmpEcho 10.1.1.254
timeout 1000
frequency 15
ip sla monitor schedule 1 life forever start-time now
snmp-server enable traps rtr
snmp-server host 10.1.1.10 mycommunity
But no SNMP trap is sent when the IP SLA object times out. ¿ Am I missing something?
Any help will be greatly appreciated.
Rogelio Alvez
Argentina

SNMP traps for IP SLAs are handled through the system logging (syslog) process. This means that system logging messages for IP SLAs violations are generated when the specified conditions are met, then sent as SNMP traps using the CISCO-SYSLOG-MIB. The ip sla monitor logging traps command is used to enable the generation of these IP SLAs specific traps. The generation of IP SLAs specific logging messages is dependant on the configuration of the standard set of logging commands (for example, logging on). IP SLAs logging messages are generated at the "informational" system logging severity level.
The command ip sla monitor logging traps is sometime hidden and may not show with ?, so just copy and paste in global config mode and have logging on and check if any traps are generated.
-Thanks
Vinod
**Encourage Contributors. RATE them**

IP SLA SNMP trap: ¿any way to include a meaningful message in it?

Hello team:
I managed my router to generate a SNMP trap when one IP SLA object detects a trigger condition.
I would like this SNMP trap (or the associated SYSLOG message) to have a meaningful, easy to identify message (ex: SERVER NOT REACHABLE).
¿is there any way to accomplish this?
Hints will be greatly appreciated
Best regards
Rogelio Alvez
Argentina

Try changing
ip sla reaction-configuration 500 react timeout action-type trapOnly
to
ip sla reaction-configuration 500 react timeout threshold-type immediate action-type trapOnly
and post "show ip sla reaction configuration".

Generating RMON SNMP Traps

I am trying to generate SNMP traps from RMON events but they won't work. I have the following test configuration:
snmp-server host 10.1.1.1 version 2c TEST
snmp-server enable traps
rmon event 1 log trap PUBLIC description "TEST TEST TEST" owner config
rmon alarm 1 ifOutUcastPkts.6 5 delta rising-threshold 100 1 falling-threshold 50 1 owner config
When I enable 'debug snmp packet' I see don't see any packets being generated. I do see %RMON-5 syslog messages but I don't see any "TEST TEST TEST" messages in the console, although I do see them here:
show rmon events
Event 1 is active, owned by config
Description is TEST TEST TEST
Event firing causes log and trap to community PUBLIC,
last event fired at 0y0w0d,01:03:09,
Current uptime       0y0w0d,01:05:58
Current log entries:
index uptime              description
1      0y0w0d,01:02:59     TEST TEST TEST
2      0y0w0d,01:03:04     TEST TEST TEST
3      0y0w0d,01:03:09     TEST TEST TEST
Am I missing something? Thanks

Your RMON event community is PUBLIC, but your trap host is using community TEST. Set these two so that they agree. You will not see
the description on the console. You will only see that a rising or falling condition has occurred.
If you want more flexibility on these syslogs or traps, consider using EEM instead of RMON.

Cisco Prime SNMP Traps Best Pratice

The Cisco Prime documentation recommends configuring switches to send SNMP traps. However it does not give any more details.
I was wondering what sorts of SNMP traps people in the community are using with Cisco Prime 2.1. I'm looking for some sort of best practice or for an idea of what traps would be the most useful to configure on the switches, to send to Prime.

Hi ,
Snmp traps need to be configured only on device end , there is no config need to be done on PI.
you can enable all the traps that you want. for e.g
snmp-server enable traps syslog
snmp-server enable traps ipsec start stop
snmp-server enable traps memory-threshold
snmp-server enable traps interface-threshold
snmp-server enable traps connection-limit-reached
snmp-server enable traps cpu threshold rising
etc......
and you can monitor then in PI (Administration > System Settings > Severity Configuration, Link down)
check the below link as well:
https://supportforums.cisco.com/discussion/11919481/prime-infrastructure-20-link-status-alarms
Thanks-
Afroz
***Ratings Encourages Contributors ***

SNMP TRAPS and SLA

HI
I am trying to configure IP SLA to send SNMP TRAPS but looks like doing some mistake ..
i have following configured
/* Style Definitions */
table.MsoNormalTable
{mso-style-name:"Table Normal";
mso-tstyle-rowband-size:0;
mso-tstyle-colband-size:0;
mso-style-noshow:yes;
mso-style-parent:"";
mso-padding-alt:0cm 5.4pt 0cm 5.4pt;
mso-para-margin:0cm;
mso-para-margin-bottom:.0001pt;
mso-pagination:widow-orphan;
font-size:12.0pt;
font-family:"Times New Roman";
mso-ascii-font-family:Cambria;
mso-ascii-theme-font:minor-latin;
mso-fareast-font-family:"Times New Roman";
mso-fareast-theme-font:minor-fareast;
mso-hansi-font-family:Cambria;
mso-hansi-theme-font:minor-latin;}
ip sla monitor 2
type echo protocol ipIcmpEcho 150.1.3.3 source-ipaddr 1.1.98.7
frequency 10!
ip sla monitor schedule 2 start-time now recurring
/* Style Definitions */
table.MsoNormalTable
{mso-style-name:"Table Normal";
mso-tstyle-rowband-size:0;
mso-tstyle-colband-size:0;
mso-style-noshow:yes;
mso-style-parent:"";
mso-padding-alt:0cm 5.4pt 0cm 5.4pt;
mso-para-margin:0cm;
mso-para-margin-bottom:.0001pt;
mso-pagination:widow-orphan;
font-size:12.0pt;
font-family:"Times New Roman";
mso-ascii-font-family:Cambria;
mso-ascii-theme-font:minor-latin;
mso-fareast-font-family:"Times New Roman";
mso-fareast-theme-font:minor-fareast;
mso-hansi-font-family:Cambria;
mso-hansi-theme-font:minor-latin;}
ip sla reaction-configuration 2 react rtt threshold-type immediate action-type trapOnly
ip sla logging traps
/* Style Definitions */
table.MsoNormalTable
{mso-style-name:"Table Normal";
mso-tstyle-rowband-size:0;
mso-tstyle-colband-size:0;
mso-style-noshow:yes;
mso-style-parent:"";
mso-padding-alt:0cm 5.4pt 0cm 5.4pt;
mso-para-margin:0cm;
mso-para-margin-bottom:.0001pt;
mso-pagination:widow-orphan;
font-size:12.0pt;
font-family:"Times New Roman";
mso-ascii-font-family:Cambria;
mso-ascii-theme-font:minor-latin;
mso-fareast-font-family:"Times New Roman";
mso-fareast-theme-font:minor-fareast;
mso-hansi-font-family:Cambria;
mso-hansi-theme-font:minor-latin;}
snmp-server community public RO
snmp-server enable traps rtr
snmp-server host 1.1.128.226 public
1.1.98.7 is the loopback ip on my network. To test the snmp traps, i enabled debug snmp packets and shutdown loopback interface (1.1.98.7)
I don't see any snmp message in debug output ..
am i missing something or it is not possible to get traps directly from ip sla .. do i need EEM for this?

sorry, it actually worked .. i just gave a restart to ip sla and it worked.
looks like router was already in threshold stage when i was activating reaction-config ..
but i am still confused which command is actualluy generating these traps since i have taken out some of the snmp config out and i stil get traps ..
below is the oputput of traps which i get when i restart ip sla .
*Feb 15 17:10:43.453: SNMP: 150.150.1.1 queue overflow, dropping packet
*Feb 15 17:10:43.453: SNMP: Queuing packet to 150.150.1.1
*Feb 15 17:10:43.453: SNMP: V1 Trap, ent rttMonNotificationsPrefix, addr 65.65.2.2, gentrap 6, spectrap 3
rttMonCtrlAdminTag.1 =
rttMonHistoryCollectionAddress.1 = 41 41 03 03
rttMonCtrlOperOverThresholdOccurred.1 = 1
*Feb 15 17:10:43.497: SNMP: 150.150.1.1 queue overflow, dropping packet
*Feb 15 17:10:43.501: SNMP: Queuing packet to 150.150.1.1
*Feb 15 17:10:43.501: SNMP: V1 Trap, ent rttMonNotificationsPrefix, addr 65.65.2.2, gentrap 6, spectrap 5
rttMonCtrlAdminTag.1 =
rttMonHistoryCollectionAddress.1 = 41 41 03 03
rttMonReactVar.1 = 1
rttMonReactOccurred.1 = 1
rttMonReactValue.1 = 12
rttMonReactThresholdRising.1 = 5
rttMonReactThresholdFalling.1 = 1
rttMonEchoAdminLSPSelector.1 = 00 00 00 00
*Feb 15 17:10:43.585: SNMP: 150.150.1.1 queue overflow, dropping packet
*Feb 15 17:10:43.585: SNMP: Queuing packet to 150.150.1.1
*Feb 15 17:10:43.585: SNMP: V1 Trap, ent rttMonNotificationsPrefix, addr 65.65.2.2, gentrap 6, spectrap 5
rttMonCtrlAdminTag.1 =
rttMonHistoryCollectionAddress.1 = 41 41 03 03
rttMonReactVar.1 = 1
rttMonReactOccurred.1 = 1
rttMonReactValue.1 = 12
rttMonReactThresholdRising.1 = 5
rttMonReactThresholdFalling.1 = 1
rttMonEchoAdminLSPSelector.1 = 00 00 00 00
below is my running config and sh ver
R2#sh ver
Cisco IOS Software, 2800 Software (C2800NM-ADVENTERPRISEK9-M), Version 12.4(24)T1, RELEASE SOFTWARE (fc3)
Technical Support: http://www.cisco.com/techsupport
Copyright (c) 1986-2009 by Cisco Systems, Inc.
Compiled Fri 19-Jun-09 15:13 by prod_rel_team
ROM: System Bootstrap, Version 12.4(1r) [hqluong 1r], RELEASE SOFTWARE (fc1)
R2 uptime is 8 hours, 9 minutes
System returned to ROM by power-on
System image file is "flash:c2800nm-adventerprisek9-mz.124-24.T1.bin"
This product contains cryptographic features and is subject to United
States and local country laws governing import, export, transfer and
use. Delivery of Cisco cryptographic products does not imply
third-party authority to import, export, distribute or use encryption.
Importers, exporters, distributors and users are responsible for
compliance with U.S. and local country laws. By using this product you
agree to comply with applicable laws and regulations. If you are unable
to comply with U.S. and local laws, return this product immediately.
A summary of U.S. laws governing Cisco cryptographic products may be found at:
http://www.cisco.com/wwl/export/crypto/tool/stqrg.html
If you require further assistance please contact us by sending email to
[email protected].
Cisco 2811 (revision 53.50) with 237568K/24576K bytes of memory.
Processor board ID FTX0952C333
2 FastEthernet interfaces
4 Serial(sync/async) interfaces
1 Virtual Private Network (VPN) Module
DRAM configuration is 64 bits wide with parity enabled.
239K bytes of non-volatile configuration memory.
62720K bytes of ATA CompactFlash (Read/Write)
Configuration register is 0x2102
R2#
R2#sh run
Building configuration...
Current configuration : 2233 bytes
version 12.4
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
hostname R2
boot-start-marker
boot-end-marker
no aaa new-model
memory-size iomem 10
dot11 syslog
ip source-route
ip cef
ipv6 unicast-routing
ipv6 cef
multilink bundle-name authenticated
voice-card 0
vtp domain 29
vtp mode transparent
archive
log config
hidekeys
interface Loopback0
ip address 65.65.2.2 255.255.255.0
interface FastEthernet0/0
shutdown
duplex auto
speed auto
interface FastEthernet0/1
ip address 65.65.128.193 255.255.255.224
shutdown
duplex auto
speed auto
interface Serial0/2/0
ip address 65.65.13.2 255.255.255.224
encapsulation ppp
clock rate 2000000
interface Serial0/3/0
no ip address
shutdown
router ospf 65
router-id 65.65.2.2
log-adjacency-changes
network 65.65.2.2 0.0.0.0 area 1
network 65.65.13.2 0.0.0.0 area 1
network 65.65.128.193 0.0.0.0 area 1
ip forward-protocol nd
no ip http server
no ip http secure-server
ip sla 1
icmp-echo 65.65.3.3 source-ip 65.65.2.2
request-data-size 1500
frequency 10
ip sla schedule 1 life forever start-time now
ip sla reaction-configuration 1 react rtt threshold-value 5 1 threshold-type immediate action-type trapOnly
snmp-server community public RO
snmp-server host 150.150.1.1 public
control-plane
mgcp fax t38 ecm
mgcp behavior g729-variants static-pt
line con 0
line aux 0
line vty 0 4
login
scheduler allocate 20000 1000
end
R2#
R2#

Syslog traps vs SNMP traps

Similar Messages

Maybe you are looking for