TimesTen SNMP traps

Hello,
I have TT over Windows 32 bit (stand alone).
I'm trying to configure SNMP traps in order to maintain Alerts for the TimesTen database.
I've followed the doc *"Oracle Times Ten In-Memory Database Error Messages and SNMP Traps"*,
and comfigured the snmp.ini file.
However, when I'm trying to use the utility snmptrapd.exe in order to start listening to the snmp traps and doing my tests, I'm getting an error: snmptrapd.exe is not a valid Win32 application, and in the CMD window I also see *"Access is denied"* error.
My user in the Administrators group.
Why do I receive the error and how can I overcome it ?
Thanks in advance,
Roni.

Hi Roni,
Getting this executable working independently of TimesTen is the first thing to look at.
- Where did you get the snmptrapd.exe executable from?
- Make sure that you get this executable from a known reputable source.
There are viruses out there that use this name.
- The MKS version of this utility is supported on Windows 2000, Windows XP, Windows Server 2003 and Vista.
- Make sure that you have the correct version of the executable for your Windows platform.
Doug

Similar Messages

Questions on Receiving SNMP Traps

Hi:
- I have more questions on receiving SNMP traps:
1) the OEM plug-in can receive traps now, but when I click the metric, I see:
Error getting data for target test20. Exception: ORA-20216: ORA-06512: at "SYSMAN.EMD_MNTR", line 817 ORA-01403: no data found ORA-06512: at line 1
- the push descriptor looks like:
<PushDescriptor RECVLET_ID="SNMPTrap">
<Property NAME="MatchEnterprise" SCOPE="GLOBAL">...</Property>
<Property NAME="MatchGenericTrap" SCOPE="GLOBAL">6</Property> <Property NAME="MatchSpecificTrap" SCOPE="GLOBAL">31</Property> <Property NAME="MatchAgentAddr" SCOPE="INSTANCE">target_ip</Property>
<Property NAME="EventsnChasFanIndexOID" SCOPE="GLOBAL">...</Property>
<Property NAME="ContextsnChasFanDescriptionOID" SCOPE="GLOBAL">...</Property>
<Property NAME="SeverityCode" SCOPE="GLOBAL">WARNING</Property>
</PushDescriptor>
- is the Key Property needed ?
2) The alerts for some reason do not filter back to the all targets home page.
- When I click the Home tab and goto to the 'All Targets' pane, I do not see the alert generated by the OEM plug-in.
- What I am doing wrong ?
3) Is it okay to receive traps with the metric usage set to either: HIDDEN or HIDDEN_COLLECT ?
- Does this cause the errors I see in Q 1) ?
Thanks
John
Edited by: user8826739 on Feb 23, 2010 7:05 AM

Hi John,
Can you post the full definition of the metric? You would need to use the Key property for each key column in the metric description.
With the SNMP receivelet you can set up definitons for data points or alerts. I would assume (as I've never tried this ;) that if you set up the definition to be a data point, you would see data from the All Metrics page. To me, it wouldn't make sense for a metric that used the PushDescriptor SNMPTrap to have data to be viewed as the result of the SNMP trap coming is would be an alert. I will have to look into that. My gut reaction is that a metric with PushDescriptor SNMPTrap shouldn't even appear on the All Metrics page ...
To be clear are you saying that you don't see the Warning number under "All Targets Alerts" increase by 1 when you SNMP trap is caught and alert is generated? When this occurs do you see the alert on the target instance homepage?
In regards to HIDDEN and HIDDEN_COLLECT, I don't know what effect they would have on a metric defined for an SNMP trap to raise an alert. You definitely wouldn't want to use HIDDEN as this setting is for temporary metrics that are used in the caclulation of other metrics. HIDDEN metrics are not collected (or hence uploaded to the OMS) and don't appear in the UI. HIDDEN_COLLECT are collected, but do not show up in the UI and are not uploaded. I've never used this settings with SNMP trap metrics that are for alerts. If your metrics for the SNMP trap alerts do show up on the All Metrics page (I'd have to get something set up to look at this), then it could make sense to use the HIDDEN_COLLECT as the alert would still be generated, but the metric itself wouldn't be shown in the UI.
Let me find out the expected behavior from someone on the agent team.
Dave

What is the minimum server layer OEM version supports SNMP trap reception ?

Hi:
- I have been trying to enable SNMP trap reception on an OEM plug-in.
- I turned on debug channel for recvlets.snmp and saw:
2009-10-16 16:07:42,808 Thread-3028552624 ERROR recvlets.snmp: Duplicate threshold : test900, oracle_guide, interfaces, status
and
2009-10-16 16:09:08,382 Thread-3021634480 INFO recvlets.snmp: Trap received is to convert Data Point
2009-10-16 16:09:08,379 Thread-3021634480 INFO recvlets.snmp: Sending Data Point ...
2009-10-16 16:09:08,379 Thread-3021634480 INFO recvlets.snmp: Listening for TRAP
So, it looks like the OEM agent can receive traps but no data point or alert appears.
And, the agent always issues an error about duplicate thresholds.
- Does the agent have to be patched ?
My agent is:
Oracle Enterprise Manager 10g Release 5 Grid Control 10.2.0.5.0.
Copyright (c) 1996, 2009 Oracle Corporation. All rights reserved.
Agent Version : 10.2.0.5.0
OMS Version : 10.2.0.1.0
Protocol Version : 10.2.0.0.0
Agent is Running and Ready
- on the server layer, the oms is:
Oracle Enterprise Manager 10g Release 10.2.0.1.0
Copyright (c) 1996, 2005 Oracle Corporation. All rights reserved.
Oracle Management Server is Up.
Is a patch needed for OMS ?
Should OMS be version 10.2.0.5.0 ?
Thanks
John
Edited by: user8826739 on Feb 23, 2010 7:17 AM

10.2.0.5 should be fine ...
Dave

Creating SNMP Trap Monitors in 2012 R2

Hello,
For the past week or so I have been attempting to create a MP for my company's UPSs to be monitored in SCOM 2012 R2. I have created a custom MP with custom datasources and objects. All seems to go according to the plan until I attempt to create a SNMP
Trap monitor for those objects. I am able to verify that the device is discovered and is sending the traps successfully with a view. The problem seems to lie within the setup of the monitor. I have followed the steps as much as I can from this page http://technet.microsoft.com/en-us/library/hh563870.aspx
to create a monitor that will be triggered by an incoming trap saying the UPS is on Battery Power.
This is the initial or trigger event information received by SCOM:
<EventData>
<DataItem type="System.SnmpData" time="2014-07-03T08:48:07.6990732-07:00" sourceHealthServiceId="26DF02E5-DEA0-BED0-443B-3605A05D4790">
<Source>10.51.85.40</Source>
<Destination>127.0.0.1</Destination>
<ErrorCode>1</ErrorCode>
<Version>1</Version>
<SnmpVarBinds>
<SnmpVarBind>
<OID>.1.3.6.1.2.1.1.3.0</OID>
<Syntax>67</Syntax>
<Value VariantType="19">17567220</Value>
</SnmpVarBind>
<SnmpVarBind>
<OID>.1.3.6.1.6.3.1.1.4.1.0</OID>
<Syntax>6</Syntax>
<Value VariantType="8">.1.3.6.1.4.1.318.0.5</Value>
</SnmpVarBind>
<SnmpVarBind>
<OID>.1.3.6.1.4.1.318.2.3.3.0</OID>
<Syntax>4</Syntax>
<Value VariantType="8">UPS: On battery power in response to an input power problem.</Value>
</SnmpVarBind>
<SnmpVarBind>
<OID>.1.3.6.1.6.3.1.1.4.3.0</OID>
<Syntax>6</Syntax>
<Value VariantType="8">.1.3.6.1.4.1.318</Value>
</SnmpVarBind>
</SnmpVarBinds>
</DataItem>
</EventData>
This is the event should signal that everything is operating normally once again.
<EventData>
<DataItem type="System.SnmpData" time="2014-07-03T08:48:12.9133769-07:00" sourceHealthServiceId="26DF02E5-DEA0-BED0-443B-3605A05D4790"><Source>10.51.85.40</Source>
<Destination>127.0.0.1</Destination>
<ErrorCode>1</ErrorCode>
<Version>1</Version>
<SnmpVarBinds>
<SnmpVarBind>
<OID>.1.3.6.1.2.1.1.3.0</OID>
<Syntax>67</Syntax>
<Value VariantType="19">17567730</Value>
</SnmpVarBind>
<SnmpVarBind>
<OID>.1.3.6.1.6.3.1.1.4.1.0</OID>
<Syntax>6</Syntax>
<Value VariantType="8">.1.3.6.1.4.1.318.0.9</Value>
</SnmpVarBind>
<SnmpVarBind>
<OID>.1.3.6.1.4.1.318.2.3.3.0</OID>
<Syntax>4</Syntax>
<Value VariantType="8">UPS: No longer on battery power.</Value>
</SnmpVarBind>
<SnmpVarBind>
<OID>.1.3.6.1.6.3.1.1.4.3.0</OID>
<Syntax>6</Syntax>
<Value VariantType="8">.1.3.6.1.4.1.318</Value>
</SnmpVarBind>
</SnmpVarBinds>
</DataItem>
</EventData>
You may notice that these traps are being sent as SNMP v1. I am unable to change that on the UPS so i have modified the monitors to account for that. Here is the code for the monitor:
<UnitMonitor ID="UIGeneratedMonitorc2c65f3c85fe42f48ce8d2580c57bbae" Accessibility="Public" Enabled="true" Target="APC.MP.UPS" ParentMonitorID="Health!System.Health.AvailabilityState" Remotable="true" Priority="Normal" TypeID="SNL!System.NetworkManagement.SnmpTrapProvider.2SingleEvent2StateMonitorType" ConfirmDelivery="false">
<Category>Custom</Category>
<AlertSettings AlertMessage="UIGeneratedMonitorc2c65f3c85fe42f48ce8d2580c57bbae_AlertMessageResourceID">
<AlertOnState>Warning</AlertOnState>
<AutoResolve>true</AutoResolve>
<AlertPriority>Normal</AlertPriority>
<AlertSeverity>Error</AlertSeverity>
</AlertSettings>
<OperationalStates>
<OperationalState ID="UIGeneratedOpStateId2750c1ab2cd14b4a8a8e9f4633eba0b0" MonitorTypeStateID="SecondEventRaised" HealthState="Success" />
<OperationalState ID="UIGeneratedOpStateId5753748399984d08953c1a46895df99c" MonitorTypeStateID="FirstEventRaised" HealthState="Warning" />
</OperationalStates>
<Configuration>
<FirstIP>$Target/Property[Type="SNL!System.NetworkManagement.Node"]/SNMPAddress$</FirstIP>
<FirstVersion>1</FirstVersion>
<FirstOIDProps>
<OIDProp>.1.3.6.1.4.1.318</OIDProp>
</FirstOIDProps>
<FirstExpression>
<SimpleExpression>
<ValueExpression>
<XPathQuery Type="String">SnmpVarBinds/SnmpVarBind[OID=".1.3.6.1.6.3.1.1.4.1.0"]/Value</XPathQuery>
</ValueExpression>
<Operator>Equal</Operator>
<ValueExpression>
<Value Type="String">.1.3.6.1.4.1.318.0.5</Value>
</ValueExpression>
</SimpleExpression>
</FirstExpression>
<SecondIP>$Target/Property[Type="SNL!System.NetworkManagement.Node"]/SNMPAddress$</SecondIP>
<SecondVersion>1</SecondVersion>
<SecondOIDProps>
<OIDProp>.1.3.6.1.4.1.318</OIDProp>
</SecondOIDProps>
<SecondExpression>
<SimpleExpression>
<ValueExpression>
<XPathQuery Type="String">SnmpVarBinds/SnmpVarBind[OID=".1.3.6.1.6.3.1.1.4.1.0"]/Value</XPathQuery>
</ValueExpression>
<Operator>Equal</Operator>
<ValueExpression>
<Value Type="String">.1.3.6.1.4.1.318.0.9</Value>
</ValueExpression>
</SimpleExpression>
</SecondExpression>
</Configuration>
</UnitMonitor>
I tried the following things while attempting to troubleshoot this issue:
Leaving First
SnmpTrapProvider and Second
SnmpTrapProvider blank while creating the monitor.
Adding "" and also '' around the value as it is a string and perhaps that was the cause.
Changing the First and Second SNMPTrapProvider to .1.3.6.1.6.3.1.1.4.1.0 since that is the specific OID I am looking for the value of.
Reading every page of the internet and bashing my head on the keyboard.
I am guessing that the issue will reside in the the monitor creation and definition, but I have not found anything that clearly describes how to fill out the SNMP Trap Monitor wizard given the trap info. Especially since the trap I am receiving does
not seem to contain the usual OID with a common Int or string value. Hopefully someone can provide assistance as I am nearing my wits end with this problem.

Firstly, thank you Michael Skov, knowing that the First and Second SnmpTrapProvider or <FirstOIDProps> in the xml, needed to be blank got me pointed in the right direction. I figured I would come back and share my final working code snippet in case
others run across a similar issue.
<UnitMonitor ID="UIGeneratedMonitorf9f671e5456c44fd807d6ec2bd09621d" Accessibility="Public" Enabled="true" Target="Disc!APC.Disc.UPS" ParentMonitorID="Health!System.Health.PerformanceState" Remotable="true" Priority="Normal" TypeID="NetworkManagement!System.NetworkManagement.SnmpTrapProvider.2SingleEvent2StateMonitorType" ConfirmDelivery="false">
<Category>Custom</Category>
<AlertSettings AlertMessage="UIGeneratedMonitorf9f671e5456c44fd807d6ec2bd09621d_AlertMessageResourceID">
<AlertOnState>Warning</AlertOnState>
<AutoResolve>true</AutoResolve>
<AlertPriority>Normal</AlertPriority>
<AlertSeverity>Warning</AlertSeverity>
</AlertSettings>
<OperationalStates>
<OperationalState ID="UIGeneratedOpStateId8700c95344254f87a60c92d30d4a3953" MonitorTypeStateID="SecondEventRaised" HealthState="Success" />
<OperationalState ID="UIGeneratedOpStateId7bf68c6cfe3d4faabe83e630781c7327" MonitorTypeStateID="FirstEventRaised" HealthState="Warning" />
</OperationalStates>
<Configuration>
<FirstIP>$Target/Property[Type="NetworkManagement!System.NetworkManagement.Node"]/SNMPAddress$</FirstIP>
<FirstVersion>1</FirstVersion>
<FirstOIDProps />
<FirstExpression>
<SimpleExpression>
<ValueExpression>
<XPathQuery Type="String">SnmpVarBinds/SnmpVarBind[OID=".1.3.6.1.6.3.1.1.4.1.0"]/Value</XPathQuery>
</ValueExpression>
<Operator>Equal</Operator>
<ValueExpression>
<Value Type="String">.1.3.6.1.4.1.318.0.5</Value>
</ValueExpression>
</SimpleExpression>
</FirstExpression>
<SecondIP>$Target/Property[Type="NetworkManagement!System.NetworkManagement.Node"]/SNMPAddress$</SecondIP>
<SecondVersion>1</SecondVersion>
<SecondOIDProps />
<SecondExpression>
<SimpleExpression>
<ValueExpression>
<XPathQuery Type="String">SnmpVarBinds/SnmpVarBind[OID=".1.3.6.1.6.3.1.1.4.1.0"]/Value</XPathQuery>
</ValueExpression>
<Operator>Equal</Operator>
<ValueExpression>
<Value Type="String">.1.3.6.1.4.1.318.0.9</Value>
</ValueExpression>
</SimpleExpression>
</SecondExpression>
</Configuration>
</UnitMonitor>

SNMP traps from Solaris 10

Hi,
I'm trying very hard to set up a Sun Fire V245 to send SNMP traps when certain hardware or software related events occur. I've been looking at sma_snmp (net-snmp) and the Fault Management Daemon (SUNWfmd) but they seem to be very limited in their capabilities. I have manged to get some traps sent for filesystem fill-ups and high load averages but that is about it.
Most of all I would like the system to send traps when there is a HW failure such as a faulty FRU or if there are disk failures.
If anyone can point me to some documentation about this, I would be most grateful.
/Mikael

Mikael,
I struggled through the same thing with a Netra 240 recently. The Sun docs are garbage when it comes to this. I opened a ticket with Sun and after 3 days and 6 hours on the phone I finally got hold of someone who knew how to spell SNMP. Yes, it was that bad!
Here's the scoop. In Solaris 10 you run Net-SNMP, a.k.a. SMA, snmpd. The old snmpdx is obsoleted and you shouldn't configure it at all.
Now to get the hardware related traps for the Sunfire and Netra series servers... (what you are really looking for).
You have to load and configure an additional SNMP daemon for the hardware specific traps.
(The first doc is rather old, the last one 819-7978-12 is pretty new and is somewhat more relevant.)
Sun� SNMP Management Agent for Sun Fire� and Netra� Systems: Sun Doc number 817-2559-13
Sun� SNMP Management Agent Addendum for the Netra� 240 Server: Sun Doc Number 817-6238-10
Sun� SNMP Management Agent Administration Guide for Sun Blade� /Sun Fire�/Sun SPARC� Enterprise/Netra� Servers: Sun Doc Number 819-7978-12
And finally the SMA/net-snmp/snmpd guide for the standard Solaris related traps:
Solaris System Management Agent Administration Guide: Sun Doc Number 817�3000�11
There are problems with all of the above documents. None of the Netra/Sunfire docs specifically talk about Solaris 10 so read them with caution. They also talk about configuring and running snmpdx and never reference SMA/net-snmp. This is odd because the instructions I got from Sun (finally) were not to run snmpdx, only to run sma/snmpd and additionally run the sunfire/netra snmpd agent.
The SMA document (817-3000-11) has an undocumented bug, which Sun knows about and is working on but will not reveal to the public. In the section titled "Migration From the Sun Fire Management Agent" it references using a script called masfcnv to convert the sunfire/netra specific snmp config and daemon to work with and through SMA. Since they all use the same ports (161/162) there is some conflict and the masfcnv is script is meant to resolve this by making sma/snmpd a proxy agent to requests toward the sunfire/netra specific hardware daemon.
The problem is the masfcnv script doesn't work properly. In fact, if you run the script you will destroy your other snmp configurations and may have to uninstall and reinstall the packages to clean everything up. This script hasn't ever worked and Sun is working on a fix but they neglect to mention this in the document which is IMO gross negligence and is a reflection of Sun's overall state of affairs (but that's another ranting thread).
So what you must do is configure SMA/net-snmp (or whatever you want to call it), and also configure the sunfire/netra specific snmp (after downloading and installing that package).
Since traps are sent to the remote trapsink using destination port 162, both net-snmp and the netra specific snmp daemons can co-exist here (port 162 is not an open listening port on the machine).
Port 161 is used for receiving SNMP Get requests and can only be bound to one daemon at a time. So either it is used by net-snmp or the netra snmp daemon, but not both. Since my boxes have not been fully integrated still I can't figure out which daemon 161 is bound to. At any rate, in my application the customer is only interested in receiving traps so the outcome here isn't that important.
I realize this isn't complete but I'm no expert here and haven't worked through all the test scenarios on a fully configured system. Hopefully though this will help clear some of the confusion propogated through Sun's stupid documents. Good luck!
/Frank

Snmp trap on solaris 10

Hi,
how can i make my Solaris 10 generate SNMP trap on specific event?
like high CPU,Load or lack of disk space ?
thanks
Ram

it should be possible to define the "index" in each /etc/hostname. file
I have never done this, but when the system boots it reads the content of these files and passes them to "ifconfig" to configure the NICs
search this page for "index":
http://docs.oracle.com/cd/E19253-01/816-5166/ifconfig-1m/index.html

SCOM 2012 SNMP Trap - Does anyone have it working?

I am wondering if anyone out there has had any luck with getting SNMP Traps to be captured by SCOM 2012? Probes work fine.
We have been unable to get SCOM 2012 to receive a SNMP Trap from network devices. We currently have a case open with Microsoft, but they dont have any answers as of yet.
Here are the cliff notes version of what we have done so far.
Discovery - OK
The nodes discover without issue. I made sure they were set to SNMP only. I did this to verify we were talking SNMP and not just ICMP.
Open Ports/Firewall Issues
No firewalls are in place on the SCOM server and none exist between devices we are trying to get traps from. Using a port tool, I can see that UDP 162 is listening as expected and its the System Center Management Host Process that is running the
process. We have tried having SNMP installed, but disabled, installed and running, and uninstalled. Currently we have the SNMP service installed and running. The SNMP Trap Service is NOT installed.
Data Validation
Using Wireshark running on the SCOM box I have been able to validate the OIDs we are searching for are hitting the SCOM server. I installed an SNMP Trap generator and Receiver on my local machine as well as Jalasoft SNMP Simulator. I was able
to discover my local machine as a network device and if I send a TRAP from the TRAP generator on my local machine to the receiver on my local machine I can validate the data is coming through ok.
What has been done on SCOM side
The simplest place to look for data is with an Event Collection Rule and then an Event View Monitor. We have set up an Event Based Monitor to search for an OID that I know to be accurate and then I set up an Event monitor to look for
anything hitting that Collection Rule. The Event monitor showed nothing so we changed the EVent Monitor to look for anything that hit Node which should show any SNMP traps that have hit from network devices. No results.
We tried to run WFAnalyzer from the 2007R2 Authoring Console, but it wont run against 2012 and from what I have found the 2012 edition doesnt exist anywhere yet.
So has anyone succesfully received a SNMP TRAP into SCOM 2012?

Hi,
As this thread has been quiet for a while, we assume that the issue has been resolved. At this time, we will mark it as "Answered" as the previous steps should be helpful for many similar scenarios.
In addition, we’d love to hear your feedback about the solution. By sharing your experience you can help other community members facing similar problems.
Thanks,
Yog Li
TechNet Community Support
How could you possibly mark this as answered? No answer was given, it was quiet for a couple of days including one of which was a holiday in the US. The previous steps are NOT helpful. The question remains, Does anyone have it working?
People have given troubleshooting advice, but nobody has actually answered the simple question. Do they have it actually WORKING?

SNMP Trap Translation Wrong For Hebrew Language

SR 3-4956842281
sev 2
Cus ISRAEL CREDIT CARDS LTD
=====================
Customer is using OMS 10.2.0.5 on linux server.
They have created an user defined metric on DB cluster instance with alert message written in hebrew.
The OMS console showed the alert in hebrew as expected.
However when they send this alert with snmp trap notification to a second system (HP openview for windows) then the message appeared not cleared (with question marks). This second system get messages in hebrew from other systems without any problems.
+Does setting LANG variable at OMS level will impact this
+Any tracing which can help to find the cause of the issue

Closing as issue found at HP openview parameter settings

Can a WLC have multiple SNMP Trap Receivers with the same cummunity string?

My Monitoring team want me to send traps to three different trap collectors with the same SNMP Community string.
I have 2106's, 2504, 4400's, 5500's, 7510 all running either version 6 or 7.
Is this possible on a Wireless controller? If so, how?

Read this from my friends blog ..
http://mrncciew.com/2013/02/14/configuring-snmp-on-wlc/
"Also you can configure SNMP trap receiver where WLC can send its snmp trap messages. Community Name means SNMP trap receiver name & that does not have any significance like snmp community value."
It doesnt appear to have the same significants .. But I havent tested it
"Satisfaction does not come from knowing the solution, it comes from knowing why." - Rosalind Franklin
‎"I'm in a serious relationship with my Wi-Fi. You could say we have a connection."

LMS 3.2.1 integration with Clarity NMS for snmp trap forwarding

Our client have integrated Clarity NMS to Ciscoworks LMS 3.2.1. So far they are receiving raw alarms/snmp traps but it lacks information/inventory of the originating device. Kindly see sample raw alarms below:
2420: 2011-11-25 12:10:46 Received trap ==> Received SNMPv1 Trap
Community=ciscoworks
Enterprise=1.3.6.1.6.3.1.1.5
Generip trap type=2
Specific Trap Type=0
Trap From=10.220.10.1
Trap ID=1.3.6.1.6.3.1.1.5.2
Trap Time=-1436283373
1.3.6.1.2.1.2.2.1.1.83=83
1.3.6.1.2.1.2.2.1.2.83=GigabitEthernet1/40
1.3.6.1.2.1.2.2.1.3.83=6
1.3.6.1.4.1.9.2.2.1.1.20.83=Lost Carrier
EndTrap
10933: 2011-11-24 11:57:53 Received trap ==> Received SNMPv1 Trap
Community=ciscoworks
Enterprise=1.3.6.1.4.1.9.1.291
Generip trap type=2
Specific Trap Type=0
Trap From=10.220.10.1
Trap ID=1.3.6.1.4.1.9.1.291.2
Trap Time=1628056965
1.3.6.1.2.1.2.2.1.1.8=8
1.3.6.1.2.1.2.2.1.2.8=E1 0/0/0
1.3.6.1.2.1.2.2.1.3.8=18
EndTrap
As you can see, those raw alarms doesn’t contain any information about the originating equipment or the physical card, port related information where those alarms were generated. Instead those alarms received are just NMS level alarms.
How do we resolve this so that the inventory of the equipment would be part of the trap to be received by Clarity from Ciscoworks.

Hi,
Is the issue you have the source IP address of the forwarded trap? Per RFC it is the IP of the actual device sending the trap. The originating IP should be contained within the packet. I have included some additional information you may find helpful.
Q. What is the difference between SNMP Raw Trap Forwarding and SNMP Trap alert/event Trap Forwarding? Does DFM support both?
A. You can configure raw trap forwarding at DFM > Other configuration > SNMP Trap forwarding, and processed event/alert trap forwarding at DFM > Notification Services > SNMP Trap Forwarding. Processed trap is "when DFM receives certain SNMP traps, it analyzes the data found in fields (Enterprise/Generic trap identifier/Specific Trap identifier/variable−bindings) of each SNMP trap message, and changes the property value of the object property (if required)". Raw trap is the trap that the device forwards to DFM and DFM has yet to process it. For more information, refer to the DFM User Guide. Yes, DFM supports both ways of trap forwarding.
http://www.cisco.com/en/US/products/sw/cscowork/ps2421/products_qanda_item09186a0080a9b35b.shtml
DFM will only forward SNMP traps from devices in the DFM inventory. It will not change the trap format—it will forward the raw trap in the format in which the trap was received from the device. However, you must enable SNMP on your devices and you must do one of the following:
Configure SNMP to send traps directly to DFM
Integrate SNMP trap receiving with an NMS or a trap daemon
The versions of SNMP traps supported by DFM are described in SNMP and ICMP Polling. For information on forwarding processed and pass-through traps, see Processed and Pass-Through Traps, and Unidentified Traps and Events.
Pass-through traps are traps that DFM receives from devices that are not in the DFM inventory, and DFM has not processed. Forwarding these traps is controlled using Configuration > Other Configurations > SNMP Trap Forwarding. These traps are shown in the Alerts and Activities display because of their relevance to fault monitoring. Pass-through traps are displayed as follows:
As one of the following events:
> InformAlarm
> MinorAlarm
> MajorAlarm
With the device type and the device name from which it was generated.
If DFM does not know which device generated the trap, it ignores the trap. Pass-through traps will be cleared after a default interval of 10 minutes to one hour
http://www.cisco.com/en/US/docs/net_mgmt/ciscoworks_device_fault_manager/3.2/user/guide/dfm32ug_Book.html

SNMP Trap on AP Max associations reached

Hi all,
I want to be able to send snmp traps to my NMS alerting our NOC to when we reach our configured max-associations on an ap. We currently use both 1130 AG and 1140-2N in autonomous mode, no controller. I have found a debug command "debug dot11 station connection failure" and the output of a test AP shows us the fact that the maximum number was reached. I need to find if it is possible to trap on such information.
Any information on this would be greatly appreciated. Also please ask me for more information if you need...
Thanks,
Daniel

Daniel,
This is a shot in the dark, but try this configuration:
ap# snmp-server enable traps dot11-mibs
I'm curious about this one, too, so please let me know if this produces the information you're looking for.
Justin

SNMP trap on IP sla

Hi all,
Does anyone know that, how can SNMP trap the information(such as jitter, number of packet loss, process number of RTR) from a router enabled IP SLA/RTR?

SNMPv1 (Simple Network Management Protocol) and SNMPv2c, along with the associated Management Information Base (MIB), encourage trap-directed notification.
The idea behind trap-directed notification is as follows: if a manager is responsible for a large number of devices, and each device has a large number of objects, it is impractical for him to poll or request information from every object on every device. The solution is for each agent on the managed device to notify the manager without solicitation. It does this by sending a message known as a trap of the event.
After receiving the event, the manager displays it and may choose to take an action based on the event. For instance, the manager can poll the agent directly, or poll other associated device agents to get a better understanding of the event.
Trap-directed notification can result in substantial savings of network and agent resources by eliminating the need for frivolous SNMP requests. However, it is not possible to totally eliminate SNMP polling. SNMP requests are required for discovery and topology changes. In addition, a managed device agent can not send a trap, if the device has had a catastrophic outage.
http://www.cisco.com/en/US/tech/tk648/tk362/technologies_tech_note09186a0080094aa5.shtml

SNMP trap on OutOfMemory Error Log record

I would like to implement SNMP trap on OutOfMemory Error Log record.
In theory SNMP LogFilter with Severity Level "Error" and Message Substring "OutOfMemory" should do the trick.
In reality it does not work (doh)(see explanations below), I wonder if someone managed to make it work.
Log entry has following format:
----------- entry begin ----------
####<Nov 12, 2003 3:09:23 PM EST> <Error> <HTTP> <ustrwd2021> <local> <ExecuteThread: '14' for queue: 'default'> <> <> <101020> <[WebAppServletContext(747136,logs2,/logs2)] Servlet failed with Exception>
java.lang.OutOfMemoryError
<<no stack trace available>>
------------ entry end ------------
Notice that java.lang.... is NOT part of the log record, yep it seems that exception stack trace is not part of log record! Thus filter could be applied only to "<[WebAppServletContext(747136,logs2,/logs2)] Servlet failed with Exception>" string, which is really useless.
Here is fragment of trap data (i had to remove Message Substring in order to get Error trap to work)
1.3.6.1.4.1.140.625.100.50: trapLogMessage: [WebAppServletContext(747136,logs2,/logs2)] Servlet failed with Exception

Andriy,
I dont think you could do much here, since Outofmemory is not part of
log record SNMP agent cannot filter on this. I would be curious to hear
if anyone got it to work using SNMP.
sorry,
-satya
Andriy Potapov wrote:
I would like to implement SNMP trap on OutOfMemory Error Log record.
In theory SNMP LogFilter with Severity Level "Error" and Message Substring "OutOfMemory" should do the trick.
In reality it does not work (doh)(see explanations below), I wonder if someone managed to make it work.
Log entry has following format:
----------- entry begin ----------
####<Nov 12, 2003 3:09:23 PM EST> <Error> <HTTP> <ustrwd2021> <local> <ExecuteThread: '14' for queue: 'default'> <> <> <101020> <[WebAppServletContext(747136,logs2,/logs2)] Servlet failed with Exception>
java.lang.OutOfMemoryError
<<no stack trace available>>
------------ entry end ------------
Notice that java.lang.... is NOT part of the log record, yep it seems that exception stack trace is not part of log record! Thus filter could be applied only to "<[WebAppServletContext(747136,logs2,/logs2)] Servlet failed with Exception>" string, which is really useless.
Here is fragment of trap data (i had to remove Message Substring in order to get Error trap to work)
1.3.6.1.4.1.140.625.100.50: trapLogMessage: [WebAppServletContext(747136,logs2,/logs2)] Servlet failed with Exception

Problem with Generating SNMP traps from Windows Events

Hi Supporter,
I configured some events to be translated to traps using evntwin for Service Control Manager and Local Session Manager events. But I just got traps from Service Control Manager event. There is no Local Session Manager events are generated. I checked
with Event Viewer that events are created. Do you have any idea to fix my problem?
Thank you!
Here is my config file from evntwin:
#pragma add "System" "Microsoft-Windows-TerminalServices-LocalSessionManager" 2952790037 1 0
#pragma add "System" "Microsoft-Windows-TerminalServices-LocalSessionManager" 2952790039 1 0
#pragma add "System" "Microsoft-Windows-TerminalServices-LocalSessionManager" 2952790040 1 0
#pragma add "System" "Microsoft-Windows-TerminalServices-LocalSessionManager" 2952790041 1 0
#pragma add "System" "Service Control Manager" 1073748864 1 0

#pragma ADD<EventLogFile> <EventSource> <EventID> [<Count> [<Period>]]
The parameter EventSource specifies the application that generates the event.
those maybe helpful...
http://www.questiondriven.com/2012/03/08/windows-server-20032008-event-log-snmp-traps/
http://www.networkcircus.com/articles/20050715.html
Best,
Howtodo

Re-routing of SNMP traps from port 162 to port greater than 1024

Hello,
I have to re-route SNMP traps received at port 162 to some other port greater that 1024 (say 2041). There is an application which sends SNMP traps to port 162 and our application running on Windows listens for SNMP traps on port 2041, so we want
to route/forward the traps internally from port 162 to 2041.
I have been looking at the rules defined in 'Windows Firewall with advanced security' but not able to succeed. I noticed that there is a predefined rule for SNMP traps but it does not give me an option to forward the trap to another port. I tried
creating a new rule but that also does not give me an option to change the port.
Please help.

Hi,
According to Technet Library:
SNMP uses the default UDP port 161 for general SNMP messages and UDP port 162 for SNMP trap messages. If these ports are being used by another protocol or service, you can change the settings by modifying the local Services file on the agent. The Services
file is located in \ % SystemRoot %\System32\Drivers\Etc
There is no file name extension. You can use any text - based editor to modify the file. The management system must also be configured to listen and send on the new ports.
Caution:
If you have previously configured IP security to encrypt SNMP messages on the default ports, you must also update the IP security policy with the new port settings. Otherwise, communication can be erroneously blocked or SNMP communications might not be secured.
You can access to the link below for this article:
http://technet.microsoft.com/en-us/library/cc959643.aspx
Roger Lu
TechNet Community Support

TimesTen SNMP traps

Similar Messages

Maybe you are looking for