Ignoring specific PCM Events and auth traps

[Chrisd131313]

Hi all,

I am trying to tidy up my events on PCM4+, but there are some events I just can't seem to ignore/throttle. The one's I am having issues with are...

PCM Events, specifically the PoE Device Polling Schedule and Virus throttling.

and

W 10/31/12 09:25:02 03362 auth: User '<username>' login from <ip_address>

W 10/31/12 09:25:02 03362 auth: User '<username>' logout

I have enabled the option under "Preferences > Policy Management" to suppress Event log messages during policy execution, but this still sends in the policy completion events, is there any way of disabling them altogether?

The other issue I have is with the trap events. The two auth traps listed have oid's of...

.1.3.6.1.4.1.11.2.3.7.11.133.2

&

.1.3.6.1.4.1.11.2.3.7.11.132.2

I do not see these listed in "Preferences > Events > Ignored Events" - Is this possibly something HP have forgotten to implement? or is there some MIB I need to install to cover these auth traps? or are they in the list as something else and I am just not seeing them?

Any help would be much appreciated.

Thanks

[Peter Jakobsen]

Hello Chris,

I had same problem, so have included the follwing CLI commands on all my procuve (>1000)

    ' * eventType / .1.3.6.1.2.1.16.9.1.1.3.y
    ' * variable type=integer
    ' * value =
    ' "1" => none
    ' "2" => log
    ' "3" => snmp-trap
    ' "4" => log-and-trap default for all events

    ' no log or Trap
    setmib eventtype.179 -i 1 'SME %s - %s Mode
    setmib eventtype.130 -i 1 'RRQ from %s for file %s
    setmib eventtype.131 -i 1 'Transfer completed
    setmib eventtype.776 -i 1 'No VR with vrid %u found on vid %u
    setmib eventtype.236 -i 1 'SNMP Security access violation from %s
    setmib eventtype.828 -i 1 'PVID mismatch on port %d(VID %d)with peer device port %d(VID %d)
    setmib eventtype.2617 -i 1 '02617 mgr: Startup configuration changed by SNMP.  New seq. number
    setmib eventtype.2422 -i 1 'igmp: wellknown DA packet received with address well known mcast address
     
    ' Only log
    setmib eventtype.76 -i 2 'port %s is now on-line
    setmib eventtype.77 -i 2 'port %s is now off-line
    setmib eventtype.564 -i 2 'port %s PD Invalid Signature indication.

The above commands tells the switch events to ignore,log or trap

In your case you just enter this

setmib eventtype.3362 -i 2

setmib eventtype.3363 -i 2

the number is from the event log list and can also be seen on the switch in the log.

You can't see commands in the config, but you can use getmib to check the value in the swtich. Changeing this can bee done in PCM using the CLI Wizard.

Regards

peter

[Chrisd131313]

Hi Peter,

Thanks so much for your response, I was never aware of that functionality!! :) Just so I can understand it all a bit more, do you know of any reference documents which explain this configuration on the switches? When I use a ' on my switch it puts me to a > prompt, I was never aware of this and would like to learn more about it - after a bit of searching I can not find anything, is it something that is covered in the switch CLI guides?

Thanks again :)

[Peter Jakobsen · Accepted solution]

Ups,

Forgot to write that - it's a comment so just ignor this when you enter the CLI command

Peter