topic Re: Alerts HP ProCurve Manager in Switches, Hubs, and Modems

Alerts HP ProCurve Manager

willinfo — Fri, 27 Mar 2009 08:57:16 GMT

I open a new thread fot the alerts of PCM. In effect, I would like that ****@wanadoo.fr receive e-mail when a switch is out or even when it returns to a good status.
Now PCM is aset but any alert (ip address conflict or switch reboot) appear although I reboot it for example. I have already create a SMTP Profile with an alert, an action and a policy. When I enforce ****@wanadoo.fr receive a mail but when I don't enforce any alerts is send. I don't know how to do.
I hope your help.

Re: Alerts HP ProCurve Manager

willinfo — Tue, 31 Mar 2009 06:54:20 GMT

nobody? I need help.

Re: Alerts HP ProCurve Manager

Javed Padinhakara — Tue, 31 Mar 2009 11:25:44 GMT

trying to understand it correctly. Are you saying that You have a policy created with
(a) an alert specified for switch reboot (for example)
(b) Action set to send email
Enforce of the above policy works but when the event specified in the alert happens, you dont see the email ?

If that is the case, then a lot would depend on the PCM version you have and also the the exact details of the alert you have created. Also how have you verified the event mentioned in the alert actually has happened?

Can you also check the Policy History tab to see if anything has been logged?

Re: Alerts HP ProCurve Manager

Javed Padinhakara — Tue, 31 Mar 2009 11:33:17 GMT

the reason I mentioned about the dependency on PCM version for this problem is because there seems to be a fix for similar problem and it was supposed to be fixed by an AutoUpdate on PCM 2.3

See this related thread:
http://forums11.itrc.hp.com/service/forums/questionanswer.do?threadId=1232764

Re: Alerts HP ProCurve Manager

willinfo — Tue, 31 Mar 2009 12:32:10 GMT

I don't know how to configure an alert when a switch is out, or when a problem happen on a port of the switch.
I have
1) an action 111 : send email (with a SMTP Profile ok)
2) an alert 99 : filter => greater than minor
source => alert source as
event source.
3) policies => any time
all sources
all targets
alerts 99
actions 111

Re: Alerts HP ProCurve Manager

willinfo — Tue, 31 Mar 2009 12:33:10 GMT

It's only what I did. I don't see where I have to configure e-mail send when a switch is out ......

Re: Alerts HP ProCurve Manager

Javed Padinhakara — Wed, 01 Apr 2009 11:05:06 GMT

Lets say we need to trigger the policy when a device goes unreachable.

First we see in the Event Browser ( Event Tab displayed in PCM GUI) and note the event details for such an event.
Here is a sample for 'device unreachable' event, as recorded in the Event Browser:
=====
Event type: PCM Event
Received from: Discovery2-4
Date received: Thu Mar 26 07:22:01 GMT+05:30 2009
Date acknowledged: Event has not been acknowledged.
Severity:Informational
Event Description:172.16.100.101,Â deviceÂ isÂ unreachable
==========

So for 'triggering a policy' whenever the above event happens, we need to create an Alert which has the properties
- has severity 'EQUAL TO' 'Informational'
- contains 'device unreachable'

so your step(2) becomes now
alerts 99==>
- has severity 'EQUAL TO' 'Informational'
- contains 'device unreachable'

Click "Apply" and make sure the policy is 'Enabled'.

Check if this policy executes henever the related event appears in the Event Browser.

hope it helped someway!

Re: Alerts HP ProCurve Manager

willinfo — Wed, 01 Apr 2009 11:38:04 GMT

In my event browser, I have nothing because the switch is reachable. When it is unreachable I don't have the access to the event browser of the switch, of the telnet console and I don't have events in PCM ....

Re: Alerts HP ProCurve Manager

Javed Padinhakara — Wed, 01 Apr 2009 13:56:51 GMT

[Note: I meant the event browser in PCM and the example was an illustration. The event varies depends on what condition you would like to trigger the email.]

Well if you are not seeing any events in PCM ( and you are sure those events are supposed to have occured ) then its a different problem altogether.

You may need to check
- if PCM server has been registered as a trap receiver in the switch
- and confirm if port 162 in PCM server machine is being used by PCM process (javaw.exe) only and not any other process.

Only when PCM is receiving events correctly can one be certain that the (event-based)Policy would get triggered.

Re: Alerts HP ProCurve Manager

willinfo — Thu, 02 Apr 2009 05:52:01 GMT

I don't know how to know if my PCM server is configure as a trap receivers in the switch.
I have this configuration for all my switch :

Link-Change Traps Enabled on Ports : All
Send Authentification Traps : Yes

Address Community Events sent in Trap
*.*.*.* public Not-info
*.*.*.* public None
*.*.*.* public None

Re: Alerts HP ProCurve Manager

willinfo — Thu, 02 Apr 2009 07:05:38 GMT

What is the relation between the security monitoring ( Preferences => Security Monitoring) with ip spoofing, protocol anomaly ... and the ignored/throttled alerts and the alerts which appear in the events tab in PCM ????

Re: Alerts HP ProCurve Manager

Javed Padinhakara — Thu, 02 Apr 2009 11:09:33 GMT

regarding:
---------
I don't know how to know if my PCM server is configure as a trap receivers in the switch
---------

To know if PCM server is configured as a trap receiver in the swich:
when you do a 'show snmp-server', you should be able to see the IP address of the PCM server under the "Trap receivers" section of the output.

Say your PCM server IP is 192.36.54.142 then you should see something like this in the above command output:

Address Community Events
--------------------------------------------------
192.36.54.142 public all

if this is not there, then configure the switch to add PCM server as one of the trap receiver as :
(config)#snmp-server host 192.36.54.142 all public
(config)#write memory

after the above step, check in PCM GUI under the Events tab in the device group folder. You should be able to see events listed from that switch.

Re: Alerts HP ProCurve Manager

willinfo — Thu, 02 Apr 2009 13:18:35 GMT

I don't understand that :
after the above step, check in PCM GUI under the Events tab in the device group folder. You should be able to see events listed from that switch.

Re: Alerts HP ProCurve Manager

Javed Padinhakara — Thu, 02 Apr 2009 13:32:59 GMT

check the attachment.
I meant the Event Tab for the corresponding device family folder, within which the switch is present.

Note that there Event Tab is also seen if you highlight a device ( within the device family folder) as well.