topic Re: Forwarding the event type by SNMP Trap in Server Management - Systems Insight Manager

Forwarding the event type by SNMP Trap

Kenan Cakir — Mon, 12 Oct 2009 12:18:20 GMT

Hello!

I am forwarding incoming SNMP Traps to another server where an application called "Advanced Host Monitor" is running. This application alerts me when it gets a Trap by HP SIM.
Unfortunately it replies me the Hostname of the Server, from where the failure originally comes from. For the first this is quite good and shows me that everything is working properly, but:

I don't want to be alerted about the Hostname, but the "Event type"-message. So for me the question is: "What kind of informations do the forwarded traps by hp sim include?" Seems for me as if it is only the related Hostname..

How can I get to my aim? Do I have to change sth. in the MIB-File? Or any other ideas?

appreciate your help!

Re: Forwarding the event type by SNMP Trap

Alexander A — Wed, 14 Oct 2009 07:17:44 GMT

Hi. Many, but not all, traps contain a variable named sysName that is set to the hostname of the system that generated the event. You'll have to get clever with the mibs to get it working.

Here are two traps to illustrate my point: they are similar but one has sysName and the other does not. Looking at the mib is the only way to know what information a trap carries.

cpqHoGenericTrap TRAP-TYPE
ENTERPRISE compaq
VARIABLES { cpqHoGenericData }
--#SUMMARY "%s"
--#ARGUMENTS {0}
--#SEVERITY MAJOR
--#TIMEINDEX 99
--#TYPE "Generic trap (11001)"
--#ENABLE true
--#CATEGORY "Proliant Miscellaneous Events"
DESCRIPTION "Generic trap."
::= 11001

cpqHo2GenericTrap TRAP-TYPE
ENTERPRISE compaq
VARIABLES { sysName, cpqHoTrapFlags, cpqHoGenericData }
--#SUMMARY "%s"
--#ARGUMENTS {2}
--#SEVERITY MAJOR
--#TIMEINDEX 99
--#MSG_FORMATTER "$V3V#Text: #"
--#TYPE "Generic trap (11003)"
--#ENABLE true
--#CATEGORY "Proliant Miscellaneous Events"
DESCRIPTION "Generic trap."
::= 11003

Re: Forwarding the event type by SNMP Trap

Kenan Cakir — Wed, 14 Oct 2009 08:41:37 GMT

"
cpqHo2GenericTrap TRAP-TYPE
ENTERPRISE compaq
VARIABLES { sysName, cpqHoTrapFlags, cpqHoGenericData }
--#SUMMARY "%s"
--#ARGUMENTS {2}
--#SEVERITY MAJOR
--#TIMEINDEX 99
--#MSG_FORMATTER "$V3V#Text: #"
--#TYPE "Generic trap (11003)"
--#ENABLE true
--#CATEGORY "Proliant Miscellaneous Events"
DESCRIPTION "Generic trap."
::= 11003
"

This was also my thought.
So I removed the variable "sysName" to watch what will happen. But no effect. Again it shows me the hostname (sysName)

Do you know which variable stands for the "Event Type"-message?

Do I need to restart sth. when I change a MIB? Or any other ideas?

So my aim is to deliver the "Event Type"(Generic trap (11003))... see picture:

Re: Forwarding the event type by SNMP Trap

Alexander A — Wed, 14 Oct 2009 10:29:23 GMT

Editing the Mib will not change the trap recieved or sent, it will only "break" the interpretation of the event in HPSIM.

You need to know that, what HPSIM show as "Event Type" is the interpretation of the event; that string is not sent in the trap itself. What the MIB that contains the definition of the 11003 trap say is that: events with this specific OID (.1.3.6.1.4.1.232.0.11003) has these three variables (sysName, cpqHoTrapFlags, cpqHoGenericData) and the description of this trap is "Generic event".

If you want your other monitoring application to show you "Generic trap" you need to somehow tell it that traps with the IOD .1.3.6.1.4.1.232.0.11003 means "Generic Trap". An application that is build to handle SNMP often has the ability to import MIBs to correctly interpret the messages. In other applications, like Microsoft SCOM, you have to manually create a rule to accept this trap and you add the description "Generic Trap" yourself, along with any variables contained in the trap you want to see.

In addition to interpreting the message OID, you need to interpret the variables. These also has a discription. The definition of the variable "sysName" is, as stated in the cpqhost.mib, imported from RFC1213-MIB.

Re: Forwarding the event type by SNMP Trap

Kenan Cakir — Wed, 14 Oct 2009 12:56:50 GMT

thank you for the first. i will look what i can do and inform you about my advancement tomorrow.. bye

Re: Forwarding the event type by SNMP Trap

Kenan Cakir — Fri, 16 Oct 2009 08:02:41 GMT

I tried many things without success.
My monitoring application (Advanced Host Monitor by KS Soft) has a "MIB Browser". It can only load/append MIB-Files but not edit them. So I'm not able to say that OID 1.3.6.1.4.1.232.11003 belongs to the value "Generic Trap", particularly it cannot find the OID xx.11003 but only xx.232, so the enterprise (compaq).
So, do you know what to do? Can I use another "MIB-editor"-software? Are there any?

Re: Forwarding the event type by SNMP Trap

Rob Buxton — Sun, 18 Oct 2009 18:24:19 GMT

When HPSIM gets an SNMP trap from a server (e.g. failed device) then it uses the MIBs compiled into HPSIM to provide the detail.

If you ask HPSIM to forward that SNMP Trap then it will do that. But it is then up to the application that the trap is being forwarded to, to provide the detail.

If I understand SNMP Traps correctly the trap itself is just a series of numbers (the OID).
Editing anything in HPSIM will not help.
So, if the application is Nagios then it would be Nagios that needs to interpret the trap and provide the detail. If it can't then you'll need to let HP SIM do that for you.