topic Re: Monitoring OSPF neighbour changes in IMC in IMC

Monitoring OSPF neighbour changes in IMC

pattap — Thu, 08 Dec 2016 11:52:37 GMT

Hi All

I've got some 5800s and 7906s running comware 5. I have enabled ospf traps with snmp-agent trap enable ospf nbrstatechange command. All look good from the switches themselves, meaning I can see that a trap with OID 1.3.6.1.2.1.14.16.2.2 is being generated. when there's nbr change. Nothing happens in IMC though.

Now when I'm in alarms>trap management>trap definition trying to query this particular OID it won't show any results but then when I'm trying define one, IMC won't let me, returning OID already exists error.

Any ideas?

Re: Monitoring OSPF neighbour changes in IMC

pattap — Wed, 14 Dec 2016 12:10:24 GMT

I'm still trying to get this working and not quite sure of results I'm getting in MIB management in IMC
I'm trying "Operate the inputted OID" with selected device as a snmp agent, OID I'm trying is 1.3.6.1.2.1.14.16.2.2 ospfNbrStateChange

IMC and that's what I get:

1.3.6.1.2.1.14.16.2.2 (ospfNbrStateChange) No Such Name

Re: Monitoring OSPF neighbour changes in IMC

pattap — Wed, 04 Jan 2017 09:25:28 GMT

anyone? I still can't get this working. We lost some major services over xmas time, IMC hasn't recorded any of the OSPF changes

Re: Monitoring OSPF neighbour changes in IMC

RPapaux — Wed, 04 Jan 2017 11:50:24 GMT

Just in the case it was not already done: Load the necessary MIB files.

The one which are most of concern for you are:

HH3C-OSPF (if you have a HP branded 5800)

RFC-4750-OSPF

RFC4750-OSPF-TRAP (this is the one encoding the "ospfNbrStateChange", hence the one required to decode that tap!)

All this files are available on the HPE site for the 5800 software, within a package called MIBs_v9, with other usefull documentation too.

I hope this can be useful

Ray

Re: Monitoring OSPF neighbour changes in IMC

pattap — Mon, 23 Jan 2017 08:59:51 GMT

The MIB wasn't loaded indeed but the 5800s we have are h3c. Regardless MIBs loaded I'm still not getting traps for ospf

Also when trying to add 1.3.6.1.2.1.14.16.2.2 trap manually (trap definition>add trap) I get "1.3.6.1.2.1.14.16.2.2 already exists" even though it's not visible in "trap definition" collection

Not sure what else to check/config

Re: Monitoring OSPF neighbour changes in IMC

Pack3tL0ss — Thu, 26 Jan 2017 05:45:42 GMT

You can go to trap definitions and hit the expand icon next to the search box in the upper right. This will pull up the advanced search, then search by trap OID. That should tell you if it's there or not. I suspect it's not.

as @RPapaux mentioned you need to get the appropriate MIB file and import it into IMC. Just to make sure there is no confusion, because there often is... The "MIB Manager" function is a tool for testing with the devices, but it has no bearing on the IMC trap definitions. To import trap definitions you need to select the 'import trap definitions from MIB file' option in the trap definitions page. Either use the upload function or place the file in the directory (it's in the help text on that page) then select and compile. You should be able to search the OID in the trap definitions page after it's imported.

The fact you are not seeing anything from the switch is likely becaue it's not defined. Go to

Alarms-->Trap Management-->Filtering Trap ... and select the Unkonwn Trap Filter, which I'm fairly certain is enabled by default. Uncheck the box to disable and save. After that is changed, even if there is no trap definition in IMC you will get the trap (identified by OID because it doesn't have the details to translate). That should help determine exactly what trap OIDs are being sent and what is or is not defined. I personally always disable that option so I know if I need to import MIBs for anything.

Hope it helps

Re: Monitoring OSPF neighbour changes in IMC

pattap — Fri, 27 Jan 2017 15:02:09 GMT

I've disabled the unknown traps filter for now as import trap to def from MIB doesn' work - IMC throughs an error saying that there are duplicate MIBs stored on IMCs local drive.

I have no direct access to it so need to liaise with other team so they can clean it up.

I hope we'll see some traps coming that were filtered out by the unknown trap, will post an update once I have something

Thanks a lot Pack3tL0ss

Re: Monitoring OSPF neighbour changes in IMC

pattap — Thu, 02 Feb 2017 08:50:07 GMT

I've just checked existing trap definitions for ospf and found the below, I'd expect to see some alerts with these in place?

a3Com_ospfNbrStateChange	        1.3.6.1.2.1.14.16.6.2	        a3Com_ospf(1.3.6.1.2.1.14.16)	Critical	System Defined

Non-virtual OSPF Neighbor State Changed	1.3.6.1.2.1.14.16.2.6.2  	OSPF(1.3.6.1.2.1.14.16.2)	Critical	System Defined

OSPF Interface Status Changed	        1.3.6.1.2.1.14.16.2.6.16	OSPF(1.3.6.1.2.1.14.16.2)	Warning	        System Defined	

snOspfNbrStateChange	                1.3.6.1.4.1.11.6.5	        hp(1.3.6.1.4.1.11)	        Critical	System Defined

Re: Monitoring OSPF neighbour changes in IMC

pattap — Thu, 23 Feb 2017 15:30:40 GMT

also for some reason I'm not able to "Import trap definition from MIB file" I'm getting the below error

Re: Monitoring OSPF neighbour changes in IMC

pattap — Mon, 20 Nov 2017 14:35:29 GMT

Old post but I've never manged to get this to work. I figured that you can see logs for traps being generated on a switch with display trap command, switch does generate traps but they are never processed by IMC

#Nov 20 06:16:12:656 2017 "Host_1 S5800" OSPF/5/NEIGHBOR_STATE_CHANGE: OSPF TrapID1.3.6.1.2.1.14.16.2.2<ospfNbrStateChange>: Non-virtual neighbor 10.122.144.111 index 0 Router 1.1.1.1 NbrRouter 1.1.1.2 state change to 1.