SNMP Trap filtering

[Kaydee]

We currently have a fully up to date iMC 7 installation. We get a number of traps from every device on out network to say that the "System Local Clock has changed". Now These traps are all reflecting minor time changes due to NTP but I was wondering if there is an intelligent way to filter these traps such that if the time has changed by less than say five minutes that it no longer flags a major alarm. We do not want to filter ALL time-changed alarms as the time being out by a large factor is a potential issue. The network is mostly HP switches (a series) and some cisco.

[LindsayHill · Accepted solution]

Yes, these alarms are a pain. I don't think there's a way to achieve quite that level of filtering. Some tools offer that sort of granularity, IMC doesn't seem to (yet).

However...it's only the Comware devices generating them. Cisco devices don't generate those particular traps, and you probably never missed them. My advice to people with mixed networks like yours is to just suppress that particular trap.

Instead use Compliance policies to verify that NTP is configured on all your devices. For bonus marks, configure a Compliance policy that logs into the devices, runs "show ntp status"  (or equivalent), and then checks that the output shows "synchronized". That's actually a far better level of verification than relying on traps reporting time adjustments.

[Kaydee]

Thanks for the reply. The compliance policy approach seems to be the best idea I think. The only draw back I can see is the ability to check only once a day per task but it's much better than filtering those alarms manually.

Thanks for the info.

[GregoryW]

You can filter these messages with IMC 7.0. On the alarm event just get the oid of the alarm first, that will make it easier to add. Then go to filtering rules and call it something like Date Change and then do by trap and when you hit the select button put in the oid. It should come up as something like Date and Time for System Changed(H3C System Management Notifications). Then just filter 7 days a week 24 hours a day.