(SNMP) Rising Threshold Passed (10005) - what is it?

[NJK-Work]

Hello,

I have a bunch of servers that keep generating the following alerts:

(SNMP) Rising Threshold Passed (10005)
(SNMP) Critical Rising Threshold Passed (10007)

There is no information in the alerts other than the server name and this:

Critical Rising Threshold passed. An alarm entry has crossed its Critical rising threshold. The instances of those objects contained within the variable list are those of the alarm entry which generated this trap.

Huh? That makes NO sense to me!

I have disabled ALL thresholds that I can think of. As far as I know, there are only four:

File System Space Used
Logical Disks
Processors
Server

So if I have disabled all thresholds, why am I getting ANY alerts, and what are these alerts? There are no details as to WHAT threshold was crossed.

Thanks
Nelson

[Change_happens · Accepted solution]

its because of threshold increased and that comes because of foundation agents. There should be summary like:
SUMMARY "%s: Variable %s has value %d >= %d."

that i can see from cpqthrsh.mib has its definition. which means there should be info that what reached value and what should be expected %d>=%d (hope you understand my technical terms as u r graduate here).

Try restarting foundation agents service.

Thanks, AJ

[NJK-Work]

Thanks for the info. However, there is no "variable list" information. Just what I mentioned above.

Nelson

[scsibus]

I am experiencing this same issue. The Windows event log facility reveals the extended trap information, but the CMS must be truncating it.

SIM Alert data: No additional information was provided. The event or device was probably deleted.


Windows event log:

Event Type: Warning
Event Source: Foundation Agents
Event Category: Events
Event ID: 1162
Date: 7/2/2008
Time: 10:16:11 AM
User: N/A
Computer: SERVER-FS1
Description:
Threshold Agent: Rising Threshold Passed.
SNMP MIB Variable .1.3.6.1.4.1.232.11.2.4.1.1.5.3 has value 91 >= 85.
Severity: Warning
Description: I:VOL14 [NTFS] disk space.
Refer to the MIB for a definition of the variable.
[SNMP TRAP: 10005 in CPQTHRSH.MIB]
Data:
0000: 0f 00 a4 01 06 00 00 00 ..¤.....
0008: 01 04 02 01 5b 00 00 00 ....[...
0010: 55 00 00 00 53 00 00 00 U...S...

[NJK-Work]

Ahhhh - cool. I will check the Event logs the next time they happen. Thanks for the tip.

[Donald E. DeFreese]

I have found the mib cpqthrsh was not properly loaded into SIM when upgrading to version 5.2.2. To workaround this, download the latest mib version from the HP site. I used version 8.10. Next copy the two files cpqthrsh.cfg and cpqthrsh.mib into the directory location c:\Program Files\HP\System Insight Manager\mibs (or whatever letter drive you installed SIM at).
Third, from a command prompt, change directory to the location of the MIB repository c:\Program Files\HP\System Insight Manager\mibs.
Finally, execute the command "c:\Program Files\HP\System Insight Manager\bin\mxmib.exe" -a cpqthrsh.cfg. The mxmib program will have two messages. First that it is importing the cfg file, second the command completed successfully. To test that the message is now corrected, restart the storage agent on a server you know has a drive over the limit so that a trap will be generated. When restarting storage, Windows will ask if you also want to restart the Foundation agent. Answer yes and both will be restarted. No server reboot on either the SIM or client server is necessary. Hope this fixes your issue.

[NJK-Work]

Thanks! I will check it out.

Nelson

[Jeffrey D. McLeod]

Hey. Your fix worked for me. Problem is: I was using the 8.30 version of the mibs. I had to roll back to 8.25 and everything seems to work fine now.

Thanks!

[Rob Buxton]

It seems to be the MIB Update process that breaks it, not the MIBs themselves. I just reloaded the 8.30 MIBs into HP SIM to fix these issues. Can't recall now, but there were a few MIBs I ended up reloading for performance and threshold errors.

[NJK-Work]

Thanks
Nelson