Alerts in PCM+ 1.6

[Preston Gallwas]

Do the alerts work from events received from individual switch event logs, or only the 'master' event list? I'm trying to get an email sent to my address every time there is a login, successful OR not, to one of our switches.

Note: We also run HP Systems Insight Manager on another server, if there is a way to set this up via SNMP we can have insight handle the alerts


Is there a way to accomplish this?

[Les Ligetfalvy]

AFAIK alerts work on traps received by PCM from the switches. They do not work on syslog entries. I presume you are calling the traplog the "master" and the syslogs, the "individual" logs. The two are unrelated.

I know nothing about Insight Manager but if it can be a syslog receiver and alert on entries, then Bob's your uncle.

[Preston Gallwas]

I believe it has to be an SNMP trap, then I need to load in a MIB with trap definitions to have it act on it :(

Well hot darn ...I really wanted the login alerts...

Devs, any chance this can get looked into?

[Les Ligetfalvy]

LOL
I have been lobbying the PCM beta team to add alerts to the syslog. Maybe in a future version.

There are other products that can alert on syslog entiries. Ipswitch WhatsUp comes to mind as one of them.

You might be able to walk the MIB tree and find the event in question. For example to turn off traps for Security Access Violation, I walked:
iso(1).org(3).dod(6).internet(1).mgmt(2).mib-2(1).rmon(16).event(9).eventTable(1).eventEntry(1).eventType(3)

EventType 236 is the aforementioned, and the value 4=logandtrap while 1=none

HTH

[Preston Gallwas]

Okay, it appears the events are all set to 4 -- logandtrap -- the problem is I need the MIB for the PCM switch -- and the ones I downloaded from HP didn't have trap definitions. Is it possible to manually write the trap definition for the login trap? If so, any help in what /w where to go for that would be greatly appreciated...just need a gentle push in the right direction here!

THANKS AGAIN Les!

[Preston Gallwas]

I believe the event im looking for is 179: eventDescription.179 (octet string) SME %s - %s Mode [53.4D.45.20.25.73.20.2D.20.25.73.20.4D.6F.64.65 (hex)]


(the syslog says 08/15/05 10:24:30 mgr: SME TELNET from 152.157.72.41 - MANAGER Mode)

[Les Ligetfalvy · Accepted solution]

Preston,
Since you don't mention models of switches so YMMV, but I had no problem to get Telnet authentications to go to the traplog from a 2848 I tested. You simply need to set your trap receiver(s) to ALL using Device Manager in PCM.

[Preston Gallwas]

Hmm... apparently 'debug' Doesnt send the traps to the eventlog...gah... "All" worked
;)

THANKS MUCH Les!