Do the alerts work from events received from individual switch event logs, or only the 'master' event list? I'm trying to get an email sent to my address every time there is a login, successful OR not, to one of our switches.
Note: We also run HP Systems Insight Manager on another server, if there is a way to set this up via SNMP we can have insight handle the alerts
AFAIK alerts work on traps received by PCM from the switches. They do not work on syslog entries. I presume you are calling the traplog the "master" and the syslogs, the "individual" logs. The two are unrelated.
I know nothing about Insight Manager but if it can be a syslog receiver and alert on entries, then Bob's your uncle.
LOL I have been lobbying the PCM beta team to add alerts to the syslog. Maybe in a future version.
There are other products that can alert on syslog entiries. Ipswitch WhatsUp comes to mind as one of them.
You might be able to walk the MIB tree and find the event in question. For example to turn off traps for Security Access Violation, I walked: iso(1).org(3).dod(6).internet(1).mgmt(2).mib-2(1).rmon(16).event(9).eventTable(1).eventEntry(1).eventType(3)
EventType 236 is the aforementioned, and the value 4=logandtrap while 1=none
Okay, it appears the events are all set to 4 -- logandtrap -- the problem is I need the MIB for the PCM switch -- and the ones I downloaded from HP didn't have trap definitions. Is it possible to manually write the trap definition for the login trap? If so, any help in what /w where to go for that would be greatly appreciated...just need a gentle push in the right direction here!
I believe the event im looking for is 179: eventDescription.179 (octet string) SME %s - %s Mode [53.4D.45.20.25.73.20.2D.20.25.73.20.4D.6F.64.65 (hex)]
(the syslog says 08/15/05 10:24:30 mgr: SME TELNET from 152.157.72.41 - MANAGER Mode)
Preston, Since you don't mention models of switches so YMMV, but I had no problem to get Telnet authentications to go to the traplog from a 2848 I tested. You simply need to set your trap receiver(s) to ALL using Device Manager in PCM.
