Editing Event priorities with SNMP set

[joe_butler]

Hi Everyone,

I am looking to change the priority on certain switch events to more appropriate levels. In particular the events:

"High collision or drop rate (formerly overbandwidth)"

"Excessive broadcasts (formerly broadcast storm)"

These are major and crital alerts and takes up space in the procurve manager log. I have a script which logs in during the night and advises of problem ports. If this alert could be changed to information it would mean that the procurve manager log would save space for more inportant things like STP and loop-protect alerts.

[Olaf Borowski]

Hi Joe,

Can you be more specific? What product(s) are you using? Are these FFI (Fault-Finder) messages? Do you see these as syslog messages or traps? If these are FFI messages, you can set the severity:
ProCurve Switch 3500yl-48G# sh fault-finder

Fault Finder

Fault ID Sensitivity Action
------------------- ----------- ----------------
bad-driver medium warn
bad-transceiver medium warn
bad-cable medium warn
too-long-cable medium warn
over-bandwidth medium warn
broadcast-storm medium warn
loss-of-link medium warn
duplex-mismatch-HDx medium warn
duplex-mismatch-FDx medium warn

ProCurve Switch 3500yl-48G(config)# fault-finder broadcast-storm sensitivity low

ProCurve Switch 3500yl-48G(config)# show fault-finder

Fault Finder

Fault ID Sensitivity Action
------------------- ----------- ----------------
bad-driver medium warn
bad-transceiver medium warn
bad-cable medium warn
too-long-cable medium warn
over-bandwidth medium warn
broadcast-storm low warn
loss-of-link medium warn
duplex-mismatch-HDx medium warn
duplex-mismatch-FDx medium warn

Or, you can disable certain message/or all:

ProCurve Switch 3500yl-48G(config)# no fault-finder all (or specific fault).

Hope this helps,
Olaf

[joe_butler]

Ok here is a bit more on what I need. the events are those shown in the "show log" on the switch which I dont want to remove completely A as its useful at times and secondly becuase of a script i run at night which reports on switchport status.

in addition to the script i send all logs via syslog to the procurve manager (2.1) server which only seems to hold the last 1000 major and critical alerts. If this could be increased it would be handy but they are filled with the two alerts i mentioned. I had a case before where I needed to remove some logs which were generated when an unathorised snmp get was sent to the switch. this was removed by setting the oid value
(setmib 1.3.6.1.2.1.16.9.1.1.3.236 -i 1)

I know it will be possible for these alerts to be changed to information in instead of a higher category but i need help finding it.

thanks,
Joe

[joe_butler]

OK I have spent some time and figured this out.

It was very similar to what I had previously done before with some snmp violation logs i didn't need.


If you mibwalk on the following OID :
1.3.6.1.2.1.16.9.1.1.2 - Event Description

You can find the name of the offending log/s, in may case they are:
eventDescription.332 port %s-Excessive Broadcasts. See help.
eventDescription.331 port %s-High collision or drop rate. See help.

You can then see how the system will handle these events by a mibwalk on:
1.3.6.1.2.1.16.9.1.1.3 - Event Type (looking for .332 and .331 in my case)

Previously these events were down as type 4 but i have solved by changing these to type 2 which will log, but not send an snmp trap, thus keeping the logs out of procurve manager and still leaving them in place for my nightly scripts.

It hasn't changed the proirity of the alert in the event log but it does acheieve what I wanted it to. I still believe that you can probably change event priorities if you really wanted to, but im not sure where you would find it.

Event Types:
1. None
2. Log
3. SNMP trap
4. Log and trap

[joe_butler]

If you want to do this from the procurve CLI you can use the command

setmib 1.3.6.1.2.1.16.9.1.1.3.331 -i 2
setmib 1.3.6.1.2.1.16.9.1.1.3.332 -i 2