PCM: Find OID of Event?

[zmichl]

Is there a way to find the OID of an event viewed in the "Events"-Tab in PCM?
For example, there is an event which says "Intrusion Detection" and I want to trigger a policy next time that event happens. But how do i find out the OID I have to filter for?

[Javed Padinhakara]

Assuming you are using PCM 3.0+, here is a quick and dirty way:

Go to Tools Menu > Prefernces > Events > Ignored Events ( or Throttled Events )

In that window, there is a "Filter" text box. You can enter the some characters from the event string and the list below would show the details of the event with OID

Hope that helps

ps: Noticed that you have posted some 11+ questions, but assigned no points to anyone:) It is always a good practise and ettique in the forum, to show appreciation for the time fellow members spend in answering your questions, by assigning appropriate points from 1-10 - Just a reminder!!

Javed

[zmichl]

Thank you for your answer, I've already searched for the OIDs in the "Ignored Events" dialog. Unfortunately, it seems that there are not all events listed that may occur in the event list. For other events, there are 2 or more entries and I don't know which one is the right one. Do you know any other way to do this?

I'm sorry that I haven't assigned any points so far. In fact, your post was the first time I took notice about this function :)

[Javed Padinhakara]

Alright. This requires some more fiddling then:)

If the 'Origin' of the event is device, then you can usually see the OID by selecting the particular event entry in the "Events" tab, and looking at the "Event Details" sub-window at the bottom. There would be a field named "Event ID" and the value of that would be the OID.

So the event in question : is it a "Device" origin event or one from PCM/IDM/NIM/MM? For the latter, of course there wouldn't be any direct way to infer the OIDs, if applicable..

And can you send across the specific Event description that you are hunting out - I can checkup and see If something comes up as the matching OID for that.

[zmichl]

>There would be a field named "Event ID" and the value of that would be the OID.

This is exactly the place where I thought to remember that I can find the OIDs there. Unfotunately there isn't any info about the OID.
Currently I want to trigger if anybody tries to auth on the switch CLI without success. I get this event in PCM:

"An invalid attempt to authenticate CLI access to this device was detected" - Origin: Device

Yes I know, I could trigger an action by matching a substring of the messsage, but I'd be happier if theres any general way to find the exact OID of an event.

[Javed Padinhakara · Accepted solution]

For this specific event:
>>An invalid attempt to authenticate CLI access to this device was detected

...the OID is "1.3.6.1.4.1.11.2.14.11.5.1.19.1" belonging to the HP-USER-AUTH MIB.

Hope that helps!

ps: The event descriptions shown in PCM are user-friendly strings provided by PCM for the respoctive trap notifications.
There is a crooked way to find out the equivalent OID for each of these messages, but I will have to double check if I can make it public in this forum, owing to disclosure restrictions.If I find there is no harm I will let you know later :)

Javed

[zmichl]

>>If I find there is no harm I will let you know later :)

No need for this, based on your hint, I think I've found a way how to get the Information out of some files of PCM :)

So thank your very much for your help!!!