SNMP traps sent by EMS

[shanmugt]

How can I set the destination for the SNMP traps generated by EMS.I need to forward the traps to a different host machine.
Do I have to use snmpd.conf or something else?

I tried to set the destination in snmpd.conf but of no use.Can you suggest me some ideas.

[Yang Qin_1]

EMS uses snmpd/snmpdm to send traps. So, by configure snmpd.conf you should be able to receive the trap. Of course you have to configure EMS to send SNMP traps for the events. Double check the config files in /var/stm/config/tools/monitor and make sure you do have SNMP configured as Target Type for those events.

Then you can use /etc/opt/resmon/lbin/send_test_event -a event_name (disk_em for example) to test.

You may also need a good tool to monitor/collect traps on your destination server. Sometimes the traps are sent to the destination host, just because the MIB file is wrong you won't see the events from those event monitor programs. (Tivoli Enterprise Event console, HP OV NM in my case).

Yang

[shanmugt]

Thanks for your information.
By the way where can I get the MIB for EMS.I tried to search in HP site, but I could not get that.
Can you help.

[Yang Qin_1]

You can get EMS SNMP MIB from "EMS) Developer's Kit" http://h20293.www2.hp.com/portal/swdepot/displayProductInfo.do?productNumber=B7611BA

If you captured some traps. You can use the trap to find the MIB by searching in SNMP database.
http://www.assure24.com/databases/snmp-mib/
http://support.ipmonitor.com/snmp_center.aspx

Yang

[shanmugt]

Hi,
Thanks Yang.I got the MIB.

But,I do have an another issue now.I configured the events in the SAM->Resource Management->Event Monitoting Service for few events like LAN status, filesystem status.. with notification type as SNMP.But when I checked this in the /var/stm/config/tools/monitor, I dont find any files being updated with my inputs.So, I tried to change the notification type to MAIL,it works.I reverted back to SNMP, but still I receive the MAILs now.

So, I dont receive any TRAPS though I configured for SNMP.I receive only the MAILs.
How can I overcome this?I even tried to stop the dianostic process and restarted it.
/sbin/init.d/diagnose [stop] [start].

I use the AdventNet SNMP Manager for recording the traps ( with the EMS mib).
I have the correct update in snmpd.conf.
But still I dont recieve any traps.

Is there any log available so that I can check if the SNMP traps are sent/generated.

I also tried to do the config with /etc/opt/resmon/lbin/monconfig for SNMP notifications but no results.

Any suggestions...

[Yang Qin_1]

If you have AdventNet SNMP Manager, you can setup "Trap Viewer" to listen to HP host on port 161.

If you use /etc/opt/resmon/lbin/monconfig to configure Events (with SNMP), it will ask you to save your configure to a new file and you should see several files changed in /var/stm/config/tools/monitor and your new configuration with "Target Type: SNMP" must be in one of those newly created/changed files.

I'm not sure if all traps sent by EMS will be logged but you can have a look at /etc/opt/resmon/log. There are several log files. Your change via SAM normally is recorded there. You can also find some Events logs.

Yang

[shanmugt]

Hi Yang,
I tried now with HP OpenView NNM.
I can see my node with all details,but still I dont see the traps configured in the node for EMS.I tried to check NNM SNMP Operations fro that node.I dont see any graph for the traps sent from the node.

Now, I strongly believe that the traps are not generated from my node in EMS.Iam confused.

/etc/opt/resmon/log contains the log of the events set in EMS GUI but not the SNMP traps send out of the node.

Any views please.I somehow need to get the traps from my node.

By the way , how can I checck the EMS version installed in my HP node.swlist does not help.

[Yang Qin_1]

To see your node information with Openview, you in fact query the information via kind of snmpget command. However, the traps generated by EMS cannot be "queried" with snmpget. EMS traps will be displayed as OpenView alerts.

It may help if you can use the monitor you configured with EMS which could send you an email alert. At least you know that monitor works and you can trigger the alert if you want. Try to configure that one to send SNMP traps instead of email. Use OpenView or the other SNMP tool to capture the traps. Even without a MIB file you sould be able to capture the traps. MIB will help you to understand the traps.

EMS is a part of OnlineDiag, so if you run

swlist -l product OnlineDiag

you will find EMS version information.

Yang

[shanmugt]

Hi Yang,
Thanks for your info.

As already mentioned I can receive the EMS traps through other notification mechanisms like Mail/log.But SNMP traps do not work.

OnlineDiag bundle I use is B.11.11.14.15

I also cross checked the SNMP Manager ( Advent Net ) through the snmptrap utility from my HP UX machine.I can see that trap in my Manager.

But not the traps sent by EMS.
:-(

[Yang Qin_1 · Accepted solution]

I just made a test with EMS, it works for me. You may give it a try:

1.edit /etc/SnmpAgent.d/snmpd.conf add snmp dist (you have done it)

2. restart snmpdm with /sbin/init.d/SnmpMaster stop/start (you may re-start it again, harmless)

3. check daemons needed for EMS SNMP straps
ps -ef|grep -iE "snmp|emsagent"

root 8891 1 0 14:54:24 ? 0:00 /usr/sbin/snmpdm
root 2324 1 0 Oct 5 ? 0:00 /etc/opt/resmon/lbin/emsagent

4. Add SNMP monitor for disk_em
/etc/opt/resmon/lbin/monconfig

-> Select (A)dd a monitoring request.

-> Select 3) /storage/events/disks/default

-> Select the Criteria Threshold:
Criteria Thresholds:
1) INFORMATION 2) MINOR WARNING 3) MAJOR WARNING
4) SERIOUS 5) CRITICAL
Enter selection {or (Q)uit,(H)elp} [4] 1

-> Select the Criteria Operator:
Criteria Operator:
1) < 2) <= 3) > 4) >= 5) = 6) !=
Enter selection {or (Q)uit,(H)elp} [4]

-> Select the Notification Method - SNMP:
Notification Method:
1) UDP 2) TCP 3) SNMP 4) TEXTLOG
5) SYSLOG 6) EMAIL 7) CONSOLE
Enter selection {or (Q)uit,(H)elp} [6] 3

-> Select the defaults for User Comment:
(C)lear (A)dd
Enter selection {or (Q)uit,(H)elp} [c]

Client Configuration File:
(C)lear (A)dd
Use Clear to use the default file.
Enter selection {or (Q)uit,(H)elp} [c]

-> Confirm the request:
New entry:
Send events generated by monitors
/storage/events/disks/default
with severity >= INFORMATION to SNMP

Are you sure you want to keep these changes?
{(Y)es,(N)o,(H)elp} [n] y

5. send test event:
/opt/resmon/bin/send_test_event -v disk_em

6. check if test event has been created:
cat /var/opt/resmon/log/event.log
....
Notification Time: Thu Nov 2 15:11:53 2006

brutest1 sent Event Monitor notification information:

/storage/events/disks/default/0_0_0_3_0.6.0 is >= 1.
Its current value is INFORMATION(1).



Event data from monitor:

Event Time..........: Thu Nov 2 15:11:53 2006
Severity............: INFORMATION
Monitor.............: disk_em
Event #.............: 103
System..............: myhost.at.my.com

Summary:
Disk at hardware path 0/0/0/3/0.6.0 : Test event


Description of Error:

This is a test message from the monitor to test the communication path
from the monitor to the notification mechanism.
.....

7. on my snmp dist server check the captured traps and find the EMS disk_em trap -- you can find the trap details from attachment.

Good luck.
Yang

[shanmugt]

Yang,
Thanks for your attachment.
The problem is the Community name.
I used Public.

From your attachment I found it is hp_trapGroup.

On changing this in the Manager, Iam able to receive the traps in the destination.

Is it possible to change the Community name.

Thanks.

[Yang Qin_1]

I know for dm_fc_hub and dm_fc_sw there is a parameter can be used to set snmp community (however, the default value is public) called SITE_SNMP_GET_COMMUNITY.

You can have a look in the file /var/stm/config/tools/monitor/dm_fc_hub.cfg

For the other monitors, I'm not sure if we can change snmp community and how to change it.

Yang

[shanmugt]

Thanks for your clear vision.
Any idea about the SNMP Version used by EMS.
I consider this is V1.

[Yang Qin_1]

I think if you use SNMP v1 it will work. EMS SNMP traps were created before 1998, I guess they are SNMP v1 traps.