EVNTWIN Generated SNMP TRAPS

[Peter Graham_1]

We are using EVNTWIN inside of Windows 2000 to generate SNMP traps when certain eventlog entries appear and sending these traps to our SIM server. It seems the SIM simply ignores them. We have verified the trap was recieved by the server itself, but SIM is not acknowleding the fact it heard anything.

We see the server acknowledge other "generic" traps but nothing from EVNTWIN traps. We tried creating a MIB and still no events are generated based on the trap.

Guess the question is, is this possible? Will SIM acknowledge any SNMP traps that are unknown to it? Has anyone had any success trying to implement such a thing?

Thank-you

[David Claypool]

Go to Options --> Events --> Event Filter Settings and check the box to 'Accept Unregistered Events.'

[Peter Graham_1]

That box is checked.

I've tried a different test of using a trap generator and sending a generic trap to the server and still nothing is showing.

Is there any specific requirments or format the traps must adhere to?

Thank-you

[Ivan KOVAC]

hello,

I'm not shure, just idea, what if you register CPQFIX and CPQHOSTB MIB files wich support HP Proliant Generic.

I.

[David Claypool]

Peter: I've just done it myself and it works from EVNTWIN. Are you sure that the event is firing in the first place?

[Peter Graham_1]

Yes Dave, verified the trigger by sending it to another machine running snmputil and the trap is heard by it.

Does the trap community need to match the read/write community used by SIM to manage the server?

I'm using one communtiy string to manage and discover the servers and another for traps.

Thank-you

[Ivan KOVAC]

hello

try to use the same community name used by SIM.

i.

[Peter Graham_1]

Ivan, that doesn't seem to make any difference.

[Greg_204]

It does work if you set it to accept unregistered events, but the description does not come through, making it meaningless. Have you had any luck?

[Peter Graham_1]

Actually we have had very good success with this now.

We too were getting the generic unregistered events coming. So we started to write our own MIB to traslate the incoming trap.

Unfortunately Microsoft didn't do a very good job when considering how they were going to send these traps so it does get a bit messy trying to work with the MIBs.

So far we have managed to translate traps for Performance Log events, Service failing and AD Group membership changes.

[Greg_204]

Hi Peter

Wish I had time to do that... Considering giving up on HP SIM as a bad idea... also only supports SNMP V1, not even 2C yet... seems a bit odd. The web interface is also not very intuative....has frustrated me for a day now.... to long for something that should be so simple

Ciao

[David Claypool]

Peter:

Consider posting your MIBs on the HP SIM Tools and Scripts forum so others may benefit.

Greg:

What is it you think you're missing as far as SNMP versions? All of the data that HP SIM moves back and forth works very well. Long term we're trying to get away from SNMP in favor of WBEM.

[Greg_204]

Howdy David

Last time I looked at SNMP was about 7 years back. Seems to be very good and lightweight and the movement does not seem to be slowing down. With 3 you'll have good security with having to do IPsec tuns and what not. Can also control most vendor equipment by doing the correct sets. WBEM seems a bit heavyweight for my liking... just time how long it takes for the service to start. I know very little about WBEM though... so point me to some whitepapers and I'll have a read.

Btw the following website came to the rescue

http://www.ncomtech.com/Ev2tHelp.html

did an mcompile and a mxmib on their mib and it works like a charm.

I still think HPSIM is fairly cool in the way that it integrates everything. We have Openview in another dept and I'll be forwarding on to them for monitoring by our SMC (Service Managment Centre)... I honestly just became a bit frustrated..

Keep Well

Ciao

G

[Mark_461]

I too am trying to use the ev2t but after compiling their mib I can see it within SIM but the traps are still coming up as unregistered. Am I missing something? Does the SIM service need restarted?

[David Claypool]

Mark:

Compiling "processes" the mib. After the mcompile step you need to use mxmib to register it.

Greg:

Does the ev2t MIB match up with the MS evntwin events?

[SenneVL]

Hi,

I know this is a very old thread, but it contains some interesting information, which I would like to complete for future adventurers who attempt monitoring windows services using HP SIM.

evntwin generates traps that are not compatible with the ev2t MIB

creating a custom MIB for evntwin traps will, in my experience, not be possible due to lacking support for some snmp features adn the huge amount of events that could possibel occur, all creating a custom OID

However: simply installing ev2t and registering the MIB works PERFECTLY.