Forwarding events from HP SIM to IBM Tivoli

[Imad]

We are sending a management agent test trap from Windows server to HPSIM. The event is getting forwarded to Tivoli successfully but it is showing up as severity 1. Test traps are Major event and we would like it to appear as severity 5.

Customer is not using the HPSIM integration with Tivoli, he is just forwarding and using few HP SIM MIBs.

Does he need to import all HP SIM MIBs and create rules in Tivoli.  Can he just set the severity to default as severity 4 or more.

Any advise is appreciated.

Below is a sample of the event received by Tivoli.

2012-10-03T16:46:59: Debug: D-UNK-000-000: Rules file processing took 710 usec.
2012-10-03T16:46:59: Debug: D-UNK-000-000: Flushing events to object servers
2012-10-03T16:46:59: Debug: D-UNK-000-000: Waiting for flush acknowledge for server USRD0P0ALLP.
2012-10-03T16:46:59: Debug: D-UNK-000-000: Received flush acknowledge for server xxxxxxxALLP.
2012-10-03T16:46:59: Debug: D-P_M-105-000: 1 trap in queue
2012-10-03T16:46:59: Debug: D-P_M-105-000: V1 trap received
2012-10-03T16:46:59: Information: I-P_M-104-000: Number of items in the trap queue is 0
2012-10-03T16:46:59: Debug: D-UNK-000-000: In var_to_text: buf=xxxxBLD001

2012-10-03T16:46:59: Debug: D-UNK-000-000: In var_to_text: buflen=11

2012-10-03T16:46:59: Debug: D-UNK-000-000: In var_to_text: buf=Management Agents Test Trap sent - Wednesday, October 03, 2012 4:51:25 PM

2012-10-03T16:46:59: Debug: D-UNK-000-000: In var_to_text: buflen=73

2012-10-03T16:46:59: Debug: D-UNK-000-000: [Event Processor] ReqId:     0
2012-10-03T16:46:59: Debug: D-UNK-000-000: [Event Processor] enterprise:        .1.3.6.1.4.1.232
2012-10-03T16:46:59: Debug: D-UNK-000-000: [Event Processor] generic-trap:      6
2012-10-03T16:46:59: Debug: D-UNK-000-000: [Event Processor] specific-trap:     11003
2012-10-03T16:46:59: Debug: D-UNK-000-000: [Event Processor] UpTime:    144021656
2012-10-03T16:46:59: Debug: D-UNK-000-000: [Event Processor] Uptime:    16 days, 16:03:36.56
2012-10-03T16:46:59: Debug: D-UNK-000-000: [Event Processor] community: public
2012-10-03T16:46:59: Debug: D-UNK-000-000: [Event Processor] IPaddress: xxx.xx.xx.40
2012-10-03T16:46:59: Debug: D-UNK-000-000: [Event Processor] PeerIPaddress:     xx.xx.xx.78
2012-10-03T16:46:59: Debug: D-UNK-000-000: [Event Processor] ReceivedPort:      162
2012-10-03T16:46:59: Debug: D-UNK-000-000: [Event Processor] ReceivedTime:      1349297219
2012-10-03T16:46:59: Debug: D-UNK-000-000: [Event Processor] Protocol:  UDP
2012-10-03T16:46:59: Debug: D-UNK-000-000: [Event Processor] SNMP_Version:      1
2012-10-03T16:46:59: Debug: D-UNK-000-000: [Event Processor] OID1:      .1.3.6.1.2.1.1.5.0
2012-10-03T16:46:59: Debug: D-UNK-000-000: [Event Processor] 1: xxxxBLD001
2012-10-03T16:46:59: Debug: D-UNK-000-000: [Event Processor] 1_raw:     xxxxBLD001
2012-10-03T16:46:59: Debug: D-UNK-000-000: [Event Processor] 1_text:    xxxxBLD001
2012-10-03T16:46:59: Debug: D-UNK-000-000: [Event Processor] 1_hex:     4d 43 46 50 50 42 4c 44 30 30 31
2012-10-03T16:46:59: Debug: D-UNK-000-000: [Event Processor] .1.3.6.1.2.1.1.5.0:        xxxxBLD001
2012-10-03T16:46:59: Debug: D-UNK-000-000: [Event Processor] OID2:      .1.3.6.1.4.1.232.11.2.11.1.0
2012-10-03T16:46:59: Debug: D-UNK-000-000: [Event Processor] 2: 0
2012-10-03T16:46:59: Debug: D-UNK-000-000: [Event Processor] 2_raw:     0
2012-10-03T16:46:59: Debug: D-UNK-000-000: [Event Processor] 2_text:    0
2012-10-03T16:46:59: Debug: D-UNK-000-000: [Event Processor] 2_hex:     0
 
4:59:31 PM: xxxx@xxx.com - name/Poughkeepsie/IBM: 2012-10-03T16:46:59: Debug: D-UNK-000-000: [Event Processor] .1.3.6.1.4.1.232.11.2.11.1.0:      0
2012-10-03T16:46:59: Debug: D-UNK-000-000: [Event Processor] OID3:      .1.3.6.1.4.1.232.11.2.8.1.0
2012-10-03T16:46:59: Debug: D-UNK-000-000: [Event Processor] 3: Management Agents Test Trap sent - Wednesday, October 03, 2012 4:51:25 PM
2012-10-03T16:46:59: Debug: D-UNK-000-000: [Event Processor] 3_raw:     Management Agents Test Trap sent - Wednesday, October 03, 2012 4:51:25 PM
2012-10-03T16:46:59: Debug: D-UNK-000-000: [Event Processor] 3_text:    Management Agents Test Trap sent - Wednesday, October 03, 2012 4:51:25 PM
2012-10-03T16:46:59: Debug: D-UNK-000-000: [Event Processor] 3_hex:     4d 61 6e 61 67 65 6d 65 6e 74 20 41 67 65 6e 74 73 20 54 65 73 74 20 54 72 61 70
20 73 65 6e 74 20 2d 20 57 65 64 6e 65 73 64 61 79 2c 20 4f 63 74 6f 62 65 72 20 30 33 2c 20 32 30 31 32 20 34 3a 35 31 3a 32 35 20 50 4d
2012-10-03T16:46:59: Debug: D-UNK-000-000: [Event Processor] .1.3.6.1.4.1.232.11.2.8.1.0:       Management Agents Test Trap sent - Wednesday, October 03,
 2012 4:51:25 PM
2012-10-03T16:46:59: Debug: D-UNK-000-000: [Event Processor] Node:      xxx.xx.ca
2012-10-03T16:46:59: Debug: D-UNK-000-000: [Event Processor] PeerAddress:       xx.xx.ca
2012-10-03T16:46:59: Debug: D-UNK-000-000: [Event Processor] EventCount:        3
2012-10-03T16:46:59: Debug: D-UNK-000-000: [Event Processor] Processing alert {0 remaining}
2012-10-03T16:46:59: Debug: D-UNK-000-000: <<<<< (snmptrap.rules) Event is an enterprise-specific trap. >>>>>
2012-10-03T16:46:59: Information: I-UNK-000-000: These are the fields set before sending to OMNIbus for event with class .
2012-10-03T16:46:59: Information: I-UNK-000-000:     Identifier       : xxxxxxxxxxxx
2012-10-03T16:46:59: Information: I-UNK-000-000:     Summary          : Enterprise: .1.3.6.1.4.1.232  Generic Trap:6  Specific Trap:11003
2012-10-03T16:46:59: Information: I-UNK-000-000:     Severity         : 1
2012-10-03T16:46:59: Information: I-UNK-000-000:     Manager          : MTTrapd Probe
2012-10-03T16:46:59: Information: I-UNK-000-000:     Node             : xxxxx.xxx.ca
2012-10-03T16:46:59: Information: I-UNK-000-000:     NodeAlias        : xxx.xx.xx.40
2012-10-03T16:46:59: Information: I-UNK-000-000:     Agent            : mttrapd

[Buggsy]

I believe the severity is going to be up to Tivoli. I haven't seen Tivoli in a long time, but it should be reciveing the same SNMP trap that SIM is getting. Without MIBs, it won't know how to read the trap and assign a severity. There shouldn't be any harm in importing all of them, that way you can be sure that it isn't reling in part on another MIB.