Reading SNMP Traps

To the Ipswitch web site

Ipswitch Forums
Home      Members   Calendar   Who's On
Welcome Guest ( Login | Register )
      



Reading SNMP TrapsExpand / Collapse
Author
Message
Posted 11/7/2008 7:35:28 AM
Forum Member

Forum MemberForum MemberForum MemberForum MemberForum MemberForum MemberForum MemberForum Member

Group: Forum Members
Last Login: Yesterday @ 6:28:43 AM
Posts: 46, Visits: 254
Hi, I'm setting up traps at the moment and trying to figure out how to get something thats readable by a human. For example I get a trap as follows:

PassiveMonitor.LoggedText:

TrapName=compaq-6032 TrapMajor=6 TrapMinor=6032 CommunityName=mycommunity cpqHoTrapFlags.0=0 1.3.6.1.4.1.232.11.2.11.1.0=0 Packet Type=Trap sysName.0=SERVER1 Protocol Version=SNMPv1 1.3.6.1.2.1.1.5.0=SERVER1 Timetick=60days 00:54:37.33 cpqHeFltTolPowerSupplyChassis.0.1=0 1.3.6.1.4.1.232.6.2.9.3.1.1.0.1=0 Object=1.3.6.1.4.1.232 (compaq)

This is for a power supply failure, which is not really apparent from the text. Is there any way (short of creating individual alerts for every possible trap) that I can get some sort of understandable output?

Post #48502
Posted 11/7/2008 8:09:32 AM
Forum Member

Forum MemberForum MemberForum MemberForum MemberForum MemberForum MemberForum MemberForum Member

Group: Forum Members
Last Login: Yesterday @ 6:28:43 AM
Posts: 46, Visits: 254
Looking at the MIB file, the trap has a description defined:

    cpqHe3FltTolPowerRedundancyLost TRAP-TYPE
        ENTERPRISE compaq
        VARIABLES  { sysName, cpqHoTrapFlags, cpqHeFltTolPowerSupplyChassis }
        DESCRIPTION
            "The Fault Tolerant Power Supplies have lost redundancy for
            the specified chassis."

        --#TYPE "Power Redundancy Lost (6032)"
        --#SUMMARY "The Power Supplies are no longer redundant on Chassis %d."
        --#ARGUMENTS {2}
        --#SEVERITY MAJOR
        --#TIMEINDEX 99
        --#STATE   DEGRADED

        ::= 6032

Can the description and the summary here be referenced in any way?

Post #48509
Posted 11/7/2008 10:16:09 AM
Time Traveler

Time TravelerTime TravelerTime TravelerTime TravelerTime TravelerTime TravelerTime TravelerTime Traveler

Group: Ipswitch Employees
Last Login: 6/30/2009 6:05:30 PM
Posts: 502, Visits: 1,276
Since you have the MIB, put it into the WUG folder structure (see Help for more info) and restart the console app. Now use the Tools and the Trap Import tool to find the traps you want WUG to listen for and select each one. Click the Import button and this will create new Passive monitors for each of them. On the device in question, add any you want WUG to listen for on that device. Now setup an action that uses the %Passive.XXX variables (use Help and search for 'percent') to send the desired information and it will have human readable text from the MIB.

Daniel Donnelly

Post #48516
Posted 11/7/2008 11:15:45 AM
Forum Member

Forum MemberForum MemberForum MemberForum MemberForum MemberForum MemberForum MemberForum Member

Group: Forum Members
Last Login: Yesterday @ 6:28:43 AM
Posts: 46, Visits: 254
Yes, I did that and got the following:

Details of the alert:

PassiveMonitor.DisplayName:

 

HP Compaq Enterprise Traps

----------------------------------------------------------------------------------------------------------

PassiveMonitor.LoggedText:

 

TrapName=compaq-6032 TrapMajor=6 TrapMinor=6032 CommunityName=mypublic cpqHoTrapFlags.0=0 1.3.6.1.4.1.232.11.2.11.1.0=0 Packet Type=Trap sysName.0=SERVER1 Protocol Version=SNMPv1 1.3.6.1.2.1.1.5.0=SERVER1 Timetick=60days 00:54:37.33 cpqHeFltTolPowerSupplyChassis.0.1=0 1.3.6.1.4.1.232.6.2.9.3.1.1.0.1=0 Object=1.3.6.1.4.1.232 (compaq)

----------------------------------------------------------------------------------------------------------

PassiveMonitor.Payload.*

 

%Device.Address=10.1.1.1

%PassiveMonitor.DisplayName=HP Compaq Enterprise Traps

%PassiveMonitor.Payload.TrapName=compaq-6032

%PassiveMonitor.Payload.TrapMajor=6

%PassiveMonitor.Payload.TrapMinor=6032

%PassiveMonitor.Payload.CommunityName=mypublic

%PassiveMonitor.Payload.cpqHoTrapFlags.0=0

%PassiveMonitor.Payload.1.3.6.1.4.1.232.11.2.11.1.0=0

%PassiveMonitor.Payload.Packet Type=Trap %PassiveMonitor.Payload.sysName.0=SERVER1

%PassiveMonitor.Payload.Protocol Version=SNMPv1 %PassiveMonitor.Payload.1.3.6.1.2.1.1.5.0=SERVER1

%PassiveMonitor.Payload.Timetick=60days 00:54:37.33 %PassiveMonitor.Payload.cpqHeFltTolPowerSupplyChassis.0.1=0

%PassiveMonitor.Payload.1.3.6.1.4.1.232.6.2.9.3.1.1.0.1=0

%PassiveMonitor.Payload.Object=1.3.6.1.4.1.232 (compaq)

%PassiveMonitor.Payload.LogicalSource=10.1.1.1

%PassiveMonitor.Payload.PhysicalSource=10.1.1.1

%PassiveMonitor.Payload.EventType=SNMP Trap

 

----------------------------------------------------------------------------------------------------------

PassiveMonitor.Payload.EventType:

 

SNMP Trap

----------------------------------------------------------------------------------------------------------

Full dump:

 

<Invalid percent variable>%PassiveMonitor.*

----------------------------------------------------------------------------------------------------------

This was using all of the %passivemonitor variables as defined in the user guide. Is there another variable that will give the MIB description, or even the MIB #SUMMARY and #STATE?

Post #48524
Posted 11/11/2008 4:36:03 AM
Forum Member

Forum MemberForum MemberForum MemberForum MemberForum MemberForum MemberForum MemberForum Member

Group: Forum Members
Last Login: Yesterday @ 6:28:43 AM
Posts: 46, Visits: 254
So has anyone else had this problem, or do you get the description included? Am I missing something? The mib has been imported, services restarted and trap imported etc but I cant work out how to reference the trap description in any way.

Help please!

Post #48620
Posted 11/12/2008 5:46:25 PM
Time Traveler

Time TravelerTime TravelerTime TravelerTime TravelerTime TravelerTime TravelerTime TravelerTime Traveler

Group: Ipswitch Employees
Last Login: 6/30/2009 6:05:30 PM
Posts: 502, Visits: 1,276
My understanding of MIBs is that any line beginning with "--" is a comment... so, it is not really part of the trap information. The Description field is part of the definition of the MIB and its structure (and MIB browsers show it so a human can figure out what the object defines), but again not part of the information that returned when the trap is generated. I don't think there is any way to have WUG reference those lines in the MIB...

Daniel Donnelly

Post #48708
Posted 11/20/2008 6:48:00 AM
Forum Member

Forum MemberForum MemberForum MemberForum MemberForum MemberForum MemberForum MemberForum Member

Group: Forum Members
Last Login: Yesterday @ 6:28:43 AM
Posts: 46, Visits: 254
Just in case anyones ever interested, I ended up writing a script to pull the trap description from the mib file. You need to tell the script the mib file beforehand, in the one below it is for compaq server traps, and the passive monitor is set to listen for any HP enterprise traps.

The script works by reading in the trap minor number, searching the mib file, then pulling off the description and wrapping it up in an email. Hope this is of use to anyone.

Dim objFile, objFSO, objMessage
Dim strMIBFile, strInputFile, strTrapPayload, strTrapMinor, strTrapSearch
Dim strDescription, strSearchString, strTemp
Dim intFileLine, intDescLine, i, j, intCounter
Dim strSubject, strFrom, strTo, strTextBody, strServer

On error resume next

'MIB file
strMIBFile = "cpqhlth.mib"
strInputFile  = "C:\Program Files\Ipswitch\WhatsUp\Data\Mibs\" + strMIBFile
strTrapPayload = "%PassiveMonitor.LoggedText"

'String to find trap definition in MIB file

If InStr(strTrapPayload, "TrapMinor") > 0 Then
    strTrapMinor = Right(Left (strTrapPayload,InStr(strTrapPayload, "TrapMinor") + 13), 4)
End If

strTrapSearch = "::= " + strTrapMinor

'Email fields
strSubject = "%Device.HostName SNMP Trap Notification"
strFrom = "whatsupgold@yourcompany.com"
strTo = "whoevercares@yourcompany.com"
strTextBody = "" 'defined below once all info is obtained
strServer = "yourmailserver"

intFileLine = 0

Set objFSO = CreateObject("Scripting.FileSystemObject")
Set objFile = objFSO.OpenTextFile(strInputFile, 1)

Do Until objFile.AtEndOfStream
    strSearchString = objFile.ReadLine
    intFileLine = intFileLine + 1
    If InStr(strSearchString, strTrapSearch) > 0 Then
     intDescLine = intFileLine - 20
 End If
Loop
objFile.Close

'intFileLine = intFileLine - 15
Set objFile = objFSO.OpenTextFile(strInputFile, 1)
For i = 1 To intDescLine
 objFile.SkipLine
Next

intCounter = 0
Do Until objFile.AtEndOfStream
    strSearchString = objFile.ReadLine
    intDescLine = intDescLine + 1
    If InStr(strSearchString, "DESCRIPTION") > 0 And intCounter = 0 Then
     intCounter = intCounter + 1
     For j = 1 To 10
   strTemp = objFile.ReadLine
   If InStr(strTemp, "--#") = 0 Then
    strTemp = LTrim(strTemp)
    strDescription = strDescription + strTemp + " "
   Else
    j = 10
   End If
  Next
 End If
Loop
objFile.Close

'Main email body:

strTextBody = "%Device.HostName has reported an incident via an SNMP trap." & chr(13) & chr(13)
strTextBody = strTextBody & "Description: "  & chr(13) & chr(13) & strDescription & chr(13) & chr(13)
strTextBody = strTextBody & "----------------------------------------------------------------------------------------------------------" & chr(13) & chr(13)

strTextBody = strTextBody & "SNMP trap payload: " & chr(13) & chr(13)
strTextBody = strTextBody & "%PassiveMonitor.LoggedText" & chr(13) & chr(13)
strTextBody = strTextBody & "----------------------------------------------------------------------------------------------------------" & chr(13) & chr(13)

strTextBody = strTextBody & "This mail was sent on %System.Date at %System.Time"

'Sending the email alert
Set objMessage = CreateObject("CDO.Message")
objMessage.Subject = strSubject
objMessage.From = strFrom
objMessage.To = strTo
objMessage.TextBody = strTextBody

'==This section provides the configuration information for the remote SMTP server.
'==Normally you will only change the server name or IP.
objMessage.Configuration.Fields.Item _
("http://schemas.microsoft.com/cdo/configuration/sendusing") = 2

'Name or IP of Remote SMTP Server
objMessage.Configuration.Fields.Item _
("http://schemas.microsoft.com/cdo/configuration/smtpserver") = strServer

'Server port (typically 25)
objMessage.Configuration.Fields.Item _
("http://schemas.microsoft.com/cdo/configuration/smtpserverport") = 25

objMessage.Configuration.Fields.Update

'==End remote SMTP server configuration section==

objMessage.Send

Post #48898
« Prev Topic | Next Topic »


Reading This TopicExpand / Collapse
Active Users: 0 (0 guests, 0 members, 0 anonymous members)
No members currently viewing this topic.
Forum Moderators: Dave, Mark Singh, kevin r gillis, Jason Benton, Christian Lawson, Brandon Felger, Tripp Allen, Will Sansbury, Jason Williams, Hush, FTPplanet.com, Hugh Garber, WUP-PM, mmulryan@ipswitch.com, mswimm

PermissionsExpand / Collapse

All times are GMT -5:00, Time now is 7:07pm

Powered By InstantForum.NET v4.1.4 © 2009
Execution: 0.047. 9 queries. Compression Enabled.