KS-Soft. Network Management Solutions
 FAQFAQ   SearchSearch   MemberlistMemberlist   UsergroupsUsergroups   RegisterRegister    ProfileProfile    Log inLog in 

SNMP Trap not getting the full message

 
Post new topic   Reply to topic    KS-Soft Forum Index -> Configuration, Maintenance, Troubleshooting
View previous topic :: View next topic  
Author Message
operacion



Joined: 05 Mar 2009
Posts: 2

PostPosted: Thu Mar 05, 2009 4:57 am    Post subject: SNMP Trap not getting the full message Reply with quote

Hi. Im getting traps from HP Data Protector with HM 7.78 in Windows 2003. HM gets the trap but only processes the first part.

The problem is Data Protector sends only a message with all the OIDs like this one and I cant configure it to send other than this:
Code:

.iso.org.dod.internet.private.enterprises.11.2.17.2.1.0: INTEGER: 1:
.iso.org.dod.internet.private.enterprises.11.2.17.2.2.0: MACHINE:
.iso.org.dod.internet.private.enterprises.11.2.17.2.3.0:
.iso.org.dod.internet.private.enterprises.11.2.17.2.4.0: Data Protector:
.iso.org.dod.internet.private.enterprises.11.2.17.2.5.0: Normal:
.iso.org.dod.internet.private.enterprises.11.2.17.2.6.0: [Normal] From: MACHINE "SPEC" Time: Thu, Mar 5, 2009 11: 50: 54 AM OB2BAR application on "testing" disconnected.:
.iso.org.dod.internet.private.enterprises.11.2.17.2.7.0:


And HM only reads the first line:
Code:

.iso.org.dod.internet.private.enterprises.11.2.17.2.1.0: INTEGER: 1:


But the interesting part is this one:
Code:

.iso.org.dod.internet.private.enterprises.11.2.17.2.6.0: [Normal] From: MACHINE "SPEC" Time: Thu, Mar 5, 2009 11: 50: 54 AM OB2BAR application on "testing" disconnected.:


Ive tried to configure it to set bad status if a message in that part arrives to HM and filtering but it looks like it doesnt even read more than the first line.

Ive tried with IP Toolss Trap Watcher and I get the same.

Do you have any way to process the OID I want?

Cheers.
Back to top
View user's profile Send private message
KS-Soft Europe



Joined: 16 May 2006
Posts: 2832

PostPosted: Thu Mar 05, 2009 7:37 am    Post subject: Reply with quote

HostMonitor offers several macro variables you may use. quote from the manual:
http://www.ks-soft.net/hostmon.eng/mframe.htm#actions.htm#macro
=============================================
The following variables applicable for "SNMP Trap" test only, they represent parameters of the last filtered message (filtered message is the one that have passed all conditions of the test item filter). When HostMonitor launches action in response to received trap message, it substitutes macro variable with its value pertinent to the trap message being received.
%TrapHost% Represents IP address of the host that have sent the message
%TrapHostInfo% If you have specified host name or description in HOSTINFO.LST file, HostMonitor will get information from the file and replace IP address with appropriate description. See HOSTINFO.LST file for details (it's a text file)
%TrapType% Represents type of the trap. It provides information about generic type and enterprise specific number. Generic type could be one of the following: Cold Start, Warm Start, Link Down, Link Up, Auth Failure, EGP Loss and Specific. Enterprise specific number is only applicable when generic trap type is Enterprise Specific, otherwise enterprise specific number is 0
%TimeTicks% Represents time ticks. Time ticks is the time interval (measured in hundredth of seconds) since the initialization (boot, start-up) of the entity that have sent the trap.
%Enterprise% Enterprise field contains an OBJECT IDENTIFIER which names the device that sends the trap
%EnterpriseName% Using the database of compiled MIB files HostMonitor may translate Enterprise OID from its numeric form to a MIB name. If you need to extend the database, include information about MIBs supported by some specific SNMP enabled device, use MIB Browser
%EnterpriseNameShort% Similar to %EnterpriseName% but shows the name without names of parent nodes.
E.g.

* %Enterprise% = 1.3.6.1.4.1.3955.5
* %EnterpriseName% = iso.org.dod.internet.private.enterprises.linksys.etherHub
* %EnterpriseNameShort% = etherHub

Each trap message may contain one or several variables that provide information about the event. Following macro variables allow you to access that information:
%MibOid% Represents OID (object identifier) of the variable
%MibName% Using the database of compiled MIB files HostMonitor may translate %MibOID% from its numeric form to a MIB name. If you need to extend the database by including information about MIBs supported by some specific SNMP enabled device, use MIB Browser
%MibNameShort% Similar to %MibName% but shows the name of the variable (plus possible index) without names of parent nodes.
E.g.

* %MibOID% = .1.3.6.1.2.1.2.2.1.8.1
* %MibName% = iso.org.dod.internet.mgmt.mib-2.interfaces.ifTable.ifEntry.ifOperStatus.1
* %MibNameShort% = ifOperStatus.1

%MibType% Type of the variable
%MibValue% Variable value
%MibRelative%

Relative value of the variable. This macro is applicable when you check incoming trap messages for some specific variable and compare current value of the variable with its previous value (see "Message contains OID" option in the Trap Filter dialog).
%MibRelative% may represent:

* simple difference between current and previous value (if you use "increases by", "decreases by" or "changes by" compare option)
* relative difference as a percentage of previous value (if you use "increases by (%)", "decreases by (%)" or "changes by (%)" compare option)
* average increase/decrease of the counter per second since previous message (if you use "increases /sec", "decreases /sec" or "changes /sec" compare option)

%TrapAllValues% This macro returns information about ALL variables received within Trap message (%TrapAllValues% returns "oid=value" line(s); if there is more than 1 variable in SNMP Trap message, lines will be separated by #13#10 characters).
Note: %MibOid%, %MibName%, %MibType%, %MibValue% variables provide the information about specific OID variable (if you have set "Message contains OID" option of the test filter) or the information about 1st variable within SNMP Trap packet.
%TrapAllValues_Name% Using the database of compiled MIB files HostMonitor may translate %MibAllValues% from its numeric form to a MIB name. If you need to extend the database by including information about MIBs supported by some specific SNMP enabled device, use MIB Browser.
%TrapAllValues_NameShort% Similar to %TrapAllValues_Name% but shows the name of the variable (plus possible index) without names of parent nodes.
E.g.
if %TrapAllValues% returns
1.3.6.1.2.1.2.2.1.7.1 = 1
1.3.6.1.2.1.2.2.1.2.1.8.1 = 1
then %TrapAllValues_Name% will show
iso.org.dod.internet.mgmt.mib-2.interfaces.ifTable.ifEntry.ifAdminStatus.1 = 1
iso.org.dod.internet.mgmt.mib-2.interfaces.ifTable.ifEntry.ifOperStatus.1 = 1
and %TrapAllValues_NameShort% will return
ifEntry.ifAdminStatus.1 = 1
ifEntry.ifOperStatus.1 = 1
=============================================

Regards,
Max
Back to top
View user's profile Send private message Send e-mail Visit poster's website
operacion



Joined: 05 Mar 2009
Posts: 2

PostPosted: Fri Mar 06, 2009 2:51 am    Post subject: Reply with quote

Thank you very much!

That was very useful. Now Im trying to filter the part of message I need.
Back to top
View user's profile Send private message
KS-Soft Europe



Joined: 16 May 2006
Posts: 2832

PostPosted: Fri Mar 06, 2009 3:00 am    Post subject: Reply with quote

operacion wrote:
Thank you very much!
You are welcome.

operacion wrote:

That was very useful. Now Im trying to filter the part of message I need.

Actually, "Trap filter" window offer enough information to set "Bad" or good status according to received message. http://www.ks-soft.net/hostmon.eng/mframe.htm#tests.htm#snmptrap

Also, I think, you may use "Optional status processing" feature, e.g. you may mark "Use Warning status" option and provide expression like not ('disconnected' in '%TrapAllValues%')
http://www.ks-soft.net/hostmon.eng/mframe.htm#tests.htm#usrstatusprocessing

Regards,
Max
Back to top
View user's profile Send private message Send e-mail Visit poster's website
gapmin



Joined: 22 Sep 2009
Posts: 4

PostPosted: Tue Sep 22, 2009 7:16 am    Post subject: Reply with quote

Hi,

I have a little Problem with "Optional status processing".

The trap contains following information:


i can't use the the "Trap Filter" because only 1.3.6.1.4.1.6876.4.3.301 is avaiable. But I need 1.3.6.1.4.1.6876.4.3.302 and 1.3.6.1.4.1.6876.4.3.305. So I use the following Synatx:
Code:

('1.3.6.1.4.1.6876.4.3.302 = Hostname' in '%TrapAllValues%') and ('1.3.6.1.4.1.6876.4.3.305 = status' in '%TrapAllValues%')


HM will change the status to bad or normal. But "Hostname" will be ignored. The test change to bad, also the "Hostname" doesn't contains.

Why? plz Help us

Thank you
Back to top
View user's profile Send private message MSN Messenger
KS-Soft



Joined: 03 Apr 2002
Posts: 12087
Location: USA

PostPosted: Tue Sep 22, 2009 9:39 pm    Post subject: Reply with quote

Do you mean HostMonitor sets "Warning" status if '%TrapAllValues% contains string with different hostname, e.g. '1.3.6.1.4.1.6876.4.3.302 = wronghostname'?
We cannot reproduce the problem. What version of HostMonitor do you use?

Regards
Alex
Back to top
View user's profile Send private message Visit poster's website
gapmin



Joined: 22 Sep 2009
Posts: 4

PostPosted: Tue Sep 22, 2009 11:45 pm    Post subject: Reply with quote

yes, thats right.
If I use %TrapAllValues% contain '1.3.6.1.4.1.6876.4.3.305 = newstatus', Hostmonitor work correct.

For Testing:
Hostmonitor Version 8.24Beta

For Productive:
Hostmonitor Version 7.07Beta



EDIT:
Hi, I have found an other way without snmp
Thanks for yor help.
Back to top
View user's profile Send private message MSN Messenger
KS-Soft



Joined: 03 Apr 2002
Posts: 12087
Location: USA

PostPosted: Wed Sep 23, 2009 7:43 pm    Post subject: Reply with quote

We tested both versions, work fine.
Strange

Regards
Alex
Back to top
View user's profile Send private message Visit poster's website
Display posts from previous:   
Post new topic   Reply to topic    KS-Soft Forum Index -> Configuration, Maintenance, Troubleshooting All times are GMT - 6 Hours
Page 1 of 1

 
Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum


Powered by phpBB © 2001, 2005 phpBB Group

KS-Soft Forum Index