Readable/usable SNMP traps?
Is it possible to have WhatsUp Gold send email actions that contain the human-readable info for a particular SNMP trap that exists in the MIB for that trap? For example, one trap I'm trying to get more specific info for is Cisco's err-disable trap in the CISCO-ERR-DISABLE-MIB.my file. This file contains the following code section that details the reason that the port was put in the err-disable state:
SYNTAX INTEGER {
udld (1),
bpduGuard (2),
channelMisconfig (3),
pagpFlap (4),
dtpFlap (5),
linkFlap (6),
l2ptGuard (7),
dot1xSecurityViolation (8),
portSecurityViolation (9),
gbicInvalid (10),
dhcpRateLimit (11),
unicastFlood (12),
vmps (13),
stormControl (14),
inlinePower (15),
arpInspection (16),
portLoopback (17)
}
However, when I select every available variable in the right-click menu on the "mail content" tab when I'm creating the alert, all I get in the email is this:
Received a trap from xxx (x.x.x.x).
Event Type: SNMP Trap
Payload: %Device.Address=x.x.x.x
%PassiveMonitor.DisplayName=Any
%PassiveMonitor.Payload.TrapName=cErrDisableNotificationsPrefix-1
%PassiveMonitor.Payload.TrapMajor=6
%PassiveMonitor.Payload.TrapMinor=1
%PassiveMonitor.Payload.1.3.6.1.4.1.9.9.548.1.3.1.1.2.10117.0=2
%PassiveMonitor.Payload.Object=1.3.6.1.4.1.9.9.548.0.1 (cErrDisableNotificationsPrefix) %PassiveMonitor.Payload.Timetick=165days 06:11:36.72 %PassiveMonitor.Payload.Packet Type=Trap %PassiveMonitor.Payload.Protocol Version=SNMPv1 %PassiveMonitor.Payload.CommunityName=xx
%PassiveMonitor.Payload.cErrDisableIfStatusCause.10117.0=2
%PassiveMonitor.Payload.LogicalSource=x.x.x.x
%PassiveMonitor.Payload.PhysicalSource=x.x.x.x
%PassiveMonitor.Payload.EventType=SNMP Trap
Display Name: Any
Logged Text: TrapName=cErrDisableNotificationsPrefix-1 TrapMajor=6 TrapMinor=1 1.3.6.1.4.1.9.9.548.1.3.1.1.2.10117.0=2 Object=1.3.6.1.4.1.9.9.548.0.1 (cErrDisableNotificationsPrefix) Timetick=165days 06:11:36.72 Packet Type=Trap Protocol Version=SNMPv1 CommunityName=xx cErrDisableIfStatusCause.10117.0=2
Logical Source: xx
Physical Source: xx
----------------------------------------
This mail was sent on December 16, 2011 at 04:51:24 PM Ipswitch WhatsUp Gold
Are there other variables that I can use in the email text that aren't on the right-click menu? Or is there any other solution to getting human-readable data from Cisco SNMP traps such as the interface that was set to err-disable, or the reason?
- 1,720 views
- 1 version
- 5 replies
- 2 followers
- Post Date:
- December 16, 2011
- Posted By:
- Jeff Morello
About this forum
- 142k views
- 2222 topics
- 55 followers
Post questions and find answers for all things related to the Standard and Premium Editions of WhatsUp gold.
Page Options
5 Replies
Sorry for the delayed response Jeff. Looking through what you posted, I don't see any where within the trap that contains the information that you are looking for. Since you were able to generate an email, i am going to assume that you have captured these traps within WUG. What information do you get from the SNMP Trap report for the target device? That should contain the entire payload of the trap.
Hi Jason,
When I look at the payload in the SNMP Trap Log, this is what I see:
TrapName=cErrDisableNotificationsPrefix-1
TrapMajor=6
TrapMinor=1
1.3.6.1.4.1.9.9.548.1.3.1.1.2.10117.0=2
Object=1.3.6.1.4.1.9.9.548.0.1 (cErrDisableNotificationsPrefix)
Timetick=165days 05:06:06.71
Packet Type=Trap
Protocol Version=SNMPv1
CommunityName=xxxxxx
cErrDisableIfStatusCause.10117.0=2
The method I was using to test this trap was having bpduguard disable the port. In that enumeration from the MIB, bpduguard is number 2, and I think that is shown in the last line of the trap payload "cErrDisableIfStatusCause.10117.0=2"
I think you may be right, but I am worried about the trailing numbers after the definition. I wonder if there is something wrong with the MIB file. Do you know which version of the MIB file you have? There is one for SNMP v1 and a different one for SNMP v2. I will try to take a look at the MIBs and see if anything sticks out at me (might be a day or 2 though).
I tried having the Cisco device send the trap in SNMP version 2c instead and had the same result. I just went to try to re-downloading the MIB file from the WUG website, and I noticed that this MIB (CISCO-ERR-DISABLE) isn't in the cisco-mibs.zip file. All of the files in the WhatsUp\Data\Mibs directory have the same last modified date, so I'm assuming it was there by default when we installed WUG.
Is it possible that this MIB isn't supported anymore?
Ok, so there is nothing wrong with the MIB, nor should there really ever be a case where a MIB is no longer supported. That said, I learned something new today!!!
The isn't a problem with anything. What you are looking to do, isn't currently supported within Passive Monitors. Basically, the way it works is, no translation or lookup is done on any of the values. Only the OIDs to the left for the = is translated.
First thing I would recommend would be to a something in the Product Ideas section for doing translations/lookups on OID values in traps.
I do have a couple of suggested workarounds that will hopefully get you close enough to what you are looking for. BTW, I have attached the latest version of the MIB, simply becuase the enumeration table has 35 entries now.
Option 1 (easiest) - The easiest and quickest workaround would be to simply add the enumeration table to your email. So whenever you received a trap notification you could look it up right there.
Option 2 - This one is going to take some configuration work. Basically you would create a separate passive monitor for each value in the enumeration table and name the passive monitor whatever the value name is. You will need to add a value in the match on section to specify each individual value. Attached is a screenshot of what the configuration might look like. You could then use the %PassiveMonitor.DisplayName in the subject or at the top of the message to know which one it was.
Let me know if you have any questions. Would also like to know what path you end up choosing.
Attachments
Would you like to comment?
You must be a member. Sign In if you are already a member.