Absent Member.
Absent Member.
2625 views

How to correlate a "clearing" SNMP trap with a previous error

Jump to solution

I have an SNMP trap with a specific OID that comes in two forms, sometimes with a "status" variable binding inidcating a fault, and sometimes with a status indicating that the entity is no longer in a state of error (i.e. "clear" previous error).

 

Looking into Incidents -> Pairwise Configuration  it seems to  me as if I have to create two incidents from the traps mentioned above.

 

Going into Incidents -> SNMP Trap Configurations I tried to create two incidents, one suppressing traps with the status var binding indicating "clear" and one suppressing traps with the opposite status indicating a fault.

 

But I am unable to create two incidents with the same SNMP Object ID! NNMi does not allow me to do it.

 

So how should I do? My basic concern is that I don't want to show incidents in "My Open Incidents" when they have received a clear from the SNMP agent in question.

Tags (3)
0 Likes
1 Solution

Accepted Solutions
Fleet Admiral
Fleet Admiral

Daniel,

 

  Firstly you need to be using NNMi 9.2.

 

  Then for the trap configuration you simply need to either load the MIB that defines it and then load the trap definition from the loaded MIB, or you can create the trap entry manually.  You only need to add the one trap.

 

  Then in the pairwise configuration you specify the trap OID for both the first ( child ) and second ( parent ) trap.  You then use the parent and child tabs to specify how the two are identified - the value of the status varbind.  Check out the default PairWise entry of  Lineproto-5-UpDownPair   which uses this same technique.

 

  If you want to delay the child trap from being displayed for a period of time to see if its canceled by a parent coming in,  then use the  dampening not the suppression, which will not display the trap at all, configuration tab.

 

  All the best

 

Dave Y

MicroFocus Support
Viewed the Support tips? Search for "(NNMi) Support Tips" and order by Date to get the list
The views expressed in my contributions are my own and do not necessarily reflect the views and strategy of MicroFocus
If you find this or any post resolves your issue, please be sure to mark it as an accepted solution.

View solution in original post

3 Replies
Fleet Admiral
Fleet Admiral

Daniel,

 

  Firstly you need to be using NNMi 9.2.

 

  Then for the trap configuration you simply need to either load the MIB that defines it and then load the trap definition from the loaded MIB, or you can create the trap entry manually.  You only need to add the one trap.

 

  Then in the pairwise configuration you specify the trap OID for both the first ( child ) and second ( parent ) trap.  You then use the parent and child tabs to specify how the two are identified - the value of the status varbind.  Check out the default PairWise entry of  Lineproto-5-UpDownPair   which uses this same technique.

 

  If you want to delay the child trap from being displayed for a period of time to see if its canceled by a parent coming in,  then use the  dampening not the suppression, which will not display the trap at all, configuration tab.

 

  All the best

 

Dave Y

MicroFocus Support
Viewed the Support tips? Search for "(NNMi) Support Tips" and order by Date to get the list
The views expressed in my contributions are my own and do not necessarily reflect the views and strategy of MicroFocus
If you find this or any post resolves your issue, please be sure to mark it as an accepted solution.

View solution in original post

Absent Member.
Absent Member.

Thanks! That worked perfectly 🙂

 

Just one additional question: As 9.2 is required for this, would you say that a trap design with separate traps for cancellation of errors is better? Or does that come with some other drawback. I'm thinking some customers may sit on older releases and will be reluctant to upgrade their system. The question is relevant as I have control of the traps that are sent.

Tags (2)
0 Likes
Fleet Admiral
Fleet Admiral

Daniel,

 

 I don't think either is actually better.  However if you are designing the traps at this time and want to be able to run them against all the NNMi versions  i.e. 8.13, 9.0x, 9.1x, 9.2x  then I would suggest different traps for alerting and clearing.  It was only at 9.20 that the one trap with differing varbind values could be configured into a pairwise configuration.  If you are only writing for 9.20 and above then either is just as good.

 

  All the best

 

Dave Y

MicroFocus Support
Viewed the Support tips? Search for "(NNMi) Support Tips" and order by Date to get the list
The views expressed in my contributions are my own and do not necessarily reflect the views and strategy of MicroFocus
If you find this or any post resolves your issue, please be sure to mark it as an accepted solution.
0 Likes
The opinions expressed above are the personal opinions of the authors, not of Micro Focus. By using this site, you accept the Terms of Use and Rules of Participation. Certain versions of content ("Material") accessible here may contain branding from Hewlett-Packard Company (now HP Inc.) and Hewlett Packard Enterprise Company. As of September 1, 2017, the Material is now offered by Micro Focus, a separately owned and operated company. Any reference to the HP and Hewlett Packard Enterprise/HPE marks is historical in nature, and the HP and Hewlett Packard Enterprise/HPE marks are the property of their respective owners.