How to correlate a "clearing" SNMP trap with a previous error

[DanielJanzon]

I have an SNMP trap with a specific OID that comes in two forms, sometimes with a "status" variable binding inidcating a fault, and sometimes with a status indicating that the entity is no longer in a state of error (i.e. "clear" previous error).

Looking into Incidents -> Pairwise Configuration  it seems to  me as if I have to create two incidents from the traps mentioned above.

Going into Incidents -> SNMP Trap Configurations I tried to create two incidents, one suppressing traps with the status var binding indicating "clear" and one suppressing traps with the opposite status indicating a fault.

But I am unable to create two incidents with the same SNMP Object ID! NNMi does not allow me to do it.

So how should I do? My basic concern is that I don't want to show incidents in "My Open Incidents" when they have received a clear from the SNMP agent in question.

[Dave Young · Accepted solution]

Daniel,

  Firstly you need to be using NNMi 9.2.

  Then for the trap configuration you simply need to either load the MIB that defines it and then load the trap definition from the loaded MIB, or you can create the trap entry manually.  You only need to add the one trap.

  Then in the pairwise configuration you specify the trap OID for both the first ( child ) and second ( parent ) trap.  You then use the parent and child tabs to specify how the two are identified - the value of the status varbind.  Check out the default PairWise entry of  Lineproto-5-UpDownPair   which uses this same technique.

  If you want to delay the child trap from being displayed for a period of time to see if its canceled by a parent coming in,  then use the  dampening not the suppression, which will not display the trap at all, configuration tab.

  All the best

Dave Y

[DanielJanzon]

Thanks! That worked perfectly 🙂

Just one additional question: As 9.2 is required for this, would you say that a trap design with separate traps for cancellation of errors is better? Or does that come with some other drawback. I'm thinking some customers may sit on older releases and will be reluctant to upgrade their system. The question is relevant as I have control of the traps that are sent.

[Dave Young]

Daniel,

 I don't think either is actually better.  However if you are designing the traps at this time and want to be able to run them against all the NNMi versions  i.e. 8.13, 9.0x, 9.1x, 9.2x  then I would suggest different traps for alerting and clearing.  It was only at 9.20 that the one trap with differing varbind values could be configured into a pairwise configuration.  If you are only writing for 9.20 and above then either is just as good.

  All the best

Dave Y