Absent Member.. Absent Member..
Absent Member..

Trap payload gets "consumed" in trap engine

Hey Experts!

I've loaded CISCO-MAC-NOTIFICATION-MIB and its incidents into NNMi (v10.10) and I'm already obtainning MacFlap incidents as expected but...

1) When I configure message format to include the mac-address contained in it shows "6K" instead of "001ebd364b1b".

2) Again in message formating: Regarding the OID returns a "7", is there a way to "resolve" this into ifDesc that the output in the message is Gi1/0/6 instead of "7"?


I've collected the following outputs

a) switch logging message

b) wireshark capture @ NNMi

c) nnmtrapdump.ovpl -source -t

d) NNMi Incident Custom Atributes

e) NNMi - Incident message - used $* in message format (output in CSV):


Thanks in Advance!

Nuno Marques



!!!!!!!!!!!!!!!!! Switch logging:

Dec 2 20:48:14: %MAC_MOVE-SP-4-NOTIF: Host 001e.bd36.4b1b in vlan 2314 is flapping between port Gi1/0/6 and port Po9




!!!!!!!!!!!!!!!!!!!!!!WIRESHARK Capture@NNMi:

Frame 507: 230 bytes on wire (1840 bits), 230 bytes captured (1840 bits) on interface 0

Ethernet II, Src: CiscoInc_ea:89:80 (00:08:7c:ea:89:80), Dst: Vmware_98:0f:2a (00:50:56:98:0f:2a)

Internet Protocol Version 4, Src:, Dst:

User Datagram Protocol, Src Port: 50868 (50868), Dst Port: 162 (162)

Simple Network Management Protocol

version: v2c (1)

community: ------

data: snmpV2-trap (7)


request-id: 2806754

error-status: noError (0)

error-index: 0

variable-bindings: 7 items

SNMPv2-MIB::sysUpTime.0 ( 835577810

Object Name: (SNMPv2-MIB::sysUpTime.0)

Value (Timeticks): 835577810

SNMPv2-MIB::snmpTrapOID.0 ( (SNMPv2-SMI::enterprises.

Object Name: (SNMPv2-MIB::snmpTrapOID.0)

Value (OID): (SNMPv2-SMI::enterprises.

SNMPv2-SMI::enterprises. ( 001ebd364b1b

Object Name: (SNMPv2-SMI::enterprises.

Value (OctetString): 001ebd364b1b

SNMPv2-SMI::enterprises. (

Object Name: (SNMPv2-SMI::enterprises.

Value (Integer32): 2314

SNMPv2-SMI::enterprises. (

Object Name: (SNMPv2-SMI::enterprises.

Value (Integer32): 7

SNMPv2-SMI::enterprises. (

Object Name: (SNMPv2-SMI::enterprises.

Value (Integer32): 6658

SNMPv2-SMI::enterprises. (

Object Name: (SNMPv2-SMI::enterprises.

Value (Integer32): 835588535


|||||||||||||||||||||| TRAPDUMP@NNMi

C:\Windows\system32>nnmtrapdump.ovpl -source -t
Trap cmnMacMoveNotification (. at 3 de Dezembro de 2016 20:44:23 GMT from PCPRT9RT01A
Version: SNMPv2c
state=HAS_VALUE type=TimeTicks oid=. value=844194738
state=HAS_VALUE type=OBJECT IDENTIFIER oid=. value=.
state=HAS_VALUE type=OCTET STRING oid=. value=6K
state=HAS_VALUE type=INTEGER oid=. value=2314
state=HAS_VALUE type=INTEGER oid=. value=7
state=HAS_VALUE type=INTEGER oid=. value=6658
state=HAS_VALUE type=INTEGER oid=. value=844205463




!!!!!!!!!!!!!!!!!!!!!!!!!!! NNMi - Incident Custom Attributes

. (asn_octetstring)


. (asn_integer)


. (asn_integer)


. (asn_integer)


. (asn_integer)


cia.snmpoid (String)


cia.address (String)

cia.originaladdress (String)

cia.securityGroup.name (String)


cia.securityGroup.uuid (String)






!!!!!!!!!!!!!!!! NNMi - Incident message - used $* in message format (output in CSV):


Severity,Priority,Lifecycle State,Last Occurrence Time,Assigned To,Source Node,Source Object,Category,Family,Origin,Correlation Nature,Message,Notes

Major,None,Registered,02-12-2016 20:48:14, ,PCPRT9RT01A,none,Status,Node,SNMP Trap,Symptom,". 6K, . 2314, . 7, . 6658, . 835588535, cia.snmpoid: ., cia.address:, cia.originaladdress:, cia.securityGroup.name: GS-NETWORK-DC, cia.securityGroup.uuid: 377ac8b1-fb80-492d-8297-f1ec62042aed",

2 Replies
Acclaimed Contributor.
Acclaimed Contributor.

Re: Trap payload gets "consumed" in trap engine

Hi Nuno,

  The issue with the display of the octetstring can be resolved using the configuration file:


Note the header comments:

# This file is used for configuring how particular SNMP trap varbind values of type ASN.1 OCTETSTRING
# are interpreted. The format of the file is a series of trap OID, varbind OID combinations for which
# to always display the value in hex, and not perform the character set conversion of that trap's varbind value
# using the encodings specified in the com.hp.nnm.sourceEncoding JVM property in nms-jboss.properties.
# For trap OID, varbind OID values specified within this file, the value of thevarbind will always be
# displayed as a hex value in the Custom Incident Attribute values on the Incident form.
# This file is only read when the the com.hp.nnm.sourceEncoding JVM system property is uncommented or enabled.
# Changes to this configuration file require a restart of jboss.

  So by adding the line:

.  .

  this should resolve this problem with the "6k" display.   Note you will need to restart NNMi and also enable the "com.hp.nnm.sourceEncoding" property in the  <NnmDataDir>/shared/nnm/conf/props/nms-jboss.properties file.  If its not already enabled.

  As for the mapping of "7" to ifDescr, this is not possible directly.   If the source object of the trap is being set to the interface ( which I sadly doubt ) you could use the event variable for ifDescr.  But without the mapping the source interface won't be known.  In which case if this is important you can run an action script, get the ifDescr from the DB using sql and the varbind value of 7 to identify the ifIndex of the associated interface, and finally create a new trap and send it back into NNMi for display with a suitable message now reporting the new varbind and ifDescr value it would carry.

  I hope this helps

Dave Y

MicroFocus Support
Viewed the Support tips? Search for "(NNMi) Support Tips" and order by Date to get the list
The views expressed in my contributions are my own and do not necessarily reflect the views and strategy of MicroFocus
If you find this or any post resolves your issue, please be sure to mark it as an accepted solution.
Micro Focus Expert
Micro Focus Expert

Re: Trap payload gets "consumed" in trap engine

Hi Nuno,

Is there anything else we could help you with on this discussion thread?

If not, would you mind marking the most appropriate post as Accepted Solution so that we could close this discussion thread? 

This is because we are periodically reviewing the Open discussion threads to determine if any help is expected further on the topic. When it is no more the case, the best is to close the discussion thread by marking the most appropriate post as Accepted solution.

Without any answer, I may proceed and mark Dave's answer as Accepted Solution but the best would be for you to do it yourself if no more help is expected here.

All the best


Micro Focus Customer Support

If you find that this or any post resolves your issue, please be sure to mark it as an accepted solution.

If you are satisfied with anyone’s response please remember to give them KUDOS and show your appreciation.
The opinions expressed above are the personal opinions of the authors, not of Micro Focus. By using this site, you accept the Terms of Use and Rules of Participation. Certain versions of content ("Material") accessible here may contain branding from Hewlett-Packard Company (now HP Inc.) and Hewlett Packard Enterprise Company. As of September 1, 2017, the Material is now offered by Micro Focus, a separately owned and operated company. Any reference to the HP and Hewlett Packard Enterprise/HPE marks is historical in nature, and the HP and Hewlett Packard Enterprise/HPE marks are the property of their respective owners.