Re: Help with unknown Cisco trap...

Great analysis, Joe.  It didn't occur to me to grep our own snmp_mibs directory
because there is no guarantee that we already have the MIB there.  But now Gord
could run mib2trap on rfc1747 and get his trap define via an addtrap command.
Or he could go out to the router and disable the trap.   Your choice now Gord

James Shanks
Tivoli (NetView for UNIX) L3 Support



Joe Fernandez <jfernand AT KARDINIA DOT COM> on 08/19/99 10:34:18 PM

Please respond to Discussion of IBM NetView and POLYCENTER Manager on NetView
      <NV-L AT UCSBVM.UCSB DOT EDU>

To:   NV-L AT UCSBVM.UCSB DOT EDU
cc:    (bcc: James Shanks/Tivoli Systems)
Subject:  Re: Help with unknown Cisco trap...




Hi James and Gord,

James' first answer (long way down) is correct - this trap is not from an
enterprise cisco MIB, it is from a standard MIB.

The leading part of the OID
.iso(1).org(3).dod(6).internet(1).mgmt(2).mib-2(1) locates it in MIB-II as
James presumably deduced in his first answer.

Regarding Gord' s question: "Do MIBs correspond to enterprises or agents?"
- MIBs are DEFINED by the IETF under the standards branch of the OID tree
 .iso(1).org(3).dod(6).internet(1).mgmt(2).mib-2(1)
 as above,  and by vendors under the enterprise branch of the OID tree
 .iso(1).org(3).dod(6).internet(1).private(4).enterprises(1).

An agent will very often IMPLEMENT both kinds of MIBs.

Regarding Gord' s other question: "How can I tell what MIB this trap
belongs to?" -  Your trap OID had .1.3.6.1.2.41 so I did a grep in the
snmp_mibs directory on "mib-2 41"  and got rfc1747, the SNA-SDLC-MIB.
(Could also grep for one of the variable names in the trap.)

The trap is defined in rfc1747, as:
sdlcLSStatusChange    "This trap indicates that the state of an SDLC link
station has transitioned to contacted or discontacted."


"Discontacted" seems to be an IETF Working Group's contribution to
extending the English language   :-)


At 06:11 PM 8/19/99 -0400, you wrote:
>There is no easy way to do that.
>
>But you know the agent for this trap -- it is Cisco.  So if there is a trap
>definition in a MIB for mib2trap to work on, then it will be in a Cisco
MIB --
>the one supported by this router.  So once again you wind up going to
Cisco and
>either reading the doc on this router or asking them.  Or you can go out to
>their web site and see if you can find their MIBs to download or a current
>version of their famous addtrap script (don't know  what they call it) but it
>will add about 400 of their traps to NetView -- just about any one you are
ever
>likely to get.
>
>James Shanks
>Tivoli (NetView for UNIX) L3 Support
>
>
>
>Gord Michaels <gord_michaels AT HOTMAIL DOT COM> on 08/19/99 06:03:59 PM
>
>Please respond to Discussion of IBM NetView and POLYCENTER Manager on NetView
>      <NV-L AT UCSBVM.UCSB DOT EDU>
>
>To:   NV-L AT UCSBVM.UCSB DOT EDU
>cc:    (bcc: James Shanks/Tivoli Systems)
>Subject:  Re: Help with unknown Cisco trap...
>
>
>
>
>Hello and Thanks for the response.
>
>So, what I did what use my MIB Browser tool. I went down through the tree
>until I reached the following:
>
>.iso.org.dod.internet.mgmt.mib-2.snaDLC.sdlc
>(.1.3.6.1.2.41.1)
>
>So, my question is: If I can do this within the MIB Browser, then that means
>I must have the MIB already loaded into netview for that enterprise (or
>agent - Do MIBs correspond to enterprises or agents?)??.
>
>So now, as previously suggested I can perform a mib2trap command and then
>this will update my trapd.conf file and hopefully this will solve the
>problem of the trap having no FMT.
>
>But, how can I tell what MIB this trap belongs to??
>
>Any help appreciated.
>
>Gord.
>
>
>
>>From: James Shanks <James_Shanks AT TIVOLI DOT COM>
>>Reply-To: Discussion of IBM NetView and POLYCENTER Manager on NetView
>>        <NV-L AT UCSBVM.ucsb DOT edu>
>>To: NV-L AT UCSBVM.ucsb DOT edu
>>Subject: Re: Help with unknown Cisco trap...
>>Date: Thu, 19 Aug 1999 09:07:58 -0400
>>
>>The enterprise is not a private one, but mib2, which all current snmp
>>agents
>>support.
>>And from the look of the trap, your Cisco router is trying to tell you
>>something
>>about its SNA interfaces (that's what sdlc is -- "synchronous data link
>>control"
>>-- the link-level protocol for IBM's SNA ).
>>
>>So your Cisco doc should (1) explain this trap and what it means, and (2)
>>how to
>>disable it if you don't want to see it.  Can't find the doc or what you
>>need in
>>it?  Call Cisco.  It's their device.
>>
>>James Shanks
>>Tivoli (NetView for UNIX) L3 Support
>>
>>
>>
>>Gord Michaels <gord_michaels AT HOTMAIL DOT COM> on 08/16/99 03:12:42 PM
>>
>>Please respond to Discussion of IBM NetView and POLYCENTER Manager on
>>NetView
>>       <NV-L AT UCSBVM.UCSB DOT EDU>
>>
>>To:   NV-L AT UCSBVM.UCSB DOT EDU
>>cc:    (bcc: James Shanks/Tivoli Systems)
>>Subject:  Help with unknown Cisco trap...
>>
>>
>>
>>
>>Hello All.
>>
>>Several of my Cisco devices, 4500, 2501, ... are sending me this Unknown
>>trap from enterprise 1.3.6.1.2.41.1. I receive thousands per day. Anyone
>>seen this before????
>>
>>

>>934824039  2  Mon Aug 16 13:20:39 1999 rtr01234                  ? NO FMT
>>IN
>>TRAPD.CONF: mgmt.mib-2.snaDLC.sdlc (1.3.6.1.2.1.41.1) generic:6 specific:2
>>args(7):  [1] sdlcLSOperEntry.sdlcLSOperState.4.193 (Integer): 1
>>934824039  2  Mon Aug 16 13:20:39 1999  rtr01234                  ?  [2]
>>sdlcLSAdminEntry.sdlcLSAdminState.4.193 (Integer): 2
>>934824039  2  Mon Aug 16 13:20:39 1999  rtr01234                  ?  [3]
>>sdlcLSOperEntry.sdlcLSOperLastFailTime.4.193 (Ticks): 881536651
>>934824039  2  Mon Aug 16 13:20:39 1999  rtr01234                  ?  [4]
>>sdlcLSOperEntry.sdlcLSOperLastFailCause.4.193 (Integer): 4
>>934824039  2  Mon Aug 16 13:20:39 1999  rtr01234                  ?  [5]
>>sdlcLSOperEntry.sdlcLSOperLastFailCtrlIn.4.193 (OctetString): 71
>>934824039  2  Mon Aug 16 13:20:39 1999  rtr01234                  ?  [6]
>>sdlcLSOperEntry.sdlcLSOperLastFailCtrlOut.4.193 (OctetString): 93
>>934824039  2  Mon Aug 16 13:20:39 1999  rtr01234                  ?  [7]
>>sdlcLSOperEntry.sdlcLSOperLastFailREPLYTOs.4.193 (Counter): 6156337
>>
>>Sincerely,
>>
>>Gord Michaels
>>
>>
>>______________________________________________________
>>Get Your Private, Free Email at http://www.hotmail.com
>
>
>______________________________________________________
>Get Your Private, Free Email at http://www.hotmail.com
>
Joe Fernandez
Kardinia Software
jfernand AT kardinia DOT com

http://www.kardinia.com