I had to read this four times to fully understand it.  I don't mean to be 
critical, but your terminology here is incorrect and clarifying it will 
help a lot if you want suggestions from others.

"private enterprises" is the standard MIB OID, .1.3.6.1.4.1 or in words, 
"iso.org.dod.internet.private.enterprises".  But that is not what you 
really want. despite what you said.  What you want is really the MIB OID 
of the first variable sent with the  trap.

Your difficulty is that this vendor sends out the same trap for all 
events, and that the traps differ only by the first (and only) variable. 
The have the same enterprise number, and the same generic and specific 
numbers.  Only the first variable, shown by [1] is different. Furthermore, 
that variable is an integer, so there is no text to distinguish on trap 
from another,  and you therefore need to know the full MIB OID which that 
integer is an instance of in order to know what the trap means.  That is 
what you are saying isn't it?

So the $NVE variable is correct.  That is the enterprise value in the 
trap.  What you want is the OID value of that first variable -- that's 
what you highlighted in your original note.   And you are correct -- the 
OIDs of the variables are not passed to nvcorrd (what he gets is a 
structure containing the values of the trap elements but not the OIDs 
which were used to send them), so there are no nvcorrd environment 
variables which you can reference that contain them.  So how can you 
reference the OIDs?  Well, the short answer is that you would have to 
build a script to run out of ovactiond, as an automatic action, on receipt 
of that trap.

Using xnmtrap you can define an automatic action for the trap in question. 
 Suppose you called yours "myscript".  Then in the automatic action field 
you would put:     <full_path>myscript "$+1"
This should pass the OID and the integer value as a string to your script 
in the first variable, which you would reference inside the script as 
simply "$1".   You can do your own processing from there, and either 
re-issue a new trap of your own devising using snmptrap and forward that 
one to TEC, or end your script with a wpostemsg to send your own 
customized event directly.

If you prefer, you could also call myscript with "$-1" which would make 
the variable look like it does now in the trapd.log extract you put in 
your note.  That format includes the variable number in brackets, [1], and 
the value type in parens, (Integer),  if you want to have those items as 
well. 


Hope this helps.

For what it is worth, someone should have a talk with the vendor of this 
product about sending out more meaningful traps.  His method, while simple 
for him, borders on the silly, in my opinion.  Cryptic traps help no one. 
He should not be depending on the MIB OID to identify what the trap is 
about.  He should be supplying some text in another variable or using 
different specific trap numbers to identify them as the rest of the 
industry does.  Can you image Cisco having one trap instead of the 
hundreds they send?  Good heavens, what a nightmare.  My two cents.


James Shanks
Level 3 Support  for Tivoli NetView for UNIX and NT
Tivoli Software / IBM Software Group




"Mahon, Ray" <Ray.Mahon AT itsis DOT ie>
11/12/2002 09:40 AM

 
        To:     "'nv-l AT lists.tivoli DOT com'" <nv-l AT lists.tivoli DOT com>
        cc: 
        Subject:        [nv-l] FW: [NV] NetView:How can one extract 
private.enterprises from a t 
rap



Hi , 
We have just recently installed an environment monitoring system(RIT 
Patchview).  All alerts raised are via SNMP, hence Netview receiving them. 
 The problem
I'm having is that all of there traps are coming in with the same event 
info, i.e. "Event name, Generic Trap no., Specific Trap no." and can not 
be changed?  The only info that does change depending on the problem is 
the return value of the integer, hostname and private.enterprise.
Event: 
                ritAuxIndicatorTable = Event Name 
                                               6 = Generic trap number 
                                         50 = Specific trap number 
Sample Traps: 
                ns_master_ems             A ritAuxIndicatorTable 6 50 1 args:  
[1] 
private.enterprises.663.1.2.4.2.1.3.1.6 (Integer): 2
                ns_master_ems             A ritAuxIndicatorTable 6 50 1 args:  
[1] 
private.enterprises.663.1.2.4.2.1.3.1.6 (Integer): 1
                ns_master_ems             A ritAuxIndicatorTable 6 50 1 args:  
[1] 
private.enterprises.663.1.2.4.2.1.3.1.8 (Integer): 2
                ns_master_ems             A ritAuxIndicatorTable 6 50 1 args:  
[1] 
private.enterprises.663.1.2.4.2.1.3.1.7 (Integer): 2
                ns_master_ems             A ritAuxIndicatorTable 6 50 1 args:  
[1] 
private.enterprises.663.1.2.4.2.1.3.1.9 (Integer): 2
                ns_master_ems             A ritAuxIndicatorTable 6 50 1 args:  
[1] 
private.enterprises.663.1.2.4.2.1.3.1.10 (Integer): 2
                ns_master_ems             A ritAuxIndicatorTable 6 50 1 args:  
[1] 
private.enterprises.663.1.2.4.2.1.3.1.11 (Integer): 2
TRAP Variables: 
The following environment variables are allow: NVE, NVA, NVG, NVS, NVT, 
NVC, NVATTR_1-50 
NVE - only gives the trap enterprise 1.3.6.1.4.1.663.1.2.4.2.  None of the 
above will give the private.enterprise number, unless I missed one. 
When one configures/creates an event you can specific "$*" to display all 
event information, which includes private.enterprise. 
The process I was looking for was looking take was as follows: 
Receive event.
Rule will forward all trap details to a scripts.
This script will evaluate the private.enterprise number.
Generate another more meaningful trap.
Rule to forward trap to TEC.

        IF Not, I'll set-up an ACP over trapd.log. 
Anybody any ideas? 

Tivoli Systems (TSG) ext:2146 
Mobile: 0866017253