|
Re: [nv-l] MIB 2 TRAP
2003-10-13 15:49:05
It's not always simple. But this one is, and it is already done, isn't it?
Since this trap does not say "No FMT found" you already have a definition for it.
The enterprise is already given in the message and you have seen that it is Microsoft, (1.3.6.1.4.1.311.1.1.3.1.1) so that should be enough for you to find it in trapd.conf. Notice also that the message says this is the coldStart trap and that it has 0 arguments.
Well, in SNMP there are five standard traps,
0 coldStart
1 warmStart
2 LinkUP
3 LinkDown
4 Authentication Failure
5 EGP Neighbor Loss
The seventh category, 6, is vendor specific. But this isn't one of those. It is a coldStart.
So what you have here is generic trap 0 sent by enterprise 1.3.6.1.4.1.311.1.1.3.1.1 or Microsoft, which is the trap you get every time the SNMP agent is restarted. It has no variables. You can go into trapd.conf and change the format if you want to, but that's all the info there is to get.
As for other traps from Microsoft or someone else, I recommend you go look for a source of MIBs. If the vendor didn't give you any, try
http://mibdepot.com/ . For Cisco, I recommend you get them directly from ftp://ftp.cisco.com/pub/mibs/ No id or password is required.
When you do get a "No FMT found" message it will tell you everything that is in the trap, including the generic and specific id values and the number and contents of all the variables sent. From that you go to the vendor's website or other source of MIBs and try to locate that specific id in TRAP_TYPE or NOTIFICATION-TYPE statement in a MIB.
HTH
James Shanks
Level 3 Support for Tivoli NetView for UNIX and Windows
Tivoli Software / IBM Software Group
James Shanks
Level 3 Support for Tivoli NetView for UNIX and Windows
Tivoli Software / IBM Software Group
|
| "Bursik, Scott {PBSG}" <Scott.Bursik AT pbsg DOT com>
Sent by: owner-nv-l-digest AT lists.us.ibm DOT com
10/13/2003 01:59 PM
Please respond to nv-l
|
To: "Nv-L (nv-l AT lists.us.ibm DOT com)" <nv-l AT lists.us.ibm DOT com>
cc:
Subject: [nv-l] MIB 2 TRAP
|
NetView 7.1.3 AIX 4.3.3
I have a question that is more than likely a simple one. When I look at my
trapd.log and I see traps come in from hosts that are not defined:
1066067587 3 Mon Oct 13 12:53:07 2003 156.82.241.242 ? Agent Up
with Possible Changes (coldStart Trap) enterprise:ENTERPRISES
(1.3.6.1.4.1.311.1.1.3.1.1) args(0):
How do you take this information and hunt down the correct MIB to extract
the traps out of using the mib2trap utility?
I am attempting to clean up my trapd.log and take some actions on some of
these traps.
Right now I am working with the Microsoft messages and the Dell messages
that come from the Dell OpenManage applications.
Thanks for your assistance,
Scott Bursik
PBSG
|
|
|
