7 Replies Latest reply: Dec 12, 2012 9:56 AM by ktmrob RSS

Trap Viewer - Conditions

ktmrob

Hi all,

 

Only been playing with Trap Viewer today, so my apologies if this is really obvious!

 

I'm using a Tavve ZoneRanger to obtain traps from cust sites that sit behind a firewall - I'm receiving the traps correctly in Trap Viewer, and have configured individual alerts to generate an email when replication goes offline/online.  This approach is fine for the 3 servers I'm testing - but some customers have up to 200 servers we monitor.  I'm playing around with the 'Conditions' tab to try and have one rule for 'replication offline' etc - but can't seem to get it working.  I'll outline below the traps/config etc :

 

netapp.18825.1.1.1.165=1100165 netapp.18825.1.1.2.165=2 netapp.18825.1.1.3.165=07/12/2012 11:16:36.561 netapp.18825.1.1.4.165=10.208.208.4 netapp.18825.1.1.5.165=4 netapp.18825.1.1.6.165=STORMT_CCL_Bugzilla netapp.18825.1.1.7.165=10 netapp.18825.1.1.8.165=955898268 netapp.18825.1.1.9.165=4149 netapp.18825.1.1.10.165=NMS <-> NRC disconnected for more than 60 seconds netapp.18825.1.1.11.165=0 netapp.18825.1.1.12.165=60 netapp.18825.1.1.13.165=0 netapp.18825.1.1.14.165=1498267188 snmpTrapOID=NETAPP-MIB:netapp.18825.0.1 sysUpTime=18 hours 38 minutes 39.23 seconds experimental.1057.1.0=10.208.208.66 snmpTrapEnterprise=NETAPP-MIB:netapp.18825


 

netapp.18825.1.1.1.168=1100168 netapp.18825.1.1.2.168=1 netapp.18825.1.1.3.168=07/12/2012 11:18:37.561 netapp.18825.1.1.4.168=10.208.208.4 netapp.18825.1.1.5.168=4 netapp.18825.1.1.6.168=STORMT_CCL_smt netapp.18825.1.1.7.168=13 netapp.18825.1.1.8.168=955898204 netapp.18825.1.1.9.168=4149 netapp.18825.1.1.10.168=NMS <-> NRC disconnected netapp.18825.1.1.11.168=0 netapp.18825.1.1.12.168=0 netapp.18825.1.1.13.168=0 netapp.18825.1.1.14.168=1619267188 snmpTrapOID=NETAPP-MIB:netapp.18825.0.1 sysUpTime=18 hours 40 minutes 39.28 seconds experimental.1057.1.0=10.208.208.66 snmpTrapEnterprise=NETAPP-MIB:netapp.18825

 

The highlighted text relates to the servers I am monitoring - they are all in the format STORMT_XXXXXXX - I thought I could configure the trap viewer conditions to look at the alert, and match based on the trap containing 'STORM' - but don't seem to be having much joy.

 

Any help would be greatly appreciated!!

 

Kind regards,

 

Rob

 
  • Re: Trap Viewer - Conditions
    ktmrob

    Anyone?!?!

     

    Got a support ticket open with SolarWinds - and they couldn't resolve the issue over a GoTo meeting either

    • Re: Trap Viewer - Conditions
      mdriskell

      You would need to do one of two things.

       

      If you are simply looking for STORM anywhere in the trap then add *storm* to the trap details tab of the trap rules.

       

      If you need to match specifically on those trap OIDs

      netapp.18825.1.1.6.165=STORMT_CCL_Bugzilla

      netapp.18825.1.1.6.168=STORMT_CCL_smt

      Then you would need to add to the conditions tab netapp.18825.1.1.6.165 Starts With STORM or netapp.18825.1.1.6.168 starts with Storm

      • Re: Trap Viewer - Conditions
        ktmrob

        Hi Mike!

         

        Thanks for replying - was hoping you may shed some light, after seeing your post in the 'Ideas & Feature Requests'.  I'll have a play now - fingers crossed!

      • Re: Trap Viewer - Conditions
        ktmrob

        Hi Mike,

         

        Right I've had a look - but that's not going to work unfortunately.  The trap 'number' increments each time a new trap is received - so in my original post it was :


        netapp.18825.1.1.6.165=STORMT_CCL_Bugzilla


        But the next one would be :


         

        netapp.18825.1.1.6.166=STORMT_CCL_Bugzilla


        So as that is not a unique identifier for the traps - it won't work.  I basically need to create an alert for 'Replication Offline' and 'Replication Online'.  I've included some screenshots if you're able to help please?

        OfflineRep.jpg

        This is the trap received when replication goes offline - I have highlighted the 2 pieces of info that I need to identify, in order for an alert to be generated.  The STORM section of the hostname will remain constant, as will the NMS <-> NRC portion.


        OnlineRep.jpg

        For 'Replication Online' - the hostname remains the same as above (STORM) - but the unique part of the trap here is 'Alert down'


        Any ideas?


        Thanks in advance!


        Rob

        • Re: Trap Viewer - Conditions
          mdriskell

          I'm not aware of any traps that work like that....those numbers should never change as they are unique OIDs..if you get a different one it means a different trap condition is met.  I suggest getting the MIBs uploaded to support so that those OIDs can be translated.

           

          That being said my other comment about matching within the trap details will match any text regardless of which OID it is received within.

          • Re: Trap Viewer - Conditions
            mdriskell

            Looking at your screenshots it appears those numbers are changing.  I have never seen that behavior in traps from any vendor.  Perhaps someone else can shed light on that.

            • Re: Trap Viewer - Conditions
              ktmrob

              Glad it wasn't just me going mad then!

               

              If I match using trap details, I get an email generated for both 'online' and 'offline' as they are matching against 'STORM' in both instances - the 'trap details' seem to operate more like an 'OR' statement - so are not exclusive.

               

              However, thanks to your original suggestion regarding config of the 'conditions' tab - I seem to have got it working by using 'netapp.18825 contains STORM' AND 'netapo.18825 contains Alert down' - and the relevant statement for 'replication offline' seems to also be working

               

              I'm hoping that portion of the trap doesn't increment also!  I'll get the MIB uploaded to support now - but a big thanks to you Mike - seems to be working!!