I have a pair of SSG550 and need guidance with the config to send traps/syslog messages to NCM. It is imperative that an alert be sent anytime any change is made on these systems. Thanks in advance.
Hi,
Have you listed all the type of Syslog messages or SNMP Traps that are generated when a change is made on these systems?
This would be the first step.
Then you will have to check what are the variables in these Traps to be sure your rules apply to all of them.
Feel free to post screenshots of the SNMP Traps or Syslog messages you are working on if you need help configuring rules.
If you are trying to setup the Real Time Configuration Change detection, check page 67 of the admin guide:
http://www.solarwinds.com/support/orionNCM/docs/orionNCMAdministratorGuide.pdf
You can generate Traps or Syslog messages on demand using the below utilities during your tests:
Kiwi Syslog Gen: http://www.kiwisyslog.com/kiwi-sysloggen-download/
SNMP Trap Editor in Engineer's Toolset: http://www.solarwinds.com/products/toolsets/
Trapgen: http://www.ncomtech.com/trapgen.html
Thanks,
Yann
If you get anywhere with this issue, please let me know. I also need real-time change detection for my Juniper devices; I currently have it successfully implemented for all Cisco devices. I've had Solarwinds' Head NCM guru working on this issue for weeks - I've upgraded to NCM 7.1 today to resolve and still nothing. Interesting, traps are being received by the NPM Trap service (NPM installed on separate VM) just fine but NCM trap service is seeing the packet come in from the Juniper device and disgarding it. Everyone is quite boggled by this issue
Christina
*** Solarwinds Trap Service v2012.1.12.2305, .Net Runtime v4.0.30319 ***
2012-08-20 10:13:44,161 [StartupThread] INFO SolarWinds.Orion.Core.Common.ModuleCollectionLoader - Loading Module Collection information...
2012-08-20 10:13:48,520 [StartupThread] INFO TrapService.TrapService - Trap ruleset of 1 rule loaded from database at 8/20/2012 10:13:48 AM
2012-08-20 10:13:49,661 [StartupThread] INFO SolarWinds.Orion.Common.SWEventLogging - Solarwinds Trap Service Started
2012-08-20 10:13:49,723 [8] ERROR TrapService.TrapService - Bad Packet (Error code 995) - Winsock error in recv()
2012-08-20 10:23:05,838 [9] ERROR TrapService.TrapService - Bad trap packet received from Node with IP 10.2.96.20. Error description : Unknown user and engine. Packet discarded
2012-08-20 10:24:10,417 [9] ERROR TrapService.TrapService - Bad trap packet received from Node with IP 10.2.96.20. Error description : Unknown user and engine. Packet discarded
2012-08-20 10:24:40,027 [9] ERROR TrapService.TrapService - Bad trap packet received from Node with IP 10.2.96.20. Error description : Unknown user and engine. Packet discarded
2012-08-20 10:35:10,643 [9] ERROR TrapService.TrapService - Bad trap packet received from Node with IP 10.2.96.20. Error description : Unknown user and engine. Packet discarded
2012-08-20 10:36:23,081 [9] ERROR TrapService.TrapService - Bad trap packet received from Node with IP 10.2.96.20. Error description : Unknown user and engine. Packet discarded
Do your Juniper devices have "startup" or "running" config? I remember someone also had troubles with RTCD and Juniper and the reason was that his Juniper device didn't have any of those two.
Regards,
Jiri