capture snmp traps for link down on serial interfaces (cisco)

wangotango

hello

i'm not sure if this is the right forum.  if not, let me know which one is best and i'll repost it.

i'd like to capture an snmp trap if a serial interface (or any really) goes down, and have it fire an email etc.  i'm having problems identifying the right message, and deciphering the MIB/SNMP trap message in my viewer. 

1.)  i need to filter only link down/up, and email that.  not sure what mib/mibs i need to filter on.  when i did a shut/no shut, it looks like its a mib for manual change.  how can i test the real thing?

2.)  i need to 'decode' the message.  right now, the ones i look at dont mean squat.  for example, if i do a manual shut/no shut, i get an snmp trap captured, but it doesn't say anything like 'link down' etc.  i understand i could add this to the message.  the information shown really doesn't help if i send the raw message (shown below).  however, as shown above, i'm not sure what mibs i need to capture.

3/3/2008 1:00 PM 12.85.21.54:12.85.21.54  CISCO-CONFIG-MAN-MIB:ciscoConfigManEvent  SNMP Trap
     Received Time:3/3/2008 1:00:53 PM
     Source:1.2.3.4(1.2.3.4)
     Community:SNMPTESTUser
     Variable Bindings
          sysUpTime:= 92 days 17 hours 41 minutes 9.68 seconds (801246968)
          snmpTrapOID:= CISCO-CONFIG-MAN-MIB:ciscoConfigManEvent (1.3.6.1.4.1.9.9.43.2.0.1)
          ccmHistoryEventCommandSource.39:= commandLine(1) (1)
          ccmHistoryEventConfigSource.39:= 2
          ccmHistoryEventConfigDestination.39:= 3
          experimental.1057.1:= 1.2.3.4
          snmpTrapEnterprise:= CISCO-CONFIG-MAN-MIB:ciscoConfigManMIBNotificationPrefix (1.3.6.1.4.1.9.9.43.2)
 

 

thanks so much in advance. 

Ralphr

It looks like you need to enable your Cisco device to send link up link down traps.  The trap you are seeing is a configuration trap and is being generated because you are going into and out of config mode on the router to shutdwon the interface.