Community
- Command Central
- MVP Program
- Monthly Mission
- Blogs
- Groups
- Events
- Media Vault
Products
- Observability
- Network Management
- Application Management
- IT Security
- IT Service Management
- System Management
- Database Management
Content Exchange
- SolarWinds Platform
- Server & Application Monitor
- Database Performance Analyzer
- Server Configuration Monitor
- Network Performance Monitor
- Network Configuration Manager
- SQL Sentry
- Web Help Desk
Free Tools & Trials
Store

Parsing SNMP Traps

We have a server which sends out different errors using the same generic OID. What I need to do is configure SNMP Trap Viewer to pattern match against the message in the OID. For instance the same OID could give either error:

=============================================================
sysUpTime=88 days 10 hours 14 minutes 0.07 seconds
snmpTrapOID=CISCO-LATITUDE-MIB:meetingplaceEventsV2.0.6
mpExCode=196945
mpSysUnit=0
mpAlarmDesc=Multiple failed login attempts on non-existent profile, port=XXX
experimental.1057.1=xxx.xxx.xxx.xxx
snmpTrapEnterprise=CISCO-LATITUDE-MIB:meetingplaceEvents

sysUpTime=88 days 10 hours 14 minutes 0.07 seconds
snmpTrapOID=CISCO-LATITUDE-MIB:meetingplaceEventsV2.0.6
mpExCode=196945
mpSysUnit=0
mpAlarmDesc=Too many attempts to log into profile (1234567)
experimental.1057.1=xxx.xxx.xxx.xxx
snmpTrapEnterprise=CISCO-LATITUDE-MIB:meetingplaceEvents
=============================================================

I'd like to create a pattern matching alert based upon the mpAlarmDesc field. Any thoughts on how I can accomplish this?

Thanks!

Find more posts tagged with

Accepted answers

All comments

joehanly

Please refer to this link You need to setup trap filters

http://www.solarwinds.com/NetPerfMon/SolarWinds/wwhelp/wwhimpl/js/html/wwhelp.htm

Regards

Joe Hanly

Solarwinds Support Enginner

joehanly

Configuring Trap Viewer Filters and Alerts
The Trap Viewer can be configured to signal Orion alert actions when trap messages that are received from network devices match defined rules. The following steps establish rules to filter trap messages and initiate alert actions as you determine.
To configure Trap Viewer filters and alerts:
1. Click Start > All Programs > SolarWinds Orion > Trap Viewer.
2. Click File > Settings.
3. Click Alerts / Filter Rules.
Note: Alerts / Filter Rules may also be accessed by clicking View > Alerts/Filter Rules.
4. If you are creating a new rule, click Add New Rule.
5. If you are editing an existing rule, click Edit Rule.
6. Click General tab,
7. Enter a Rule Name, and then check Enabled to enable the rule.
8. Select appropriate servers from the Apply this Rule to list.
9. Enter the IP addresses or subnets to which this rule applies.
Note: Use the examples listed on this tab to format the list properly.
10. If you want the rule to be limited to messages from specific hosts, domains, or hostname patterns, click DNS Hostname, and then enter a DNS Hostname Pattern.
Note: When Use Regular Expressions in this Rule is checked, regular expressions can be used in place of “like” statements. For more information about regular expressions, see “Regular Expression Pattern Matching Examples”.
11. If you want the rule to be limited to specific community strings or text within a trap message, click Message, and then enter rules Community String Pattern.
Notes:
•
Use the examples listed on this tab to format the list properly.
•
When Use Regular Expressions in this Rule is checked, regular expressions can be used in place of “like” statements. For more information about regular expressions, see “Regular Expression Pattern Matching Examples”.
12. Click Conditions, and then generate trigger conditions for rule application in the text field as follows:
•
Select appropriate object identifiers and comparison functions from the linked context menus.
•
Click the ellipsis to Insert an “OR” condition, to Insert an “AND” condition, or to Delete a condition as necessary.
Note: For more information about conditions and condition groups, see “Understanding Condition Groups”.
13. If you want to limit rule application to within a specific period of time, click Time of Day, check Enable Time of Day checking, enter the time period, and then select days of the week on which to apply the rule.
Notes:
•
Enabling Time of Day checking creates more overhead for the CPU.
•
Messages received outside the specified timeframe will not trigger alerts.
14. If you want to suppress alert actions until a specified number of traps arrive that match the rule, click Trigger Threshold, check Define a Trigger Threshold for this Rule, and then enter option values as appropriate.
Note: When Suspend further Alert Actions for is checked, alert actions are not sent until the specified amount of time has expired. Once the time period has expired, only new alerts are sent. All alerts that are suppressed during the time period will never be sent.
15. Click Alert Actions.
16. If you are associating a new action to the rule, click Add New Action, and then select an action from the list to configure. For more information about adding alert actions, see “Adding Alert Actions”.
17. If you are editing an existing action for the rule, select an action from the list, click Edit Action, and then configure the action. For more information about adding alert actions, see “Adding Alert Actions”.
18. Use the arrow buttons to arrange the order in which actions are performed.
Note: Actions are processed in the order that they appear in this list, from top to bottom.
19. If you need to delete an action, select the action, and then click Delete Action.
20. Click OK to save all changes and return to Trap Viewer Settings.
21. Use the arrow buttons to arrange the order in which the rules are applied.
Note: Rules are processed in the order that they appear in this list, from top to bottom.

mstensta

Thanks for the link but I still don't understand how I'm supposed to use it. Would I do something like this?

=============================================

Traps received where ANY of the following are true:

SNMPv2-MIB:snmpTrapOID is equal to CISCO-LATITUDE-MIB:meetingplaceEventsV2.0.6

AND Traps received where ANY of the following are true:

SNMPv2-MIB:snmpTrapOID contains Multiple failed

=============================================

Is this what you mean? I didn't think the snmpTrapOID will search the mpAlarmDesc variable inside the CISCO-LATITUDE-MIB:meetingplaceEventsV2.0.6 mib. Unless I'm supposed to do this:

=============================================

Traps received where ANY of the following are true:

SNMPv2-MIB:snmpTrapOID is equal to CISCO-LATITUDE-MIB:meetingplaceEventsV2.0.6

AND Traps received where ANY of the following are true:

mpAlarmDesc contains Multiple failed

=============================================

mstensta

Thanks, but this still doesn't answer my question.

--Mark.

mstensta

Looks like the below worked just fine.

=============================================

Traps received where ANY of the following are true:

SNMPv2-MIB:snmpTrapOID is equal to CISCO-LATITUDE-MIB:meetingplaceEventsV2.0.6

AND Traps received where ANY of the following are true:

mpAlarmDesc contains Multiple failed

=============================================