Log Manager - Extract SNMP Trap VarBinds into Orion Alert & Alert De-duplication

So I receive a trap for something like "interface down"

TrapOid

1.3.6.1.6.3.1.1.5.3

TrapType

IF-MIB:linkDown

it has a load of VarBinds:

VARBINDS

sysUpTime (1.3.6.1.2.1.1.3.0)

356 days 6 hours 46 minutes 21.27 seconds

ifIndex.436232192 (1.3.6.1.2.1.2.2.1.1.436232192)

436232192

ifAdminStatus.436232192 (1.3.6.1.2.1.2.2.1.7.436232192)

down(2)

ifOperStatus.436232192 (1.3.6.1.2.1.2.2.1.8.436232192)

down(2)

ifDescr.436232192 (1.3.6.1.2.1.2.2.1.2.436232192)

Ethernet1/7

ifAlias.436232192 (1.3.6.1.2.1.31.1.1.1.18.436232192)

[ThisIsAnImportantPort]

snmpTrapEnterprise (1.3.6.1.6.3.1.1.4.3.0)

IF-MIB:linkDown

From this, I add a tag to the alert and fire an Orion Integrated Alert. Fabulous. I have two issues I cannot figure out.

1) In the Orion alert, I cannot pick out specific bits to place in my customer alert. I can insert the trap message which just dumps the alert as "Interface Down was triggered. IF-MIB:linkDown : sysUpTime = 356 days 6 hours 46 minutes 21.27 seconds, ifIndex.436232192 = 436232192, ifAdminStatus.436232192 = down(2), ifOperStatus.436232192 = down(2), ifDescr.436232192 = Ethernet1/7, ifAlias.436232192 = [ThisIsAnImportantPort], snmpTrapEnterprise = IF-MIB:linkDown"

What I would like to do is have the orion alert say something like "Trap received for Interface Ethernet1/7 on Node Switch1 for Interface Down. Port has description of 'ThisIsAnImportantPort'"

Whilst I can get Orion Alert manager to display the nodeID, I cannot for the life of me insert a variable to say "use varbind/trapOID 1.3.6.1.2.1.2.2.1.2.436232192" in the alert message.

2) If, by Chance, I am managing the same Node and Interface in Orion via SNMP Polling, I will, on the next polling cycle, get an alert if the interface is down (and has stayed down). We need both, as if the port "drops" for a few mins between polling cycles, we would want to know about it. How do I use both sources for monitoring without ending up with Duplicate Orion Alerts?

Thanks.

Ashley

Parents Reply Children
No Data