So I receive a trap for something like "interface down"
TrapOid
1.3.6.1.6.3.1.1.5.3
TrapType
IF-MIB:linkDown
it has a load of VarBinds:
VARBINDS
356 days 6 hours 46 minutes 21.27 seconds
436232192
down(2)
down(2)
Ethernet1/7
[ThisIsAnImportantPort]
IF-MIB:linkDown
From this, I add a tag to the alert and fire an Orion Integrated Alert. Fabulous. I have two issues I cannot figure out.
1) In the Orion alert, I cannot pick out specific bits to place in my customer alert. I can insert the trap message which just dumps the alert as "Interface Down was triggered. IF-MIB:linkDown : sysUpTime = 356 days 6 hours 46 minutes 21.27 seconds, ifIndex.436232192 = 436232192, ifAdminStatus.436232192 = down(2), ifOperStatus.436232192 = down(2), ifDescr.436232192 = Ethernet1/7, ifAlias.436232192 = [ThisIsAnImportantPort], snmpTrapEnterprise = IF-MIB:linkDown"
What I would like to do is have the orion alert say something like "Trap received for Interface Ethernet1/7 on Node Switch1 for Interface Down. Port has description of 'ThisIsAnImportantPort'"
Whilst I can get Orion Alert manager to display the nodeID, I cannot for the life of me insert a variable to say "use varbind/trapOID 1.3.6.1.2.1.2.2.1.2.436232192" in the alert message.
2) If, by Chance, I am managing the same Node and Interface in Orion via SNMP Polling, I will, on the next polling cycle, get an alert if the interface is down (and has stayed down). We need both, as if the port "drops" for a few mins between polling cycles, we would want to know about it. How do I use both sources for monitoring without ending up with Duplicate Orion Alerts?
Thanks.
Ashley