Trap Viewer - Conditions

Hi all,

Only been playing with Trap Viewer today, so my apologies if this is really obvious!

I'm using a Tavve ZoneRanger to obtain traps from cust sites that sit behind a firewall - I'm receiving the traps correctly in Trap Viewer, and have configured individual alerts to generate an email when replication goes offline/online. This approach is fine for the 3 servers I'm testing - but some customers have up to 200 servers we monitor. I'm playing around with the 'Conditions' tab to try and have one rule for 'replication offline' etc - but can't seem to get it working. I'll outline below the traps/config etc :

netapp.18825.1.1.1.165=1100165 netapp.18825.1.1.2.165=2 netapp.18825.1.1.3.165=07/12/2012 11:16:36.561 netapp.18825.1.1.4.165=10.208.208.4 netapp.18825.1.1.5.165=4 netapp.18825.1.1.6.165=STORMT_CCL_Bugzilla netapp.18825.1.1.7.165=10 netapp.18825.1.1.8.165=955898268 netapp.18825.1.1.9.165=4149 netapp.18825.1.1.10.165=NMS <-> NRC disconnected for more than 60 seconds netapp.18825.1.1.11.165=0 netapp.18825.1.1.12.165=60 netapp.18825.1.1.13.165=0 netapp.18825.1.1.14.165=1498267188 snmpTrapOID=NETAPP-MIB:netapp.18825.0.1 sysUpTime=18 hours 38 minutes 39.23 seconds experimental.1057.1.0=10.208.208.66 snmpTrapEnterprise=NETAPP-MIB:netapp.18825

netapp.18825.1.1.1.168=1100168 netapp.18825.1.1.2.168=1 netapp.18825.1.1.3.168=07/12/2012 11:18:37.561 netapp.18825.1.1.4.168=10.208.208.4 netapp.18825.1.1.5.168=4 netapp.18825.1.1.6.168=STORMT_CCL_smt netapp.18825.1.1.7.168=13 netapp.18825.1.1.8.168=955898204 netapp.18825.1.1.9.168=4149 netapp.18825.1.1.10.168=NMS <-> NRC disconnected netapp.18825.1.1.11.168=0 netapp.18825.1.1.12.168=0 netapp.18825.1.1.13.168=0 netapp.18825.1.1.14.168=1619267188 snmpTrapOID=NETAPP-MIB:netapp.18825.0.1 sysUpTime=18 hours 40 minutes 39.28 seconds experimental.1057.1.0=10.208.208.66 snmpTrapEnterprise=NETAPP-MIB:netapp.18825

The highlighted text relates to the servers I am monitoring - they are all in the format STORMT_XXXXXXX - I thought I could configure the trap viewer conditions to look at the alert, and match based on the trap containing 'STORM' - but don't seem to be having much joy.

Any help would be greatly appreciated!!

Kind regards,

Rob

Find more posts tagged with

Accepted answers

All comments

ktmrob

Anyone?!?!

Got a support ticket open with SolarWinds - and they couldn't resolve the issue over a GoTo meeting either

mdriskell

You would need to do one of two things.

If you are simply looking for STORM anywhere in the trap then add *storm* to the trap details tab of the trap rules.

If you need to match specifically on those trap OIDs

netapp.18825.1.1.6.165=STORMT_CCL_Bugzilla

netapp.18825.1.1.6.168=STORMT_CCL_smt

Then you would need to add to the conditions tab netapp.18825.1.1.6.165 Starts With STORM or netapp.18825.1.1.6.168 starts with Storm

ktmrob

Hi Mike!

Thanks for replying - was hoping you may shed some light, after seeing your post in the 'Ideas & Feature Requests'. I'll have a play now - fingers crossed!

ktmrob

Hi Mike,

Right I've had a look - but that's not going to work unfortunately. The trap 'number' increments each time a new trap is received - so in my original post it was :

netapp.18825.1.1.6.165=STORMT_CCL_Bugzilla

But the next one would be :

netapp.18825.1.1.6.166=STORMT_CCL_Bugzilla

So as that is not a unique identifier for the traps - it won't work. I basically need to create an alert for 'Replication Offline' and 'Replication Online'. I've included some screenshots if you're able to help please?

This is the trap received when replication goes offline - I have highlighted the 2 pieces of info that I need to identify, in order for an alert to be generated. The STORM section of the hostname will remain constant, as will the NMS <-> NRC portion.

For 'Replication Online' - the hostname remains the same as above (STORM) - but the unique part of the trap here is 'Alert down'

Any ideas?

Thanks in advance!

Rob

mdriskell

I'm not aware of any traps that work like that....those numbers should never change as they are unique OIDs..if you get a different one it means a different trap condition is met. I suggest getting the MIBs uploaded to support so that those OIDs can be translated.

That being said my other comment about matching within the trap details will match any text regardless of which OID it is received within.