This discussion has been locked. The information referenced herein may be inaccurate due to age, software updates, or external references.
You can no longer post new replies to this discussion. If you have a similar question you can start a new discussion in this forum.

Generating trap message alerts from trap details

Hi all,

 

I'm trying to trigger an action in a rule in the Trap Viewer based on information in the trap details and so far I haven't been completely successful. I have traps coming into our trap viewer, and I have created a test Rule that will generate an email. If I don't put anything into the trap details tab of the Rule, the Rule generates the email just fine (based on conditions). However, for the specific traps we need to alert on, the only way they are differentiated is in the trap details.

Example. When we do a generator test, we get 4 traps. 2 are the same trap (0.3) but in the details it shows you that they are different. (the 3 means that an event was triggered). Then we get 2 additional traps that are the same(0.4). The 4s are the events clearing.

I can make the rules alert on the trap just fine (the 0.3 part of it) but I haven't been able to combine that trap condition with the trap details (specifically the OID of what is going on) and alert. Based on the above example, we want to have 4 rules. 3A (triggering A), 3B (triggering B), 4A (clearing A), and 4B (clearing B). Below are some of the trap messages.

Hope this makes sense.

Thanks, Phil

 

Forwarded Trap Message from 10.10.31.98:10.10.31.98

07/25/2011 11:02 : UPS-MIB:upsTraps.0.3  SNMP Trap

     Received Time:7/25/2011 11:02:49 AM

    Source:10.10.31.98(10.10.31.98)

    Community:public

     Variable Bindings

         sysUpTime:= 17 days 17 hours 59 minutes 8.51 seconds (153354851)

         snmpTrapOID:= UPS-MIB:upsTraps.0.3 (1.3.6.1.2.1.33.2.0.3)

         upsAlarmId.9:= 9

         upsAlarmDescr.9:= 1.3.6.1.2.1.33.1.6.3.2

          experimental.1057.1:= 10.10.31.98

         snmpTrapEnterprise:= UPS-MIB:upsTraps (1.3.6.1.2.1.33.2)

 

Forwarded Trap Message from 10.10.31.98:10.10.31.98

07/25/2011 11:02 : UPS-MIB:upsTraps.0.3  SNMP Trap

     Received Time:7/25/2011 11:02:50 AM

    Source:10.10.31.98(10.10.31.98)

    Community:public

     Variable Bindings

         sysUpTime:= 17 days 17 hours 59 minutes 9.46 seconds (153354946)

         snmpTrapOID:= UPS-MIB:upsTraps.0.3 (1.3.6.1.2.1.33.2.0.3)

         upsAlarmId.10:= 10

         upsAlarmDescr.10:= 1.3.6.1.2.1.33.1.6.3.18

         experimental.1057.1:= 10.10.31.98

         snmpTrapEnterprise:= UPS-MIB:upsTraps (1.3.6.1.2.1.33.2)

 

Forwarded Trap Message from 10.10.31.98:10.10.31.98

07/25/2011 11:03 : UPS-MIB:upsTraps.0.4  SNMP Trap

     Received Time:7/25/2011 11:03:00 AM

     Source:10.10.31.98(10.10.31.98)

    Community:public

     Variable Bindings

         sysUpTime:= 17 days 17 hours 59 minutes 19.48 seconds (153355948)

         snmpTrapOID:= UPS-MIB:upsTraps.0.4 (1.3.6.1.2.1.33.2.0.4)

         upsAlarmId.9:= 9

          upsAlarmDescr.9:= 1.3.6.1.2.1.33.1.6.3.2

         experimental.1057.1:= 10.10.31.98

         snmpTrapEnterprise:= UPS-MIB:upsTraps (1.3.6.1.2.1.33.2)

 

Forwarded Trap Message from 10.10.31.98:10.10.31.98

07/25/2011 11:03 : UPS-MIB:upsTraps.0.4  SNMP Trap

     Received Time:7/25/2011 11:03:01 AM

    Source:10.10.31.98(10.10.31.98)

    Community:public

     Variable Bindings

         sysUpTime:= 17 days 17 hours 59 minutes 20.36 seconds (153356036)

          snmpTrapOID:= UPS-MIB:upsTraps.0.4 (1.3.6.1.2.1.33.2.0.4)

         upsAlarmId.10:= 10

         upsAlarmDescr.10:= 1.3.6.1.2.1.33.1.6.3.18

         experimental.1057.1:= 10.10.31.98

         snmpTrapEnterprise:= UPS-MIB:upsTraps (1.3.6.1.2.1.33.2)

  • you could send the whole email with:

    Forwarded Trap Message from ${Hostname}:${IP}

    ${DateTime} : ${MESSAGETYPE}  ${MESSAGE}

    or

    Uptime: ${vbData1}
    OID text: ${vbData2}
    Trap Enterprise: ${vbData6}

  • Hi Netlogix,

     

    Unfortunately, the real reason I need the alerts is because I'm executing an external program based on which trap and the details of that trap. Sorry I should have specified that. I'm only using the 'send email' to test.

     

    Phil

  • can you use: run external program: c:\this.bat "${IP}" "${vbData2}"

    This.bat:

    @Echo $~2 on $~1 > this.txt

  • ok, I think I read this wrong at first, this isn't about pulling out the details, it is about being able to use the detail to differentiate between the alerts. (right?)

    What I boiled the traps down to is:
    07/25/2011 11:02 : UPS-MIB:upsTraps.0.3  SNMP Trap
              snmpTrapOID:= UPS-MIB:upsTraps.0.3 (1.3.6.1.2.1.33.2.0.3)
              upsAlarmId.9:= 9
              upsAlarmDescr.9:= 1.3.6.1.2.1.33.1.6.3.2

    07/25/2011 11:02 : UPS-MIB:upsTraps.0.3  SNMP Trap
              snmpTrapOID:= UPS-MIB:upsTraps.0.3 (1.3.6.1.2.1.33.2.0.3)
              upsAlarmId.10:= 10
              upsAlarmDescr.10:= 1.3.6.1.2.1.33.1.6.3.18

    07/25/2011 11:03 : UPS-MIB:upsTraps.0.4  SNMP Trap
              snmpTrapOID:= UPS-MIB:upsTraps.0.4 (1.3.6.1.2.1.33.2.0.4)
              upsAlarmId.9:= 9
              upsAlarmDescr.9:= 1.3.6.1.2.1.33.1.6.3.2

    07/25/2011 11:03 : UPS-MIB:upsTraps.0.4  SNMP Trap
              snmpTrapOID:= UPS-MIB:upsTraps.0.4 (1.3.6.1.2.1.33.2.0.4)
              upsAlarmId.10:= 10
              upsAlarmDescr.10:= 1.3.6.1.2.1.33.1.6.3.18

    is it that you care about the 0.3 vs 0.4, but also want to know upsAlarmId.9 vs upsAlarmId.10?

    You could use the batch file to differentiate:
    this.bat "${vbdata3}"

    this.bat =
    @if "%~1" == "10" c:\this10.exe
    @if "%~1" == "10" goto exit
    @if "%~1" == "9" c:\this9.exe
    @if "%~1" == "9" goto exit
    echo should not be here
    pause
    :exit


    But you should be able to do this, but it is case sensitive.  Use the Conditions tab to narrow down the trap for 0.3 vs 0.4, and the Trap Details tab to use "*upsAlarmId.9*" or "*upsAlarmId.10*"

    To do any of this you need 10.0 or maybe 10.1 (I don't remember when they made these changes).

  • Hi Phil,

    I know you posted this a long time ago but I was wondering if you ended up having any success with this.

    I am having a similar issue.