cancel
Showing results for 
Search instead for 
Did you mean: 
Create Post
Level 7

Repetitive Trap Being Generated

Hi,


 There is a repetitive trap that we keep receiving in the Trap Viewer. Could anybody provide any insight on what might be generating it?


This is what the trap looks like.


sysUpTime=1 hour 13 minutes 44.31 seconds


snmpTrapOID=MSSQLSERVER-MIB:software.13.1.8.83.101.99.117.114.105.116.121.0.534


software.13.1.9999.1.0=TG9nb24gRmFpbHVyZToNCg0KCVJlYXNvbjoJVGhlIHVzZXIgaGFzIG5vdCBiZWVuIGdyYW50ZWQgdGhlIHJlcXVlc3RlZA0KDQoJCWxvZ29uIHR5cGUgYXQgdGhpcyBtYWNoaW5lDQoNCglVc2VyIE5hbWU6CWFkbWluaQ0KDQoJRG9tYWluOgkJRE1aLU9TRy1ERVYNCg0KCUxvZ29uIFR5cGU6CTQNCg0KCUxvZ29uIFByb2Nlc3M6CUFkdmFwaSAgDQoNCglBdXRoZW50aWNhdGlvbiBQYWNrYWdlOglOZWdvdGlhdGUNCg0KCVdvcmtzdGF0aW9uIE5hbWU6CUZJTEUyDQoNCglDYWxsZXIgVXNlciBOYW1lOglGSUxFMiQNCg0KCUNhbGxlciBEb21haW46CURNWi1PU0ctREVWDQoNCglDYWxsZXIgTG9nb24gSUQ6CSgweDAsMHgzRTcpDQoNCglDYWxsZXIgUHJvY2VzcyBJRDoJMjk3Ng0KDQoJVHJhbnNpdGVkIFNlcnZpY2VzOgktDQoNCglTb3VyY2UgTmV0d29yayBBZGRyZXNzOgktDQoNCglTb3VyY2UgUG9ydDoJLQ0KDQo=


software.13.1.9999.2.0=SYSTEM


software.13.1.9999.3.0=FILE2


software.13.1.9999.4.0=16


software.13.1.9999.5.0=2


software.13.1.9999.6.0=admini


software.13.1.9999.7.0=DMZ-OSG-DEV


software.13.1.9999.8.0=4


software.13.1.9999.9.0=Advapi


software.13.1.9999.10.0=Negotiate


software.13.1.9999.11.0=FILE2


software.13.1.9999.12.0=FILE2$


software.13.1.9999.13.0=DMZ-OSG-DEV


software.13.1.9999.14.0=(0x0,0x3E7)


software.13.1.9999.15.0=2976


software.13.1.9999.16.0=-


software.13.1.9999.17.0=-


software.13.1.9999.18.0=-


experimental.1057.1=10.179.1.52


snmpTrapEnterprise=MSSQLSERVER-MIB:software.13.1.8.83.101.99.117.114.105.116.121

0 Kudos
1 Reply
Product Manager
Product Manager

I have found an Event MIB that Microsoft has that can help you in correlating your traps to windows events.  This will also be in the MIB update on Monday from your customer portal.

nmpTrapOID=MSSQLSERVER-MIB:software.13.1.8.83.101.99.117.114.105.116.121.0.534

software.13.1.9999.1.0=TG9nb24gRmFpbHVyZToNCg0KCVJlYXNvbjoJVGhlIHVzZXIgaGFzIG5vdCBiZWVuIGdyYW50ZWQgdGhlIHJlcXVlc3RlZA0KDQoJCWxvZ29uIHR5cGUgYXQgdGhpcyBtYWNoaW5lDQoNCglVc2VyIE5hbWU6CWFkbWluaQ0KDQoJRG9tYWluOgkJRE1aLU9TRy1ERVYNCg0KCUxvZ29uIFR5cGU6CTQNCg0KCUxvZ29uIFByb2Nlc3M6CUFkdmFwaSAgDQoNCglBdXRoZW50aWNhdGlvbiBQYWNrYWdlOglOZWdvdGlhdGUNCg0KCVdvcmtzdGF0aW9uIE5hbWU6CUZJTEUyDQoNCglDYWxsZXIgVXNlciBOYW1lOglGSUxFMiQNCg0KCUNhbGxlciBEb21haW46CURNWi1PU0ctREVWDQoNCglDYWxsZXIgTG9nb24gSUQ6CSgweDAsMHgzRTcpDQoNCglDYWxsZXIgUHJvY2VzcyBJRDoJMjk3Ng0KDQoJVHJhbnNpdGVkIFNlcnZpY2VzOgktDQoNCglTb3VyY2UgTmV0d29yayBBZGRyZXNzOgktDQoNCglTb3VyY2UgUG9ydDoJLQ0KDQo=

OID 1.3.6.1.4.1.311.1.13.1.9999.1

Type OCTET

Units

Access read-only

Status unknown

The event message text. The message data is populated with

the variable data.

software.13.1.9999.2.0=SYSTEM

OID 1.3.6.1.4.1.311.1.13.1.9999.2

Type OCTET

Units

Access read-only

Status unknown

The user ID of the process that generated the event.

software.13.1.9999.3.0=FILE2

OID 1.3.6.1.4.1.311.1.13.1.9999.3

Type OCTET

Units

Access read-only

Status unknown

The computername of the host that generated the event.

software.13.1.9999.4.0=16

OID 1.3.6.1.4.1.311.1.13.1.9999.4

Type OCTET

Units

Access read-only

Status unknown

The numeric code value of the event type.

 

software.13.1.9999.5.0=2

OID 1.3.6.1.4.1.311.1.13.1.9999.5

Type OCTET

Units

Access read-only

Status unknown

The numeric code value of the event category.

 

software.13.1.9999.6.0=admini

Event-specific variable data for the rest of the 9999.x

 

The SNMP trap data itself is provided as an enterprise-specific alert, using the OID value of 9999 after the base OID value described above.

Every trap message has at least five sub-fields, while some of them can provide a dozen or more additional event-specific variables.

The five fields that are always present are the

1. textual event message

2. the user ID of the process that triggered the event

3. the computer name of the event system

4. a numeric representation of the event "type"

5. and a numeric representation of the event "category", in that order.

The MIB I added to the database tonight that will be availabe monday morning has these as "eventText", "eventUserId", "eventSystem", "eventType" and "eventCategory".

 

I hope this helps you to correlate the trap to the event.

 

Thanks,

 ~Dez

0 Kudos