This discussion has been locked. The information referenced herein may be inaccurate due to age, software updates, or external references.
You can no longer post new replies to this discussion. If you have a similar question you can start a new discussion in this forum.

Repetitive Trap Being Generated

Hi,


 There is a repetitive trap that we keep receiving in the Trap Viewer. Could anybody provide any insight on what might be generating it?


This is what the trap looks like.


sysUpTime=1 hour 13 minutes 44.31 seconds


snmpTrapOID=MSSQLSERVER-MIB:software.13.1.8.83.101.99.117.114.105.116.121.0.534


software.13.1.9999.1.0=TG9nb24gRmFpbHVyZToNCg0KCVJlYXNvbjoJVGhlIHVzZXIgaGFzIG5vdCBiZWVuIGdyYW50ZWQgdGhlIHJlcXVlc3RlZA0KDQoJCWxvZ29uIHR5cGUgYXQgdGhpcyBtYWNoaW5lDQoNCglVc2VyIE5hbWU6CWFkbWluaQ0KDQoJRG9tYWluOgkJRE1aLU9TRy1ERVYNCg0KCUxvZ29uIFR5cGU6CTQNCg0KCUxvZ29uIFByb2Nlc3M6CUFkdmFwaSAgDQoNCglBdXRoZW50aWNhdGlvbiBQYWNrYWdlOglOZWdvdGlhdGUNCg0KCVdvcmtzdGF0aW9uIE5hbWU6CUZJTEUyDQoNCglDYWxsZXIgVXNlciBOYW1lOglGSUxFMiQNCg0KCUNhbGxlciBEb21haW46CURNWi1PU0ctREVWDQoNCglDYWxsZXIgTG9nb24gSUQ6CSgweDAsMHgzRTcpDQoNCglDYWxsZXIgUHJvY2VzcyBJRDoJMjk3Ng0KDQoJVHJhbnNpdGVkIFNlcnZpY2VzOgktDQoNCglTb3VyY2UgTmV0d29yayBBZGRyZXNzOgktDQoNCglTb3VyY2UgUG9ydDoJLQ0KDQo=


software.13.1.9999.2.0=SYSTEM


software.13.1.9999.3.0=FILE2


software.13.1.9999.4.0=16


software.13.1.9999.5.0=2


software.13.1.9999.6.0=admini


software.13.1.9999.7.0=DMZ-OSG-DEV


software.13.1.9999.8.0=4


software.13.1.9999.9.0=Advapi


software.13.1.9999.10.0=Negotiate


software.13.1.9999.11.0=FILE2


software.13.1.9999.12.0=FILE2$


software.13.1.9999.13.0=DMZ-OSG-DEV


software.13.1.9999.14.0=(0x0,0x3E7)


software.13.1.9999.15.0=2976


software.13.1.9999.16.0=-


software.13.1.9999.17.0=-


software.13.1.9999.18.0=-


experimental.1057.1=10.179.1.52


snmpTrapEnterprise=MSSQLSERVER-MIB:software.13.1.8.83.101.99.117.114.105.116.121

  • I have found an Event MIB that Microsoft has that can help you in correlating your traps to windows events.  This will also be in the MIB update on Monday from your customer portal.

    nmpTrapOID=MSSQLSERVER-MIB:software.13.1.8.83.101.99.117.114.105.116.121.0.534

    software.13.1.9999.1.0=TG9nb24gRmFpbHVyZToNCg0KCVJlYXNvbjoJVGhlIHVzZXIgaGFzIG5vdCBiZWVuIGdyYW50ZWQgdGhlIHJlcXVlc3RlZA0KDQoJCWxvZ29uIHR5cGUgYXQgdGhpcyBtYWNoaW5lDQoNCglVc2VyIE5hbWU6CWFkbWluaQ0KDQoJRG9tYWluOgkJRE1aLU9TRy1ERVYNCg0KCUxvZ29uIFR5cGU6CTQNCg0KCUxvZ29uIFByb2Nlc3M6CUFkdmFwaSAgDQoNCglBdXRoZW50aWNhdGlvbiBQYWNrYWdlOglOZWdvdGlhdGUNCg0KCVdvcmtzdGF0aW9uIE5hbWU6CUZJTEUyDQoNCglDYWxsZXIgVXNlciBOYW1lOglGSUxFMiQNCg0KCUNhbGxlciBEb21haW46CURNWi1PU0ctREVWDQoNCglDYWxsZXIgTG9nb24gSUQ6CSgweDAsMHgzRTcpDQoNCglDYWxsZXIgUHJvY2VzcyBJRDoJMjk3Ng0KDQoJVHJhbnNpdGVkIFNlcnZpY2VzOgktDQoNCglTb3VyY2UgTmV0d29yayBBZGRyZXNzOgktDQoNCglTb3VyY2UgUG9ydDoJLQ0KDQo=

    OID 1.3.6.1.4.1.311.1.13.1.9999.1

    Type OCTET

    Units

    Access read-only

    Status unknown

    The event message text. The message data is populated with

    the variable data.

    software.13.1.9999.2.0=SYSTEM

    OID 1.3.6.1.4.1.311.1.13.1.9999.2

    Type OCTET

    Units

    Access read-only

    Status unknown

    The user ID of the process that generated the event.

    software.13.1.9999.3.0=FILE2

    OID 1.3.6.1.4.1.311.1.13.1.9999.3

    Type OCTET

    Units

    Access read-only

    Status unknown

    The computername of the host that generated the event.

    software.13.1.9999.4.0=16

    OID 1.3.6.1.4.1.311.1.13.1.9999.4

    Type OCTET

    Units

    Access read-only

    Status unknown

    The numeric code value of the event type.

     

    software.13.1.9999.5.0=2

    OID 1.3.6.1.4.1.311.1.13.1.9999.5

    Type OCTET

    Units

    Access read-only

    Status unknown

    The numeric code value of the event category.

     

    software.13.1.9999.6.0=admini

    Event-specific variable data for the rest of the 9999.x

     

    The SNMP trap data itself is provided as an enterprise-specific alert, using the OID value of 9999 after the base OID value described above.

    Every trap message has at least five sub-fields, while some of them can provide a dozen or more additional event-specific variables.

    The five fields that are always present are the

    1. textual event message

    2. the user ID of the process that triggered the event

    3. the computer name of the event system

    4. a numeric representation of the event "type"

    5. and a numeric representation of the event "category", in that order.

    The MIB I added to the database tonight that will be availabe monday morning has these as "eventText", "eventUserId", "eventSystem", "eventType" and "eventCategory".

     

    I hope this helps you to correlate the trap to the event.

     

    Thanks,

     ~Dez