01-20-2014 01:52 PM
I continue to get these alarms on a daily basis. Any ideas on what's causing this?
Name Alarm system detected alarms from unmanaged devices
Alarm at 2014-01-20 06:49:26
Alarm Category NMS Alarm (Partial)
Recovery Status Unrecovered
Acknowledgement Status Unacknowledged
Description iMC alarm system has received 1000 alarms from the unmanaged device from 2014-01-19 06:27:37 to 2014-01-20 06:49:26.
Alarm Cause iMC alarm system has received a large amount of alarms from unmanaged devices.
Remediation Suggestion Please add the unmanaged devices to the system for management.
Note -- [Modify]
Parameter Name Parameter Value
*Start Time 2014-01-19 06:27:37
*Stop Time 2014-01-20 06:49:26
01-20-2014 03:57 PM
You're getting SNMP traps from devices that aren't managed by IMC.
With that volume, the most likely source is from some system that has SNMP Authentication Failure traps enabled, and IMC set as its destination.
You've got three choices:
1/ Fix the offending system
2/ Add the offending system to IMC
3/ Turn off notification for alarms from Unknown systems.
The problem with 1 & 2 is identifying the offending systems. The easiest way is probably to go to Alarm -> Trap Management -> Filtering Trap. Click Modify next to "Unknown Trap Filter". Uncheck "Filter Unknown Traps" - now you will at least see the alarms in Alarm -> Trap Management -> Browse Trap. You can then see which system you need to go and fix, or add to IMC.
If you don't care that systems are sending you large numbers of unnecessary traps, and you just want to stop the alarm about it, then you could uncheck "Escalate to alarms" from the above Filter.
01-21-2014 07:19 AM
I think your steps to uncheck "filter unknown traps" is what I was looking for. I'd prefer to track down what system(s) are causing this, but the original alert I posted had localhost 127.0.0.1 as the source.
I'll post back if this does the trick, in case others have the same issue.
01-21-2014 03:04 PM
The reason you see "127.0.0.1" in the original alert is that it's raised against the NMS itself. The message is saying that it received a total of 1,000 messages from unknown sources - that includes many different sources, so it just rolls the alert up into one against the NMS itself.
(Yes, it would be nice if it had some more analysis - e.g. 100 from 10.1.1.11, 50 from 10.1.1.2, etc).
Hopefully you can now track down the problematic systems.
01-27-2014 01:14 PM
05-03-2014 03:37 PM
Hello, I was happy to see this post; I've been frustrated with the numbers of these alarms being generated. I unclicked "Filter Unknown Traps" and waited a while. I am still seeing alarms "iMC alarm system has received 1000 alarms from the unmanaged device from 2014-05-03 15:29:58 to 2014-05-03 15:35:18." but when I go to Alarm/Trap Management/Browse Trap, I don't see any traps that correspond to this alarm. I am running 7.0 E0202. Is there somewhere else I can look for this information? TIA.