SNMP Trap filtering (386 Views)
Reply
Occasional Visitor
Kaydee
Posts: 2
Registered: ‎10-21-2013
Message 1 of 4 (386 Views)
Accepted Solution

SNMP Trap filtering

We currently have a fully up to date iMC 7 installation. We get a number of traps from every device on out network to say that the "System Local Clock has changed". Now These traps are all reflecting minor time changes due to NTP but I was wondering if there is an intelligent way to filter these traps such that if the time has changed by less than say five minutes that it no longer flags a major alarm. We do not want to filter ALL time-changed alarms as the time being out by a large factor is a potential issue. The network is mostly HP switches (a series) and some cisco.

Please use plain text.
Honored Contributor
LindsayHill
Posts: 687
Registered: ‎11-16-2011
Message 2 of 4 (367 Views)

Re: SNMP Trap filtering

Yes, these alarms are a pain. I don't think there's a way to achieve quite that level of filtering. Some tools offer that sort of granularity, IMC doesn't seem to (yet).

 

However...it's only the Comware devices generating them. Cisco devices don't generate those particular traps, and you probably never missed them. My advice to people with mixed networks like yours is to just suppress that particular trap.

 

Instead use Compliance policies to verify that NTP is configured on all your devices. For bonus marks, configure a Compliance policy that logs into the devices, runs "show ntp status"  (or equivalent), and then checks that the output shows "synchronized". That's actually a far better level of verification than relying on traps reporting time adjustments.

CCIE 36708 | @northlandboy | lkhill.com
Please use plain text.
Occasional Visitor
Kaydee
Posts: 2
Registered: ‎10-21-2013
Message 3 of 4 (360 Views)

Re: SNMP Trap filtering

Thanks for the reply. The compliance policy approach seems to be the best idea I think. The only draw back I can see is the ability to check only once a day per task but it's much better than filtering those alarms manually.

 

Thanks for the info.

Please use plain text.
Occasional Visitor
GregoryW
Posts: 1
Registered: ‎02-25-2014
Message 4 of 4 (210 Views)

Re: SNMP Trap filtering

You can filter these messages with IMC 7.0. On the alarm event just get the oid of the alarm first, that will make it easier to add. Then go to filtering rules and call it something like Date Change and then do by trap and when you hit the select button put in the oid. It should come up as something like Date and Time for System Changed(H3C System Management Notifications). Then just filter 7 days a week 24 hours a day. 

Please use plain text.
The opinions expressed above are the personal opinions of the authors, not of HP. By using this site, you accept the Terms of Use and Rules of Participation