Re: How to correlate a "clearing" SNMP trap with a previous error (341 Views)
Reply
Occasional Advisor
DanielJanzon
Posts: 9
Registered: ‎03-04-2014
Message 1 of 4 (405 Views)
Accepted Solution

How to correlate a "clearing" SNMP trap with a previous error

I have an SNMP trap with a specific OID that comes in two forms, sometimes with a "status" variable binding inidcating a fault, and sometimes with a status indicating that the entity is no longer in a state of error (i.e. "clear" previous error).

 

Looking into Incidents -> Pairwise Configuration  it seems to  me as if I have to create two incidents from the traps mentioned above.

 

Going into Incidents -> SNMP Trap Configurations I tried to create two incidents, one suppressing traps with the status var binding indicating "clear" and one suppressing traps with the opposite status indicating a fault.

 

But I am unable to create two incidents with the same SNMP Object ID! NNMi does not allow me to do it.

 

So how should I do? My basic concern is that I don't want to show incidents in "My Open Incidents" when they have received a clear from the SNMP agent in question.

Please use plain text.
HP Expert
Dave Young
Posts: 518
Registered: ‎09-27-2000
Message 2 of 4 (371 Views)

Re: How to correlate a "clearing" SNMP trap with a previous error

Daniel,

 

  Firstly you need to be using NNMi 9.2.

 

  Then for the trap configuration you simply need to either load the MIB that defines it and then load the trap definition from the loaded MIB, or you can create the trap entry manually.  You only need to add the one trap.

 

  Then in the pairwise configuration you specify the trap OID for both the first ( child ) and second ( parent ) trap.  You then use the parent and child tabs to specify how the two are identified - the value of the status varbind.  Check out the default PairWise entry of  Lineproto-5-UpDownPair   which uses this same technique.

 

  If you want to delay the child trap from being displayed for a period of time to see if its canceled by a parent coming in,  then use the  dampening not the suppression, which will not display the trap at all, configuration tab.

 

  All the best

 

Dave Y

HP Support

The views expressed in my contributions are my own and do not necessarily reflect the views and strategy of HP

If you find this or any post resolves your issue, please be sure to mark it as an accepted solution.
Please use plain text.
Occasional Advisor
DanielJanzon
Posts: 9
Registered: ‎03-04-2014
Message 3 of 4 (347 Views)

Re: How to correlate a "clearing" SNMP trap with a previous error

Thanks! That worked perfectly :)

 

Just one additional question: As 9.2 is required for this, would you say that a trap design with separate traps for cancellation of errors is better? Or does that come with some other drawback. I'm thinking some customers may sit on older releases and will be reluctant to upgrade their system. The question is relevant as I have control of the traps that are sent.

Please use plain text.
HP Expert
Dave Young
Posts: 518
Registered: ‎09-27-2000
Message 4 of 4 (341 Views)

Re: How to correlate a "clearing" SNMP trap with a previous error

Daniel,

 

 I don't think either is actually better.  However if you are designing the traps at this time and want to be able to run them against all the NNMi versions  i.e. 8.13, 9.0x, 9.1x, 9.2x  then I would suggest different traps for alerting and clearing.  It was only at 9.20 that the one trap with differing varbind values could be configured into a pairwise configuration.  If you are only writing for 9.20 and above then either is just as good.

 

  All the best

 

Dave Y

HP Support

The views expressed in my contributions are my own and do not necessarily reflect the views and strategy of HP

If you find this or any post resolves your issue, please be sure to mark it as an accepted solution.
Please use plain text.
The opinions expressed above are the personal opinions of the authors, not of HP. By using this site, you accept the Terms of Use and Rules of Participation