DX NetOps

 View Only
Expand all | Collapse all

Unknown alert receives - AlertMap file

Jump to Best Answer
  • 1.  Unknown alert receives - AlertMap file

    Posted Nov 09, 2018 10:15 AM

    Hello,

    I have a problem when I received trap for one type of device. There is the message in my event confguration :

     

    Unknown alert received from device T38D1 of type Host_Device. Device Time 0+00:00:00. (Trap type 1.3.6.1.4.1.21066.6.6) Trap var bind data:

    OID: 1.3.6.1.6.3.1.1.4.1.0 Value: 1.3.6.1.4.1.21066.6.4

    OID: 1.3.6.1.4.1.21066.6.4.1 Value: 18-11-08

    OID: 1.3.6.1.4.1.21066.6.4.2 Value: 23:04:03

    OID: 1.3.6.1.4.1.21066.6.4.3 Value: C601

    OID: 1.3.6.1.4.1.21066.6.4.4 Value: 52.E9.74.72.6F.E9.63.6C.61.69.72.61.67.65.20.48.53

    OID: 1.3.6.1.4.1.21066.6.4.5 Value: Liaison TAF IP

    OID: 1.3.6.1.4.1.21066.6.4.6 Value: TFT4

    OID: 1.3.6.1.4.1.21066.6.4.7 Value: Alarme 601

    OID: 1.3.6.1.4.1.21066.6.4.8 Value: BackLight@HS

    OID: 1.3.6.1.4.1.21066.6.4.9 Value: 10.16.1.1

    OID: 1.3.6.1.4.1.21066.6.4.10 Value: TFT4_Guingamp

    OID: 1.3.6.1.4.1.21066.6.4.11 Value: 1

    OID: 1.3.6.1.4.1.21066.6.4.12 Value: Afficheur

     

    In my AlertMap file, I have this code :

    # Code erreur C601
    1.3.6.1.4.1.21066.6.4    0x5e10fffb    1.3.6.1.4.1.21066.6.4.1(100,0)\
                        1.3.6.1.4.1.21066.6.4.2(101,0)\
                        1.3.6.1.4.1.21066.6.4.3(102,0)\
                        1.3.6.1.4.1.21066.6.4.4(103,0)\
                        1.3.6.1.4.1.21066.6.4.5(104,0)\
                        1.3.6.1.4.1.21066.6.4.6(105,0)\
                        1.3.6.1.4.1.21066.6.4.7(106,0)\
                        1.3.6.1.4.1.21066.6.4.8(107,0)\
                        1.3.6.1.4.1.21066.6.4.9(108,0)\
                        1.3.6.1.4.1.21066.6.4.11(109,0)\
                        1.3.6.1.4.1.21066.6.4.12(110,0)\
                        1.3.6.1.4.1.21066.6.4.10(7,0)

     

    Is my code correct ?

     

    Thank's for your help.

    Best regards,

     

    Jeremy



  • 2.  Re: Unknown alert receives - AlertMap file
    Best Answer

    Posted Nov 09, 2018 10:49 AM

    Jeremy,

     

    I believe the trap oid is 1.3.6.1.4.1.21066.6.6. So use:

     

    1.3.6.1.4.1.21066.6.6    0x5e10fffb    1.3.6.1.4.1.21066.6.4.1(100,0)\

    ...

    ...

    ...

     

     

    Joe



  • 3.  Re: Unknown alert receives - AlertMap file

    Posted Nov 09, 2018 10:58 AM

    I Joseph,

     

    I tested and i have the same unknown message ...

     

    Jeremy



  • 4.  Re: Unknown alert receives - AlertMap file

    Posted Nov 09, 2018 11:04 AM

    Which AlertMap file did you put it in? Did you update the SpectroSERVER Event Configuration after updating the AlertMap file?

     

    Joe



  • 5.  Re: Unknown alert receives - AlertMap file

    Posted Nov 10, 2018 10:16 AM

    Hi Joe ,

     

    How you have declared (100,0) ?



  • 6.  Re: Unknown alert receives - AlertMap file

    Posted Nov 14, 2018 08:54 PM

    Any inputs 



  • 7.  Re: Unknown alert receives - AlertMap file

    Posted Nov 12, 2018 03:18 AM

    Hi,

    The AlertMap file is in $SPECROOT\SS\CsVendor\gen_app_gw\EventAdmin\

    And yes I updated the SpectroServer Event Configuration after updating my AlertMap file.

     

    Jeremy



  • 8.  Re: Unknown alert receives - AlertMap file

    Posted Nov 12, 2018 09:39 AM

    Because the AlertMap file is in the $SPECROOT\SS\CsVendor\gen_app_gw\EventAdmin\ directory, then the only model the trap will be processed on is a model that uses the EventAdmin model type.

     

    What is the model where you are getting the unmanaged trap event? 

     

    Joe



  • 9.  Re: Unknown alert receives - AlertMap file

    Posted Nov 12, 2018 09:48 AM

    Hi Joe,

     

    It's an Host_device model.

    So I create this folder : $SPECROOT\SS\CsVendor\gen_app_gw\Host_Device ?

     

    Jeremy



  • 10.  Re: Unknown alert receives - AlertMap file

    Posted Nov 12, 2018 10:05 AM

    Jeremy,

     

    Are you processing the trap for Southbound Gateway purposes?

     

    Joe



  • 11.  Re: Unknown alert receives - AlertMap file

    Posted Nov 12, 2018 10:10 AM

    Joe,

     

    I don't understand.

    Could you explain please ?

     

    Jeremy



  • 12.  Re: Unknown alert receives - AlertMap file

    Posted Nov 12, 2018 10:15 AM

    Jeremy,

     

    A host model can be used for Southbound Gateway. Reference Southbound Gateway Toolkit - CA Spectrum - 10.2 to 10.2.3 - CA Technologies Documentation for information regarding Southbound Gateway.

     

    If you only want the trap processed on the Host_Device model, then you can enter the trap configuration in the $SPECROOT/customer/AlertMap file.

     

    Joe



  • 13.  Re: Unknown alert receives - AlertMap file

    Broadcom Employee
    Posted Nov 12, 2018 11:20 AM

    Joe has pointed out 2 problems with this event.  The original question described

    "

    Unknown alert received from device T38D1 of type Host_Device. Device Time 0+00:00:00. (Trap type 1.3.6.1.4.1.21066.6.6) Trap var bind data:

    ......

    In my AlertMap file, I have this code :
    1.3.6.1.4.1.21066.6.4    0x5e10fffb    1.3.6.1.4.1.21066.6.4.1(100,0)\

    "

     

    we can see an obvious mismatch between the oids ending with 21066.6.6 of the incoming trap and 21066.6.4 of the alartMap.  If 6.6 was not also mapped, it is unknown in Spectrum.

     

    The 2nd potential problem is that this map was put in the folder read by EventAdmin models and not host devices.

    this is discussed in more details here.

    AlertMap Files - CA Spectrum - 10.3 - CA Technologies Documentation 

    AlertMap File Location

    Default trap mappings are located in the <$SPECROOT>/SS/CsVendor directory while MIB Tools customized trap mappings are located in the <$SPECROOT>/custom/Events/AlertMap directory. MIB Tools’ customized trap mappings are preserved when you upgrade CA Spectrum, and they take precedence over any existing default trap mappings. For more information about working with custom trap mappings and default trap mappings, see Map Tab.

    Global AlertMap files are located in <$SPECROOT>/SS/CsVendor/<developername>/AlertMap, where <developername> is usually the name of the vendor, manufacturer, or developer that is associated with the model type.

    In some instances, CA uses something other than the developer name for the directory. For example, the IETF directory contains the AlertMap file that maps standard RFC traps.

    If the AlertMap file is specific to the model type, it is located in <$SPECROOT>/SS/CSVendor/<developername>/ <model_type_name>AlertMap, where:

    <developername> is the name of the vendor, manufacturer, or developer that is associated with the model type (for example, Compaq). If you are developing your own management module, your developer name is used here.

    <model_type_name> is the name of the model type.

    If a mapping for a trap exists in both a model type AlertMap file and a global AlertMap file, the model type AlertMap file takes precedence for that particular model type.

    When you map traps using MIB Tools, entries are generated in the following file on all SpectroSERVERs in your DSS environment:

    <$SPECROOT>/custom/Events/AlertMap

    The mapping information for a trap in these files overrides any mapping information that previously existed for that same trap in other files or directories on the SpectroSERVER.

     

    If you have further questions, please open an issue and I will look at this via webex tomorrow.

    best regards

    Shane



  • 14.  Re: Unknown alert receives - AlertMap file

    Posted Nov 13, 2018 03:21 AM

    Hi Shane and Joe,

     

    The problem was the location of the AlertMap file.

    I move this file in $SPECROOT/custom/ and the problem is resolved.

     

    Moreover, my code in my AlertMap file is correct, the problem was sending the trap with snmptrap (error with OID send); It's resolved too.

     

    Thanks a lot for your help.

     

    Jeremy



  • 15.  Re: Unknown alert receives - AlertMap file

    Posted Nov 13, 2018 03:59 AM

    Even i am facing the same issue ,after adding i could see the traps itself .Kindly suggest

     

    Unknown alert received from device xyz.dc of type GnSNMPDev. Device Time 51+11:20:23. (Trap type 1.3.6.1.4.1.11096.6.1.1.6.0)
    Trap var bind data:
    OID: 1.3.6.1.4.1.11096.6.1.1 Value: 8208 Information: High memory in device

     

    Added the belwo in SPECROOT/custom/Events/AlertMap file.

    1.3.6.1.4.1.11096.6.1.1.6.0 0xfff00004 1.3.6.1.4.1.11096.6.1.1 (1,0)