How to map traps from vRealize Operations Manager to specific models?

[Legacy User]

I'm receiving unknown alert traps from vROM and I need to process them in order to create alarms and attach them to specific models (vm appliances) which are managed by vCenter Server and we have modeled in Spectrum under the Virtual Host Management module. 

I compiled the MIBs for this product (I got them from VMWare) and I'm know creating events and configuring my custom AlertMap file. 

The thing is I don't understand quite well where to get the generic and specific type identifiers to configure the AlertMap file properly. 

 

So far, I created a custom event from the Oneclick console directly, and I'm setting up my custom AlertMap file. 

 

# vmwareAlertTrap vmwareAlertAliveServerName ("The name of the VCOPs server that generated this alert.")
1.3.6.1.4.1.6876.4.5.1.6.46 0xfff00008 1.3.6.1.4.1.6876.4.5.1.2.1(1,0)\
# vmwareAlertEntityName ("The Entity name about which this alert was generated.")
#1.3.6.1.4.1.6876.4.5.1.2.2(2,0)\
# vmwareAlertCriticality ("A text string describing the alert criticality level.")
#1.3.6.1.4.1.6876.4.5.1.2.5(3,0)\
# vmwareAlertMetricName ("The textual metric name of the alert that was generated.")
#1.3.6.1.4.1.6876.4.5.1.2.15(4,0)\
# vmwareAlertDefinitionName ("Alert Definition Name")
#1.3.6.1.4.1.6876.4.5.1.2.17(5,0)

 

I need generate alarms for the models specified in the variable 1.2.2.0. 

 

This is the trap:

 

Unknown alert received from device FC-SFC-HOR-VROPS02 of type Pingable. Device Time 107+10:42:14. (Trap type 1.3.6.1.4.1.6876.4.5.1.6.46)
Trap var bind data:
OID: 1.3.6.1.2.1.1.3.0 Value: 928333440
OID: 1.3.6.1.6.3.1.1.4.1.0 Value: 1.3.6.1.4.1.6876.4.5.1.0.46
OID: 1.3.6.1.4.1.6876.4.5.1.2.1.0 Value: FC-SFC-HOR-VROPS02
OID: 1.3.6.1.4.1.6876.4.5.1.2.2.0 Value: Agregation-Edge-03
OID: 1.3.6.1.4.1.6876.4.5.1.2.3.0 Value: General
OID: 1.3.6.1.4.1.6876.4.5.1.2.4.0 Value: 1499871888058
OID: 1.3.6.1.4.1.6876.4.5.1.2.5.0 Value: critical
OID: 1.3.6.1.4.1.6876.4.5.1.2.6.0 Value: New alert by id 54bb044e-da71-4247-81ac-4462388552b2 is generated at Wed Jul 12 12:04:48 ART 2017;
OID: 1.3.6.1.4.1.6876.4.5.1.2.7.0 Value: https://10.120.85.80/ui/index.action#/alert/54bb044e-da71-4247-81ac-4462388552b2/summary
OID: 1.3.6.1.4.1.6876.4.5.1.2.8.0 Value: 54bb044e-da71-4247-81ac-4462388552b2
OID: 1.3.6.1.4.1.6876.4.5.1.2.9.0 Value: 73.79.6D.70.74.6F.6D.53.65.74.3A.20.34.38.65.34.30.65.39.33.2D.34.38.64.65.2D.34.33.66.35.2D.39.38.64.30.2D.62.32.37.66.39.66.31.32.37.39.63.39.A.72.65.6C.61.74.69.6F.6E.3A.20.73.65.6C.66.A.74.6F.74.61.6C.4F.62.6A.65.63.74.73.3A.20.31.A.76.69.6F.6C.61.74.69.6E.67.4F.62.6A.65.63.74.73.3A.20.31.A.73.79.6D.70.74.6F.6D.3A.20.57.65.74.63.6F.6D.20.2D.20.53.69.6E.20.74.72.3F.66.69.63.6F.A.61.63.74.69.76.65.3A.20.74.72.75.65.A.6F.62.6A.2E.31.2E.6E.61.6D.65.3A.20.41.67.72.65.67.61.74.69.6F.6E.2D.45.64.67.65.2D.30.33.A.6F.62.6A.2E.31.2E.69.64.3A.20.32.38.31.39.61.30.63.37.2D.39.63.35.38.2D.34.36.30.61.2D.38.65.35.38.2D.62.36.35.62.35.64.31.64.66.39.36.36.A.6F.62.6A.2E.31.2E.6D.65.74.72.69.63.3A.20.6E.65.74.7C.75.73.61.67.65.5F.61.76.65.72.61.67.65.A.6F.62.6A.2E.31.2E.69.6E.66.6F.3A.20.48.54.20.65.71.75.61.6C.73.20.30.20.3D.20.30.A
OID: 1.3.6.1.4.1.6876.4.5.1.2.10.0 Value: Application
OID: 1.3.6.1.4.1.6876.4.5.1.2.11.0 Value: Availability
OID: 1.3.6.1.4.1.6876.4.5.1.2.12.0 Value: critical
OID: 1.3.6.1.4.1.6876.4.5.1.2.13.0 Value: info
OID: 1.3.6.1.4.1.6876.4.5.1.2.14.0 Value: info
OID: 1.3.6.1.4.1.6876.4.5.1.2.15.0 Value: net|usage_average
OID: 1.3.6.1.4.1.6876.4.5.1.2.16.0 Value: EdgeServicesGateway
OID: 1.3.6.1.4.1.6876.4.5.1.2.17.0 Value: Edge Sin trafico
OID: 1.3.6.1.4.1.6876.4.5.1.2.19.0 Value: health

This is the MIB:

 

librenms/VMWARE-VCOPS-EVENT-MIB at master · librenms/librenms · GitHub 

 

I think that the 6.46 part of the "Trap type 1.3.6.1.4.1.6876.4.5.1.6.46" corresponds to the enterprise specific (the 6) and the specific trap (the 46). Right?

 

Now, how do I attach the alarm to the Agregation-Edge-03 vm? (OID: 1.3.6.1.4.1.6876.4.5.1.2.2.0 Value: Agregation-Edge-03). Can I look for the model name instead of the IP address, right?

[Catalin Farcasanu]

The mib file is missing some information: These oids are missing: 1.3.6.1.4.1.6876.4.5.1.2.12.0-1.3.6.1.4.1.6876.4.5.1.2.19.0

[Legacy User]

Yes, it's true. But that's not the point. I have the correct MIB in which those variables exist. 

[Mohammed Alfakhrany]

Hi Elio,

 

We have a KB article that describes how to map unknown traps to events and alarms:

 

Customising Events and Mapping Traps

 

Go through it and see if it helps.

[Catalin Farcasanu]

Basically, you need to create a southbound integration using the traps you're receiving from your devices. Here is an example on the process. You need to be able to identify uniquely your devices.  This is done with the variables 1-6. Here you find some information on how this should be done. From the trap, I see that the only possible candidate for identifying your model on which you need your event/alarm raised would be 1.3.6.1.4.1.6876.4.5.1.2.2.0.

 

Actually, I would suggest reading out the entire chapter.

[Legacy User]

Thanks Catalin. I've read it, but I don't quite understand how Spectrum determines what variable to take into account for indetifying the model I need to assert the alarm to. On the other hand, is it mandatory to define an EventDisp file for an EventAdmin Model? 

 

My scenario is this:

A vROM server sends traps to Spectrum alerting for a VM with some issue

I already managed to create an event from the trap received

My files are located here:

   /spectrum/custom/Events/VMWare-vROM/AlertMap

   /spectrum/custom/Events/VMWare-vROM/EventDisp

I need to assert the event to the model specified in variable 1.3.6.1.4.1.6876.4.5.1.2.2.0 (as you correctly mentioned before)

 

Do I have to put my files in a folder like this? /spectrum/custom/Events/gen_app_gw/VMWare-vROM

Will doing that be enough?

[Catalin Farcasanu]

Yes, it's mandatory to use EventAdmin. You have to modify the AlertMap and EventDisp for EventAdmin models. You don't have to actually use an EventAdmin model, you can use also other types of models, but the modification made have to be for the AlertMap/EventDisp for EventAdmin. I think the decision is based on an attribute on the model (SBG_AlertForwardingEnabled). Basically if your device is modeled as a model that has this attribute, you can use it to forward events received from it to another device. There is also a technical document for this. You'll find it here.

 

I'm usually using Host_SystemEDGE as model type for creating this integrations, but this means that SystemEDGE has to be installed on the manager. There are examples in the Spectrum documentation on how to setup the eHealth integration with SPECTRUM. This integration is describing a process in which Spectrum has to evaluate devices that is not actually monitoring, devices that are not modeled in spectrum. Spectrum would create an EventModel for all those devices that are not modeled in Spectrum. You should check here this process, as what you have to setup is a very similar situation.

[Legacy User]

I configured the events to be processed by SBGW, but I'm not figured out how to forward the event to the correct models yet. 

 

I have my files in these directories:

 

/spectrum/custom/Events/gen_app_gw/EventAdmin/EventDisp

0xfff00008 E 0 
0xfff00009 E 0 C 0xfff00008,2,4

 

/spectrum/custom/Events/gen_app_gw/EventDisp

0xfff00008 E 0
0xfff00009 E 0 A 0,0xfff00009 C 0xfff00008,2,4

 

/spectrum/custom/Events/gen_app_gw/AlertMap

# vmwareTrapProblemActive vmwareAlertAliveServerName ("The name of the VCOPs server that generated this alert.")
1.3.6.1.4.1.6876.4.5.1.6.46 0xfff00008 1.3.6.1.4.1.6876.4.5.1.2.1(101,0)\
# vmwareAlertEntityName ("The Entity name about which this alert was generated.")
1.3.6.1.4.1.6876.4.5.1.2.2(16,0)\ #La variable 16 le indica al SBGW que busque al modelo por nombre
# vmwareAlertCriticality ("A text string describing the alert criticality level.")
1.3.6.1.4.1.6876.4.5.1.2.5(103,0)\
# vmwareAlertID
1.3.6.1.4.1.6876.4.5.1.2.8(104,0)\
# vmwareAlertMetricName ("The textual metric name of the alert that was generated.")
1.3.6.1.4.1.6876.4.5.1.2.15(105,0)\
# vmwareAlertDefinitionName ("Alert Definition Name")
1.3.6.1.4.1.6876.4.5.1.2.17(106,0)\

#####################################################################################################################################

# vmwareTrapProblemClear vmwareAlertAliveServerName ("The name of the VCOPs server that generated this alert.")
1.3.6.1.4.1.6876.4.5.1.6.47 0xfff00009 1.3.6.1.4.1.6876.4.5.1.2.1(101,0)\
# vmwareAlertEntityName ("The Entity name about which this alert was generated.")
1.3.6.1.4.1.6876.4.5.1.2.2(16,0)\
# vmwareAlertCriticality ("A text string describing the alert criticality level.")
1.3.6.1.4.1.6876.4.5.1.2.5(103,0)\
# vmwareAlertID
1.3.6.1.4.1.6876.4.5.1.2.8(104,0)\
# vmwareAlertMetricName ("The textual metric name of the alert that was generated.")
1.3.6.1.4.1.6876.4.5.1.2.15(105,0)\
# vmwareAlertDefinitionName ("Alert Definition Name")
1.3.6.1.4.1.6876.4.5.1.2.17(106,0)\

 

I read in the guide something about the Event Data Template, and that in order to match the model by name (case insensitive) I would need to map the varbind to variable 16 of the event. Is that correct?

On the other hand, the guide suggests to use variable numbers greater than 100, and that's why I'm mapping varbinds to variables 101, 103, 104, 105 and 106. 

 

I see that the traps are being processed and events are being created, but these events are attached to the vROPS server instead of the entity the alarm was generated about.

 

What am I doing wrong?  

[Catalin Farcasanu]

I'm assuming you took a close inspection at event data template for SBGW. There are several situation described here. Have you tried all of them? I don't see any IP address in your TRAP. Maybe you need to use one of the OID's (maybe even name) as a unique identifier in 1-6 fields. I would use variable id 7 as identifier of Event Model. You'll get a message on what's going on.

[Legacy User]

I'm using variable 16 instead of variable 7, because the first one is case insensitive. And I'm doing this because, as you say, there's no IP address in the trap. 

[Catalin Farcasanu]

Try to set also 1-6, at least one. It does not matter what type of data is presented there, just to see if the EventModel get created.

[Legacy User]

Actually, I don't need to create any EventModel, cause models exist (they are VMs). However, I was first using variables 1-6 instead of using 101-106, but no EventModel was created.