We are trying to monitor the netapp devices (netapp sending traps to spectrum) in spectrum. We have already imported the MIB and created the trap support.
But there is a mismatch of the OID present in the MIB file and from which we are getting the trap.
For e.g :
In MIB tool the trap OID is "18.104.22.168.4.1.722.214.171.12413 but the trap OID we are getting from netapp is "126.96.36.199.4.1.7188.8.131.5213"
please suggest how we can fix this issue ?
That should still work, it’s SNMPv1 vs SNMPv2. Spectrum takes that into account automatically (however you can change the number in the $SPECROOT/custom/Events/AlertMap file (but you really shouldn’t have to)).
Are you seeing that Spectrum is not generating the event you have specified for that trap?
Yes, netapp is sending snmp v1 traps but Spectrum is not recognising, it’s showing them as “unknown”.
As you mentioned spectrum should handle this automatically but it’s not.
What could be the possible reason?
I downloaded DATAFABRIC-MANAGER-MIB and NETWORK-APPLIANCE-MIB and imported into MIB Tools. I see 184.108.40.206.4.1.7220.127.116.1113 in the MIB but not 18.104.22.168.4.1.722.214.171.12413. This tells me netapp should update their MIB to reflect this new trap they are sending.
You could add 126.96.36.199.4.1.7188.8.131.5213 to the Alertmap as Jay mentioned previously. Information on working with Alertmap files can be found here: https://docops.ca.com/ca-spectrum/10-2-3/en/managing-network/event-configuration/alertmap-files
as Jason already said, it doesn't matter in which format the device sends the trap (.0. or .6.). Spectrum will understood both, even if only one is mapped in the AlertMap file.
May you have only missed to reload the Alert/Event configuration change to the SepctroSERVER?
You will find a "SpectroServer Control->Update Event Configuration" in the Information Tab of the VNM model.
In order to get the Event messages in OneClick, you have to load Event changes for the OC Server as well. You will find this option in the OC SERver Admin page.
If there are problems with the syntax in your Event configuration, the event error log file could be helpful
Where is the unknown event being generated? On the device model or the VNM model?
Can you send a copy of the unknown trap event and the AlertMap file mapping of the trap?
Unknown trap are being generated on the device model. Attached the snap of event mapping from alertmap file
as already said, I guess your configuration is not loaded by the SS.
Did you have reloaded the Event Configuration after creation of your files?
Where are your configuation files located? The prompt in the screen shot looks different than ".../custom/Events" or other valid places.
Please either provide the full event message for unknown trap, or a sniffer trace, or the Alert Manager in debug mode output (VNM.OUT). I would like to ensure the Trap OID that Spectrum is receiving matches with the AlertMap entry.
Internal Only: How to enable Alert Manager debuggi - CA Knowledge
Alert Manager debug output would be useful here for sure. There’s an easier way to do it:
VNM Information View – scroll down to Dynamic Debugging – Alert Manager - Change to Enabled
Reproduce the issue. Turn the debug off.
Output writes to the VNM.OUT.
We may need a ticket for this.
Please see the attached snap of unknown trap.
Thanks all for the information, will open a support ticket for the same