SNMP TRAP LINK DOWN LINK UP FROM CISCO SWITCHES

[ciscoguy]

Hello Guys

 

I Configured some Switches and Routers Cisco to send SNMP Trap LinkDown and LinkUp.

 

The Devices send the traps and they are received in the Spectrum but without information, I mean without the OID and Without the rest of the Information.

 

Nobody know what could be happening? and How to resolve it? Because I need the OID to create the Alarms

 

[Jason Volpini]

Hi Moises

 

There seems to be some information missing so it is difficult to say what may be the issue. Best suggestion would be to get a sniffer trace / packet capture of the trap. By reviewing the trap packet you can gather information such as the trap OID, the varbind OID and their values, and then can compare that information to the trap mapping within Spectrum to make sure everything lines up properly.

 

Regards,

Jay V

[Olaf Schalenberg]

the Additional Variables are optional within a link down trap. It depends on the vendor and the device to provide them.

Most devices only support ifIndex and ifDescription.

If the link down trap will lead to an alarm in Spectrum depends on your configuration. There have to be several attributes configured in order to get link down traps alarmed. Please refer to the documentation. Maybe you will find this helpful Port/Interface alarming in CA Spectrum when a port - CA Knowledge 

 

Regards,

Olaf

 

 

[ackjo04]

The standard linkUp/Down traps defined in the IF-MIB only send three varbinds by default:

 

linkDown NOTIFICATION-TYPE
OBJECTS { ifIndex, ifAdminStatus, ifOperStatus }
STATUS current
DESCRIPTION
"A linkDown trap signifies that the SNMP entity, acting in
an agent role, has detected that the ifOperStatus object for
one of its communication links is about to enter the down
state from some other state (but not from the notPresent
state). This other state is indicated by the included value
of ifOperStatus."
::= { snmpTraps 3 }

linkUp NOTIFICATION-TYPE
OBJECTS { ifIndex, ifAdminStatus, ifOperStatus }
STATUS current
DESCRIPTION
"A linkUp trap signifies that the SNMP entity, acting in an
agent role, has detected that the ifOperStatus object for
one of its communication links left the down state and
transitioned into some other state (but not into the
notPresent state). This other state is indicated by the
included value of ifOperStatus."
::= { snmpTraps 4 }

 

Vendors will tag additional information in their own mibs so the link up/down traps defined in the $SPECROOT/SS/CsVendor/IETF/AlertMap file tries to capture that data.

 

So if a vendor only sends the basic, then you will only see the basic. Everything else will be blank.

 

Joe

[ciscoguy]

Hello Joe

 

Very usefull your information but you are telling me about the way to send trap with IETF RFC 2233 with commands:

 

• snmp-server trap link ietf

 

and I am using this commands with MIB CISCO:

 

• snmp-server host X.X.X.X Prueba V2c snmp
• snmp-server enable traps snmp linkdown linkup coldstart warmstart

 

I used another SNMP Gestor and I got more information that Spectrum gives me and specially I can see the OID:

 

 

Is there any way that with the information that spectrum gives to create the alarms? Because I have understood I need to see the OID when I received the Trap to map it and create the alarm.

[ackjo04]

The standard link down trap is mapped in the $SPECROOT/SS/CsVendor/IETF/AlrtMap file as follows.

 

The four varbinds in your example ar configured in the AlertMap file configuration for this trap.

 

Is the device sending the standard link down trap?

 

# link-down # ifIndex
2.0 0x00220001 1.3.6.1.2.1.2.2.1.1(1,2)\
# ifDescr
1.3.6.1.2.1.2.2.1.2(3,2)\
# ifType
1.3.6.1.2.1.2.2.1.3(4,2)\
# ifAdminStatus
1.3.6.1.2.1.2.2.1.7(5,2)\
# ifOperStatus
1.3.6.1.2.1.2.2.1.8(6,2)\
# sysObjectID
1.3.6.1.2.1.1.2(7,0)\
# sysName
1.3.6.1.2.1.1.5(8,0)\
# locIfReason
1.3.6.1.4.1.9.2.2.1.1.20(9,0)\
# ifReasonForStatusCes
1.3.6.1.4.1.2505.1.14.2.1(10,0)\
# ifPhysLocationCes
1.3.6.1.4.1.2505.1.14.2.2(11,0)\
# ifPhysRelPosCes
1.3.6.1.4.1.2505.1.14.2.3(12,0)\
# ifIpAddrCes
1.3.6.1.4.1.2505.1.14.2.4(13,0)\
# ifNameCes
1.3.6.1.4.1.2505.1.14.2.5(14,0)\
# ifTunnelRemoteIpAddrCes
1.3.6.1.4.1.2505.1.14.2.6(15,0)\
# ifName
1.3.6.1.2.1.31.1.1.1.1(16,0)\
# ifAlias
1.3.6.1.2.1.31.1.1.1.18(17,0)\
# usdSnmpTrapTrapSeverity
1.3.6.1.4.1.4874.2.2.16.1.3.5(18,0)

[ciscoguy]

Hello Joseph

 

What do you mean with Standard Link Down Trap? I configured my Cisco Devices Switches and Routers with the Following configuration what I found in an official Cisco's Website.

 

• snmp-server host X.X.X.X Prueba V2c snmp
• snmp-server enable traps snmp linkdown linkup coldstart warmstart

 

The last Image I post It was from NMS PowerSNMP , Also I used NMS PRTG, SNMP TRAP LISTENER and WireShrak and all of them give me obviously the same OID of the TRAP LINK DOWN AND LINK UP

 

1.3.6.1.6.3.1.1.5.3 and 1.3.6.1.6.3.1.1.5.4

 

I investigate those OIDs 

 

 

That Belows to the MIB :  IF-MIB

 

 

And in IF-MIB Information:

 

 

Spectrum doesn't show me the OIDs 1.3.6.1.6.3.1.1.5.3 and 1.3.6.1.6.3.1.1.5.4 that I understand are needed to create the AlarmsMap right? If it is no needed I ask you again Is there a way to create alarms only with the information that I receive in the spectrum from the Trap that I showed in the First Image when I opened the Post?

[ciscoguy]

Oh well Now I Found this information in CA's Website:

 

And I have this information so I think It is a Generic Trap

 

[Olaf Schalenberg]

as already said, the Link Down Trap is already mapped in Spectrum and it seems you have to take more care about your configuration like

Link Down trap - The device first needs to be configured to send link down traps to the SpectroSERVER system. When set to process the trap, Spectrum will assert a Critical "BAD LINK DETECTED" alarm on the interface model associated with the trap.

AlarmOnLinkDownTrap
Attribute ID: 0x11fc2
Determines how CA Spectrum handles a Link Down trap on this particular port. (0 for ignore the trap, 1 for process the trap).

In addition, the interface can be configured to assert a Minor alarm on the device model when a link down trap is received.

AssertLinkDownAlarm
Attribute ID: 0x12957
Determines whether CA Spectrum generates a yellow alarm on the device model when a link-down trap is received for this port.

 

 

where to find?

see above

[ciscoguy]

Hello

 

So You are telling me If I Receive a Bad Link Detected Event this is attached to the Trap my device is sending?  can I  convert it to send it in a email?

 

Because I am not the administrator of SPECTRUM and the real person that administer it is telling me that he needs the OID to map it and later convert it in a alarm to send it in an email.

[Olaf Schalenberg]

if your device sends a standard Link Down trap, it will be mapped to an Event. There is no need to add an additional OID. You have already posted the specific Event in your first message.

If AlarmOnLinkDownTrap Attribute ID: 0x11fc2 is set to "always" for the port model, it will lead to an alarm on the port. If it is set to "never", it will not lead to an alarm. If it's set to "Check Admin" Spectrum will poll for the current status.

If you want to see the alarm in addition on the device model the AssertLinkDownAlarm Attribute ID: 0x12957 has to be set to TRUE. If such an alarm  will lead to an email depends on the SANM and AlarmNotifier configuration.

Please also look for other Spectrum port  monitoring concepts, such as Live Pipes.

 

 

[ciscoguy]

If I am correct CA SPECTRUM works with alerts, events and alarms.

 

Alerts is when a Trap is Received and Events is a Response From Spectrum if the trap is mapped.

 

So My First Image I post is the Alert and If I receive a Bad Link Detected this is the Event? that can be convert it in a Alarm to be sent it to a specific email?

 

Or my first Image is the Event already mapped that is related with AlarmOnLinkDownTrap Attribute ID: 0x11fc2? and later this I can convert it in a Alarm to be send it to a specific email?