SOI SNMP Policy - Solarwinds

[Kaviarasu Jayapal]

Hi All,

Need some help to build SNMP policy for the solarwinds traps.

I could see the CA:00036*.xml files in the Eventstore, but those are not converted to normalized events.

Attached the snmp policy and the eventstore files for reference. 

Thanks,
Kavi

Attachment(s)

CA-00036-us-smy-wdsw1.am.elcompanies.net!2019-07-16!5!1.xml   192 KB 1 version

snmp_policy_solarwinds.xml   9 KB 1 version

[Michael Boehm]

Hi Kavi,

I had a look at the policy and all seems to be properly coded.

Three things are worthwhile to mention:
The Label part is commented out, e.g. you will not get the Label you set in the code (temp_Label).
To use a temporary variable "severity" is possibly confusing the system, because the system variable is "Severity".  I hope the system is case sensitive.
Which version of the SNMP Connector do you use?  The usage of direct varbind-OIDs is not supported by all versions.  The Catalyst version does create these values, the IFW version only with a patch.

The attached Eventstore seems to be corrupt, it only creates an error message when trying to open the file.
What exactly is the issue you are facing?
Can you attach a screencapture of what you see on the console, and a description of what you expect?
Looking at the Eventstore does not really help any further here.

You can also contact me directly, if you don't want to share sensitive data in the Community: [e-mail].

Michael

------------------------------
Customer Success Architect
CA Deutschland GmbH (a Broadcom company)
------------------------------

[Michael Boehm]

The analysis is followed up in direct email communication.
Once we have identified the issue, I will post the solution.

Michael

------------------------------
Customer Success Architect
CA Deutschland GmbH (a Broadcom company)
------------------------------

[Michael Boehm]

The issue was fixed by applying two changes to the policy:
The parsing pattern to extract information from the trap varbinds was wrong (one group too much), and the only traps that came into the system so far were from "Nodes", but that part was commented out in the policy.  Thus, no trap was recognized for being processed.

Michael

------------------------------
Customer Success Architect
CA Deutschland GmbH (a Broadcom company)
------------------------------