SNMP Traps for Interface Errors

klherisson · ‎04-16-2007

Is it possible for a Catalyst 6500 series switch to generate snmp traps upon the generation of interface errors (e.g. CRC, underrun)?

wong34539 · ‎04-20-2007

SNMP Traps are not defined for interface errors like CRC or underrun. They can be used to find if the interfaces changes state.

Refer to http://www.cisco.com/en/US/products/sw/netmgtsw/ps837/products_user_guide_chapter09186a00800a4c54.html#xtocid13

Iain · ‎04-20-2007

I think Syslog can do this. You could dump the messages to a syslog server and get notified when it happens. It wouldn't be SNMP, but it would allow you to get notification when the event occurs.

http://www.kiwisyslog.com/syslog-info.php

klherisson · ‎04-20-2007

I've been a long time user of KiwiSyslog but I believe the previous poster was correct regarding that this is not within the SNMP trap functionality. I have also tried to put various switches into logging debug mode for the purpose to see what happens when a CRC is generated but unfortunately it does not send a syslog message either. I'll get link status, VTP, power, environmental, login and misc messages but no port error traps via either SNMP or Syslog. Although it would be nice to see this feature in future IOS implementations.

Iain · ‎04-20-2007

I think you can do this in CatOS. My experience has been that CatOS will allow you to get alot more granular when defining Syslog logging levels.

This is a good question. I would definitely be interested in knowing if there is a method for monitoring these values in IOS.

klherisson · ‎04-20-2007

I partially take back what I said based upon an analysis of the syslog from a Catalyst 2924XL switch. I notice that when a port is showing a high number of errors you will receive a messages similar to the one below.

2007-04-20 17:15:39 Local7.Warning xxx.xxx.xxx.xxx 5054: Apr 20 21:15:18: %LINK-4-ERROR: FastEthernet0/18 is experiencing errors

Although, it does this after an indeterminate amount of errors have accumulated. When I have looked at impacted ports they will usually have several hundred errors. Although I have found nothing that will generate a trap based upon a single interface error event.

Iain · ‎04-20-2007

Is it possible that this could be caused by some sort of timing issue? Such as a delay between the times when syslog is 'checking' the status of this field? Perhaps the errors are occurring fast enough to accumulate hundreds before the event is reported.

I'm not familiar enough with the architecture of syslog to know how it gathers the data to generate an event.