IP SLA Threshold - Notification (Trap)

slueckoff · ‎07-28-2009

Hello,

I still have a problem with notifications of ip sla thresholds. I defined for example the following ip sla reaction:

ip sla reaction-configuration 94492 react maxOfNegativeSD threshold-value 3 3 threshold-type immediate action-type trapOnly

When should the device send out a (trap-)notification?

I got the following Traps:

Wed Jul 29 07:52:16 2009 A rttMonNotification indicates the occurrence of a sw-test-xy-1 C0 A8 A8 0B maxOfNegativeDS false 1 3 3 00 00 00 00

Wed Jul 29 07:52:14 2009 A rttMonNotification indicates the occurrence of a sw-test-xy-1 C0 A8 A8 0B maxOfNegativeDS false 1 3 3 00 00 00 00

Wed Jul 29 07:51:19 2009 A rttMonNotification indicates the occurrence of a sw-test-xy-1 C0 A8 A8 0B maxOfPositiveDS true 1 3 3 00 00 00 00

Wed Jul 29 07:51:17 2009 A rttMonNotification indicates the occurrence of a sw-test-xy-1 C0 A8 A8 0B maxOfPositiveDS true 1 3 3 00 00 00 00

In the MIB-Translation there are the names of the variables:

Variables:

1: rttMonCtrlAdminTag

2: rttMonHistoryCollectionAddress

3: rttMonReactVar

4: rttMonReactOccurred

5: rttMonReactValue

6: rttMonReactThresholdRising

7: rttMonReactThresholdFalling

8: rttMonEchoAdminLSPSelector

EDESC

So, how can it be, that there is a threshold rttMonReactOccurred=true and the rttMonReactValue=1 by a rttMonReactThresholdRising=3?

Isn't the rttMonReactValue this value that should be upper the 3 when rttMonReactOccurred=true?

Has someone an idea?

Joe Clarke · ‎08-01-2009

It would be helpful to see an SNMP walk of the entire ciscoRttMonMIB branch to see exactly what is configured in terms of IP SLA thresholds. It appears that you have more than one reaction configured.

slueckoff · ‎08-03-2009

Yes, there is more than one reaction configured.

The notification that are send by the komponent are OK.

Only the argument 5: rttMonReactValue is not right. It is not the maxOfNegativeDS or maxOfPositiveDS. May be it is the jitter average

Joe Clarke · ‎08-03-2009

It seems consistent with what you've shown to have configured. In the case of the first two traps, rttMonReactOccurred is false meaning that the condition is no longer occurring. The reason that the condition is no longer occurring is that the current value of 1 is less than the falling threshold of 3.

If you're saying the value of 1 is wrong, then I would need to see more evidence of that from the latest completion results of the collector in question.

slueckoff · ‎08-03-2009

Yes, the first two traps seems consistent.

But what is with the last two?

After my observations it seems that the ReactValue is not the value that I anticipate. For the third trap I anticipate the maxOfPositiveDS-jitter-value but it isn't this value.

New example:

configuration:

ip sla reaction-configuration 94492 react maxOfPositiveDS threshold-value 10 10 threshold-type immediate action-type trapOnly

ip sla reaction-configuration 94492 react maxOfNegativeDS threshold-value 10 10 threshold-type immediate action-type trapOnly

notifications:

2040 rttMonNotification .1.3.6.1.4.1.9.9.42.2.0.5 .1.3.6.1.4.1.9.9.42.2.0.5 .1.3.6.1.4.1.9.9.42.2 public 192.168.2.5 192.168.2.5 Status Events Warning 5:9:51:40.74 Sun Aug 2 20:37:55 2009 A rttMonNotification indicates the occurrence of a sw-test-xy-1 C0 A8 A8 0B maxOfNegativeDS false 1 10 10 00 00 00 00 0

2039 rttMonNotification .1.3.6.1.4.1.9.9.42.2.0.5 .1.3.6.1.4.1.9.9.42.2.0.5 .1.3.6.1.4.1.9.9.42.2 public 192.168.2.5 192.168.2.5 Status Events Warning 5:9:51:40.74 Sun Aug 2 20:37:53 2009 A rttMonNotification indicates the occurrence of a sw-test-xy-1 C0 A8 A8 0B maxOfPositiveDS false 1 10 10 00 00 00 00

2049 rttMonNotification .1.3.6.1.4.1.9.9.42.2.0.5 .1.3.6.1.4.1.9.9.42.2.0.5 .1.3.6.1.4.1.9.9.42.2 public 192.168.2.5 192.168.2.5 Status Events Warning 5:15:10:40.73 Mon Aug 3 01:56:57 2009 A rttMonNotification indicates the occurrence of a sw-test-xy-1 C0 A8 A8 0B maxOfNegativeDS true 5 10 10 00 00 00 00 0

2048 rttMonNotification .1.3.6.1.4.1.9.9.42.2.0.5 .1.3.6.1.4.1.9.9.42.2.0.5 .1.3.6.1.4.1.9.9.42.2 public 192.168.2.5 192.168.2.5 Status Events Warning 5:15:10:40.73 Mon Aug 3 01:56:55 2009 A rttMonNotification indicates the occurrence of a sw-test-xy-1 C0 A8 A8 0B maxOfNegativeDS true 5 10 10 00 00 00 00 0

2047 rttMonNotification .1.3.6.1.4.1.9.9.42.2.0.5 .1.3.6.1.4.1.9.9.42.2.0.5 .1.3.6.1.4.1.9.9.42.2 public 192.168.2.5 192.168.2.5 Status Events Warning 5:15:10:40.72 Mon Aug 3 01:56:54 2009 A rttMonNotification indicates the occurrence of a sw-test-xy-1 C0 A8 A8 0B maxOfPositiveDS true 5 10 10 00 00 00 00 0

2046 rttMonNotification .1.3.6.1.4.1.9.9.42.2.0.5 .1.3.6.1.4.1.9.9.42.2.0.5 .1.3.6.1.4.1.9.9.42.2 public 192.168.2.5 192.168.2.5 Status Events Warning 5:15:10:40.72 Mon Aug 3 01:56:52 2009 A rttMonNotification indicates the occurrence of a sw-test-xy-1 C0 A8 A8 0B maxOfPositiveDS true 5 10 10 00 00 00 00 0

Why is the ReactValue 5 by the last four traps?

Joe Clarke · ‎08-03-2009

This could be CSCsd57199, but I can't say for certain since you haven't provided any IOS version.

slueckoff · ‎08-03-2009

The Softwareversion is:

Cisco IOS Software, C3560 Software (C3560-ADVIPSERVICESK9-M), Version 12.2(46)SE, RELEASE SOFTWARE (fc2)

Joe Clarke · ‎08-03-2009

It appears you are hitting this bug, though this bug was filed against 12.4T. However, the fix was not committed to 12.2(46)SE, and the same broken code appears to be used. The same problem exists up to 12.2(50)SE3.

I recommend you open a TAC service request so this additional platform can be documented so a fix can be made into the SE branch.