Warning message

  • Cisco Support Forums is in Read Only mode while the site is being migrated.
  • Cisco Support Forums is in Read Only mode while the site is being migrated.

Sensor Health Thresholds

Unanswered Question
Aug 5th, 2009
User Badges:

We now have the concept of system health which can be viewed in the IDM Dashboard, but can/could the same monitors be configured to send a snmptrap on threshold breach?

  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 0 (0 ratings)
mkodali Wed, 08/05/2009 - 16:14
User Badges:
  • Cisco Employee,

Threshold breaches on sensor are tracked by health monitor application in the form of heartbeat messages encapsulated in evStatus events every 300 seconds as shown below :

evStatus: eventId=1172446951295212902 vendor=Cisco


hostId: qssm-230

appName: monitor

appInstanceId: 359

time: 2007/02/26 05:00:05 2007/02/26 05:00:05 UTC


description: Heartbeat

healthStatus: red


virtualSensor: vs0

status: green



evStatus messages cannot be sent as snmp traps like evError messages. However the events that cause the threshold to exceed in some cases are also generated as evError messages which are eligible to be sent as snmptraps. Some examples are termination of some application like sensorApp or removing the monitoring interface from virtual sensor, etc. as shown below :

evError: eventId=1172446951295212899 severity=warning vendor=Cisco


hostId: qssm-230

appName: sensorApp

appInstanceId: 456

time: 2007/02/26 04:59:14 2007/02/26 04:59:14 UTC

errorMessage: name=errWarning unspecifiedWarning:There are no interfaces assigned to any virtual sensors. This can result in some packets not being monitored.

Hope this helps


This Discussion