my problem is i am not able to understand their working. i have port security enabled in my network and my network do keep changing a lot in terms of end hosts.

According to the docs, "Major acquisition fetches end hosts for all switches where as minor acquisition fetches end hosts from switches which were reported as to have changed in the last Data Collection or polling cycle."

I want to know what kind of trap reports to CM for this minor acquisition to run. and If CM doesn't get those traps within 60 mins, will it run major acquition instead.

Changing end hosts or access ports does not count in terms of minor acquisition. The changes only refer to infrastructure changes (e.g. inter-device links going down).

The detection of changes for minor acquisition does not come from traps. It can come from ANI devices and links polling and Data Collection. Both are configured under Campus Manager > Administration > Data Collection > Schedule Data Collection and Device Poller. I already gave the example of a topology link going down. Another example is a switch reloading.

If changed devices have been detected, and the 60 minute timer pops, ANI will dump the list of changed devices to a file, then start the UTMajorAcquisition daemon with arguments to do a minor acquisition as opposed to a major one.

If, however, it is time to run a major acquisition, the minor acquisition will be skipped. Additionally, a minor acquisition will not run if at least one Data Collection has not been done or one major acquisition has not been done.

Instead of using minor acquisitions, I typically recommend users enable Dynamic User Tracking. This mode uses the CISCO-MAC-ADDRESS-NOTIFICATION-MIB traps to get near instant notifications of when users enter and leave the network. In this mode, end host entries will be automatically added to UT without needing to run an acquisition.

thnks man.