Placing SNMP messages in system log

Answered Question
Aug 18th, 2009
User Badges:

Does anyone know a way that we can place our SNMP messages in with our syslog? That way we could correlate our SNMP traps with our syslogs.

Thank you,

Bill

Correct Answer by Lucien Avramov about 7 years 9 months ago

No you can not do that, snmp traps are sent in an snmp format to an snmp server. The console can not display you those headers and the content of the snmp message.


But, traps are triggered by events that can be seen on the syslog usually, depending what events you want to monitor.


Another thing you can do is generate SNMP traps for RMON events for example if cpu is above xx%. That will create a syslog messsage that is also encapsulated as SNMP trap.

Also, EEM can generate syslog messages for certain actions on the router.


But to see the snmp message itself, only a packet capture or the receiving snmp server will show it to you, not the syslog message.

  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 5 (1 ratings)
Loading.
Lucien Avramov Tue, 08/18/2009 - 10:03
User Badges:
  • Red, 2250 points or more

You can send syslog messages in snmp traps but you can not do the opposite: send snmp messages in syslog.


The only thing you may do is set your syslog level at debug and turn debug snmp packet, which i do NOT recommend as a simple snmpwalk with debug on, will spike your cpu.


HTH

one_w_borg Tue, 08/18/2009 - 10:41
User Badges:

Sorry.. I may have not been real clear on what I was trying to do.

My real question is - is it possible for me to send snmp traps not only to the snmp-server I specify, but also to the router's logging buffer - so that I can see the traps when I do a "show log".

Correct Answer
Lucien Avramov Tue, 08/18/2009 - 10:58
User Badges:
  • Red, 2250 points or more

No you can not do that, snmp traps are sent in an snmp format to an snmp server. The console can not display you those headers and the content of the snmp message.


But, traps are triggered by events that can be seen on the syslog usually, depending what events you want to monitor.


Another thing you can do is generate SNMP traps for RMON events for example if cpu is above xx%. That will create a syslog messsage that is also encapsulated as SNMP trap.

Also, EEM can generate syslog messages for certain actions on the router.


But to see the snmp message itself, only a packet capture or the receiving snmp server will show it to you, not the syslog message.

one_w_borg Wed, 08/19/2009 - 04:10
User Badges:

Thank you for your help on this. I was hoping there was an easier way. :-)

Actions

This Discussion