Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. And see here for current known issues.

Cannot collect traps

I created a simple test. Created a process without any triggers and added a ‘Correlate SNMP trap received’ activity. When the event criteria inside ‘Correlate SNMP trap received’ activity  is “OID=*”, ‘correlate snmp trap received’ activity collects all the traps that I sent using my trap generator. Quite the contrary, when I set the OID=1.3.6.1.6.3.1.1.5.3 and send using my trap generator the traps matching the same OID (1.3.6.1.6.3.1.1.5.3 - LinkDown), the ‘correlate snmp trap received’ activity does not collect any of the traps sent. I did check the SNMP adaptor log and it does show receiving the events with OID=1.3.6.1.6.3.1.1.5.3  - Why is it not collecting? Is this the behavior by design? If so, can you explain what event criteria match stands for? thanks

5 REPLIES
Cisco Employee

Cannot collect traps

You cannot use wildcards in the correlate SNMP traps activity as of 2.2. You have to give it the explicit info. If TEO is receiving it you just need to change the configuration of your activity. Check the help flyout for the activity when you use it and you can see additional info.

--Shaun Roberts shaurobe@cisco.com CIAC Adoption Pilot Engineering Lead

Cannot collect traps

I am using TEO 2.2.0.1409. Yes, TEO is receiving traps only when I set OID=*.

When I change the configuration of the activity to explicit OID (per the help flyout), TEO does not collect the traps.

Please tell me why TEO does not collect traps when OID is explicitly stated (example: 1.3.6.1.6.3.1.1.5.3) case?

Cisco Employee

Cannot collect traps

TEO collecting traps (and showing in logs) has nothing to do with the OID in an activity. Did you turn on debug level logs and submit them to your case that is open? The debug level should show events being generated into TEO.

Do you have a SNMP agent setup correctly in the targets area?

--Shaun Roberts shaurobe@cisco.com CIAC Adoption Pilot Engineering Lead
Cisco Employee

Re: Cannot collect traps

As a follow up to this, I got it to work fine in one of our support setups... couple things.

1) Make sure the SNMP listener service is running on the TEO box, you might need to restart TEO if you have to start the service(in fact I'd suggest starting the listener and then restart TEO)

2) If you run debug logs, you should be able to see the traps coming into your TEO box, the logs show something like this:

04/19 08:16:51:878[TrapListener.0]: (mem=135378456/356581376) HostMsg: Sending item event message.

04/19 08:16:53:472[MD-77]: (mem=134546152/356581376) HostMsg: Sending connection information [2112.02000020120419081653472en_US]

04/19 08:16:57:847[TrapListener.0]: (mem=122253816/356581376) TrapReceiveHandler: Incoming trap from 172.18.173.7 to local port 162

04/19 08:16:57:847[TrapListener.0]: (mem=122253816/356581376) TrapReceiveHandler: Incoming trap version: V2C and community string: public

04/19 08:16:57:847[TrapListener.0]: (mem=122253816/356581376) TrapReceiveHandler: Incoming trap OID :1.3.6.1.6.3.1.1.5.6

04/19 08:16:57:847[TrapListener.0]: (mem=122253816/356581376) TrapReceiveHandler: Trap source FQDN :IA-TAC-AUTO-TLS.GIATAC.LOCAL

04/19 08:16:57:847[TrapListener.0]: (mem=122253816/356581376) TrapReceiveHandler: Trap source from computer:IA-TAC-AUTO-TLS

04/19 08:16:57:847[TrapListener.0]: (mem=122253816/356581376) HostMsg: Sending item event message. 04/19 08:16:51:878[TrapListener.0]: (mem=135378456/356581376) HostMsg: Sending item event message.
04/19 08:16:53:472[MD-77]: (mem=134546152/356581376) HostMsg: Sending connection information [2112.02000020120419081653472en_US]
04/19 08:16:57:847[TrapListener.0]: (mem=122253816/356581376) TrapReceiveHandler: Incoming trap from 172.18.173.7 to local port 162
04/19 08:16:57:847[TrapListener.0]: (mem=122253816/356581376) TrapReceiveHandler: Incoming trap version: V2C and community string: public
04/19 08:16:57:847[TrapListener.0]: (mem=122253816/356581376) TrapReceiveHandler: Incoming trap OID :1.3.6.1.6.3.1.1.5.6
04/19 08:16:57:847[TrapListener.0]: (mem=122253816/356581376) TrapReceiveHandler: Trap source FQDN :IA-TAC-AUTO-TLS.GIATAC.LOCAL
04/19 08:16:57:847[TrapListener.0]: (mem=122253816/356581376) TrapReceiveHandler: Trap source from computer:IA-TAC-AUTO-TLS
04/19 08:16:57:847[TrapListener.0]: (mem=122253816/356581376) HostMsg: Sending item event message.

As you can see, it shows the IP from where it came as well as the OID. All I had to do was put that OID into my Correlate activity and I was able to pick up a handful of traps I generated. I used a little command line utility to make them, but it should not matter whether you use a utility or the real thing.

Lastly, make sure you have an Agent Device setup to monitor on and that you have it configured to read traps and that your community string is correct.

--Shaun Roberts shaurobe@cisco.com CIAC Adoption Pilot Engineering Lead

Cannot collect traps

Thanks again for the response Chris.

Yes to all your questions above. I see the log exactly as you see it...I do have the AgentDevice setup with the correct community string. Only, I am dealing with v1 traps in my setup.

The listener service is up and running (I see the java process in task mgr)...also, when I put OID=* (instead of 1.3.x.x.x.x), I can see the correlate activity collecting all the traps.

Will appreciate if you can call me for 5 mins Chris.Thanks.

460
Views
0
Helpful
5
Replies
CreatePlease login to create content