Problems understanding SNMP OIDs/Traps

[schlingloff]

Dear Community,

i would be very glad if you could help me with this thopic...i seem to have some trouble understanding it...

Here an example:

2010-01-18 06:28:44    Unknown alert received from device ber-be-swt01.is24-rz.de of type SwCiscoIOS. Device Time 82+21:21:53. (Trap type 1.3.6.1.4.1.9.9.43.2.0.1.6.0)\nTrap var bind data: \nOID:  1.3.6.1.4.1.9.9.43.1.1.6.1.3.738  Value:  1\nOID:  1.3.6.1.4.1.9.9.43.1.1.6.1.4.738  Value:  4\nOID:  1.3.6.1.4.1.9.9.43.1.1.6.1.5.738  Value:  2\nOID:  1.3.6.1.6.3.18.1.3.0  Value:  10.3.32.2

Ok. Let's take the trap type:

1.3.6.1.4.1.9.9.43.2.0.1.6.0

Searching with SNMP Object Navigator (http://tools.cisco.com/Support/SNMP/do/BrowseOID.do?local=en) i only get as far as:

1.3.6.1.4.1.9.9.43.2.0.1   -> ...6.0 is unkown.

If i search for the OID

1.3.6.1.4.1.9.9.43.1.1.6.1.3.738 for example

i get the following:

1.3.6.1.4.1.9.9.43.1.1.6.1.3  -> ...738 is unknown.

This happens with a lot of OIDs for me (not just these ones). If i understand the OID correctly, this could be a command from the command line which forced this trap.

So what's the .738 for? Why couldn't it be recognised by the search-function?

In advance i like to thank you for any feedback.

Sven Schlingloff

[Joe Clarke]

Try using my search and translate tool at http://jaguar.ir.miami.edu/~marcus/snmptrans.html .  If you do, you will see that 1.3.6.1.4.1.9.9.43.2.0.1.6.0 translates to ciscoConfigManEvent.  The OID 1.3.6.1.4.1.9.9.43.1.1.6.1.3.738 translates to ccmHistoryEventCommandSource.  However, ccmHistoryEventCommandSource'd OID is 1.3.6.1.4.1.9.9.43.1.1.6.1.3.  The .738 is the specific instance.  The definition of ccmHistoryEventCommandSource is:

"The source of the command that instigated the event."

This object comes from the ccmHistoryEventTable which is indexed by the ccmHistoryEventIndex object.  The definition of that object is:

"A monotonically increasing integer for the sole
purpose of indexing events.  When it reaches the 
maximum value, an extremely unlikely event, the agent 
wraps the value back to 1 and may flush existing 
entries."

So, the 738 is simply a unique number which identifies this particular history event.