snmp traps for switch generate up/down messages

[sebastianvandijk]

I have this configuration on a Cisco 2960 switch :

logging buffered warnings

logging monitor notifications

logging trap warnings

logging facility local6

logging 192.168.120.222

snmp-server community snmp_community RO

snmp-server enable traps snmp authentication coldstart warmstart

snmp-server enable traps tty

snmp-server enable traps cluster

snmp-server enable traps entity

snmp-server enable traps cpu threshold

snmp-server enable traps vtp

snmp-server enable traps vlancreate

snmp-server enable traps vlandelete

snmp-server enable traps flash insertion removal

snmp-server enable traps port-security

snmp-server enable traps envmon

snmp-server enable traps mac-notification

snmp-server enable traps copy-config

snmp-server enable traps config

snmp-server enable traps bridge newroot topologychange

snmp-server enable traps stpx inconsistency root-inconsistency loop-inconsistenc

We have a syslog server configured at 192.168.120.222.

We don't want to receive interface up/down notifications.

However when an interface goes up or down we still receive that notification despite removing the configuration :

snmp-server enable traps snmp linkdown

snmp-server enable traps snmp linkup.

What configuration is causing these messages to be syslogged ?

regards,

Sebastian

[bbo · Accepted solution]

just configure (on a per-interface-basis)

no snmp trap link-status

resp. no logging event link-status

do not confuse between snmp and syslog - they are different protocols with (possibly) different servers

[sebastianvandijk]

What is the difference between "no snmp trap linkstatus" and "no snmp-server enable traps snmp linkup linkdown" ?

They're both snmp traps ?

[mullzkBern_2 · Accepted solution]

the difference lies between SNMP and Syslog

"no snmp-server enable traps snmp linkup linkdown" disables the sending of SNMP-Traps to your SNMP-Server. However, you don't have any SNMP-Server configured (would be the command "snmp-server host [ip] [community]"), you only have configured a Syslog-Server, sending him Syslog-Messages with Severity warning and higher. Link-Status-Messages have - as I recall - severity 3.

Unless you do not want to set the syslog-severity higher, you should - as bbo described - configure all interfaces with "no logging event link-status".

The difference between the two snmp-traps-link-status-command is the scope: "snmp-server enable traps snmp linkup linkdown" is a global command, which can be overridden by "no snmp trap linkstatus" on each interface. The opposite (no .. in global, snmp trap link-status on interface) is default and results in no SNMP-Link-Status-Traps (but no still Syslog-Messages in your configuration).

[Joe Clarke · Accepted solution]

If it's syslog messages you don't want to see, you will have to do:

no logging event link-status

Under each interface that should not trigger and up/down message.

[sebastianvandijk]

Thanks all,

I think i have to dig in a bit more into snmp versus syslog :)

But for now i've added 2 rules per interface :

no logging event link-status

no snmp trap link-status

gr

Sebastian