Cannot collect traps

[Jamaluddin Mohamed]

I created a simple test. Created a process without any triggers and added a ‘Correlate SNMP trap received’ activity. When the event criteria inside ‘Correlate SNMP trap received’ activity  is “OID=*”, ‘correlate snmp trap received’ activity collects all the traps that I sent using my trap generator. Quite the contrary, when I set the OID=1.3.6.1.6.3.1.1.5.3 and send using my trap generator the traps matching the same OID (1.3.6.1.6.3.1.1.5.3 - LinkDown), the ‘correlate snmp trap received’ activity does not collect any of the traps sent. I did check the SNMP adaptor log and it does show receiving the events with OID=1.3.6.1.6.3.1.1.5.3  - Why is it not collecting? Is this the behavior by design? If so, can you explain what event criteria match stands for? thanks

[Shaun Roberts]

You cannot use wildcards in the correlate SNMP traps activity as of 2.2. You have to give it the explicit info. If TEO is receiving it you just need to change the configuration of your activity. Check the help flyout for the activity when you use it and you can see additional info.

[Jamaluddin Mohamed]

I am using TEO 2.2.0.1409. Yes, TEO is receiving traps only when I set OID=*.

When I change the configuration of the activity to explicit OID (per the help flyout), TEO does not collect the traps.

Please tell me why TEO does not collect traps when OID is explicitly stated (example: 1.3.6.1.6.3.1.1.5.3) case?

[Shaun Roberts]

TEO collecting traps (and showing in logs) has nothing to do with the OID in an activity. Did you turn on debug level logs and submit them to your case that is open? The debug level should show events being generated into TEO.

Do you have a SNMP agent setup correctly in the targets area?

[Shaun Roberts]

As a follow up to this, I got it to work fine in one of our support setups... couple things.

1) Make sure the SNMP listener service is running on the TEO box, you might need to restart TEO if you have to start the service(in fact I'd suggest starting the listener and then restart TEO)

2) If you run debug logs, you should be able to see the traps coming into your TEO box, the logs show something like this:

04/19 08:16:51:878[TrapListener.0]: (mem=135378456/356581376) HostMsg: Sending item event message.

04/19 08:16:53:472[MD-77]: (mem=134546152/356581376) HostMsg: Sending connection information [2112.02000020120419081653472en_US]

04/19 08:16:57:847[TrapListener.0]: (mem=122253816/356581376) TrapReceiveHandler: Incoming trap from 172.18.173.7 to local port 162

04/19 08:16:57:847[TrapListener.0]: (mem=122253816/356581376) TrapReceiveHandler: Incoming trap version: V2C and community string: public

04/19 08:16:57:847[TrapListener.0]: (mem=122253816/356581376) TrapReceiveHandler: Incoming trap OID :1.3.6.1.6.3.1.1.5.6

04/19 08:16:57:847[TrapListener.0]: (mem=122253816/356581376) TrapReceiveHandler: Trap source FQDN :IA-TAC-AUTO-TLS.GIATAC.LOCAL

04/19 08:16:57:847[TrapListener.0]: (mem=122253816/356581376) TrapReceiveHandler: Trap source from computer:IA-TAC-AUTO-TLS

04/19 08:16:57:847[TrapListener.0]: (mem=122253816/356581376) HostMsg: Sending item event message. 04/19 08:16:51:878[TrapListener.0]: (mem=135378456/356581376) HostMsg: Sending item event message.
04/19 08:16:53:472[MD-77]: (mem=134546152/356581376) HostMsg: Sending connection information [2112.02000020120419081653472en_US]
04/19 08:16:57:847[TrapListener.0]: (mem=122253816/356581376) TrapReceiveHandler: Incoming trap from 172.18.173.7 to local port 162
04/19 08:16:57:847[TrapListener.0]: (mem=122253816/356581376) TrapReceiveHandler: Incoming trap version: V2C and community string: public
04/19 08:16:57:847[TrapListener.0]: (mem=122253816/356581376) TrapReceiveHandler: Incoming trap OID :1.3.6.1.6.3.1.1.5.6
04/19 08:16:57:847[TrapListener.0]: (mem=122253816/356581376) TrapReceiveHandler: Trap source FQDN :IA-TAC-AUTO-TLS.GIATAC.LOCAL
04/19 08:16:57:847[TrapListener.0]: (mem=122253816/356581376) TrapReceiveHandler: Trap source from computer:IA-TAC-AUTO-TLS
04/19 08:16:57:847[TrapListener.0]: (mem=122253816/356581376) HostMsg: Sending item event message.

As you can see, it shows the IP from where it came as well as the OID. All I had to do was put that OID into my Correlate activity and I was able to pick up a handful of traps I generated. I used a little command line utility to make them, but it should not matter whether you use a utility or the real thing.

Lastly, make sure you have an Agent Device setup to monitor on and that you have it configured to read traps and that your community string is correct.

[Jamaluddin Mohamed]

Thanks again for the response Chris.

Yes to all your questions above. I see the log exactly as you see it...I do have the AgentDevice setup with the correct community string. Only, I am dealing with v1 traps in my setup.

The listener service is up and running (I see the java process in task mgr)...also, when I put OID=* (instead of 1.3.x.x.x.x), I can see the correlate activity collecting all the traps.

Will appreciate if you can call me for 5 mins Chris.Thanks.