Process Trigger Vs Correlate SNMP trap received-need clarification

[Jamaluddin Mohamed]

-          In my example process I created today, I had the trigger enabled on the process matching for a specific trap OID (LinkDown in my case). Further this process was made to listen to a SNMP device agent (pointing to a trap generator running in another machine).

-          I then added ‘Correlate SNMP trap received’ activity after the process. I set the time as 1 min ‘after’ process start time. I set the event criteria within this activity to match LinkUp (1.3.6.1.6.3.1.1.5.4) OID.

My interpretation of the above wokflow is as follows, please correct if my understanding is wrong:

1.       When the process is run, it starts ‘Correlate SNMP trap received’ activity. However, the process is technically ‘not started’ since the triggering event was not received by the process yet. Since the process is not started yet, ‘Correlate SNMP trap received’ activity will not be collecting yet.

2.       When the LinkDown Event is sent to CPO, the trigger condition is met. Let’s say this happens at 10:00 AM. ‘Correlate SNMP trap received’ activity will now collect traps from 10:00 AM to 10:01 AM. ‘Correlate SNMP trap received’ activity will not collect the LinkDown Event as that was meant to act as a trigger for collection to begin.

3.       Between 10 AM to 10:01 AM, if I sent using my trap generator, ‘LinkUp’ event, then ‘Correlate SNMP trap received’ will collect that LinkUp trap and move to the next step in the workflow.

4.       Between 10 AM to 10:01 AM, if I sent using my trap generator, any event other than ‘LinkUp’ event, then ‘Correlate SNMP trap received’ will not collect any event and move to the next step in the workflow.

tt

thanks,

jamal

[Shaun Roberts]

Yes, that sounds fairly correct.

If TEO recieves an event that it is monitoring for (in your case SNMP trap) and it matches the criteria on your trigger, it will trigger your process.

For the correleate activities that you have set to 1 minute after process start, it will wait for that 1 minute time and the move onto the next step regardless if it got anything or not.

If you need further help, perhaps explain the use-case more in detail. I am not a SNMP person by any means, but what you are saying from a content setup perspective sounds correct.

[Jamaluddin Mohamed]

Thanks for the very prompt response Chris.

The use case I am trying is as follows:

1. Generic LinkDown trap if received, start listening for a LinkUp trap (think of LinkUp trap as a trap that's clearing the LinkDown event).

2. In that 1 minute interval, if a LinkUp trap does show up then end the process (meaning STOP).

3. In that 1 minute interval, if a LinkUp trap does *not* show up, then send an alert email (stating that LinkDown is still DOWN and is not cleared yet) and STOP.

I did create a workflow based on my above understanding for this use case. However, TEO seems to fail when attempting to filter on specific OIDs (LinkDown and LinkUp). In other words, when I set OID=, TEO fails to receive those traps and process them. I have turned ON debug log and see SNMP trap with specific OID number being received (as seen in the SNMP adaptor log).

I have a SR#621435891 against this. If you want, you can call me at 408 221 0824 and I can demonstrate where it fails.

thanks in advance,

Jamal

[Shaun Roberts]

I think your general setup is ok. Check my other thread for my testing of that activity. It works fine for me when I input the right OID and see that TEO is receiving it.