ACS snmp, Orion shows it rebooting

[tahscolony]

I added our ACS servers to Orion NPM yesterday, and so far have had three alerts of the servers rebooting, yet we all know they didn't. It looks like a possible SNMP bug.

snmpTrapEnterprise=NET-SNMP-TC:linux
snmpTrapOID=SNMPv2-MIB:coldStart
sysUpTime=0.05 second

snmpTrapEnterprise=NET-SNMP-TC:linux
ifOperStatus.3=down(2)
ifAdminStatus.3=down(2)
ifIndex.3=3
snmpTrapOID=IF-MIB:linkDown
sysUpTime=0.06 second

snmpTrapEnterprise=NET-SNMP-TC:linux
ifOperStatus.2=up(1)
ifAdminStatus.2=up(1)
ifIndex.2=2
snmpTrapOID=IF-MIB:linkUp
sysUpTime=0.06 second

snmpTrapEnterprise=NET-SNMP-TC:linux
ifOperStatus.1=up(1)
ifAdminStatus.1=up(1)
ifIndex.1=1
snmpTrapOID=IF-MIB:linkUp
sysUpTime=0.06 second

It also reported all volumes missing.

[Nadav]

Hi,

Which version of ACS and which platform is it installed on? 

[tahscolony]

5.6.0.22.3 on VM.

[Nadav]

I didn't see anything in the release notes from version 5.6.0.22.3 until 5.8. Could be a bug although I'd imagine it would appear as a known caveat. 

I did see incorrect behavior being monitored when I installed the ACS 5.8 VM using incorrect settings for SCSI and network card. Correcting the settings and reimaging fixed those issues.

1) Run "show uptime" via CLI to confirm that the coldstart trap is a false.  

2) Can you check that you have installed the software according to this document: 

http://www.cisco.com/c/en/us/td/docs/net_mgmt/cisco_secure_access_control_system/5-6/installation/guide/csacs_book/csacs_vmware.html

3) This could be an Orion issue. Can you put a network sniffer in place and see that the traps (including variable bindings) in Orion correspond with the actual network traffic? I doubt it's a MIB issue since there isn't a dedicated MIB for ACS, but if there are discrepencies between what appears in Orion and what you can see on your network sniffer, that would be a good start for a case.

4) You should extract the traps from the local stores and open a case if all else fails.