2811 SNMP traps

[harwoodk1]

Hello, i have a 2811 running Version 12.4(13r)T and it is configured to send SNMP traps, and this works fine.

snmp-server community xxxxxxxx RO

snmp-server queue-length 100

snmp-server enable traps snmp authentication coldstart warmstart

snmp-server enable traps sctp dest-address

snmp-server enable traps flash insertion removal

snmp-server enable traps envmon fan shutdown supply temperature status

snmp-server enable traps cs7 gw-linkset-state

snmp-server enable traps cs7 xua-state

snmp-server host xx.xxx.xxx.xxx version 2c xxxxxxxx

What i want to do is to control the traps so that if the event happens and then clears the trap is NOT sent. This is mainly for the "xua-state" alarms where the link drops for less than 3 seconds for example.

Any help would be great...

Kevin

[Martin Ermel]

you cannot configure a device to do delay the sending of traps or bring some logic into this process. You just can enable or disable SNMP traps.

But there are other possibilities to achive what you want with Embedded Event Manager [EEM]

Generally I could imagine 2 ways:

    disable the (xua-) trap

1) if you get syslog messages on the down event you' ll need to catch them and wait for a specific time if the up message comes also, if not send out a custom trap (or syslog message)

2) if you do not get a syslog message on the down event, you must configure a tracked object that monitors the state of the link. If in a given time period there is only a down event then fire

on CSC you can find more information about EEM and also find some applets:

https://supportforums.cisco.com/community/netpro/network-infrastructure/eem

https://supportforums.cisco.com/docs/DOC-11745

the other option is to bring the logic into the trap receiver (if possible)

[harwoodk1]

Thanks Martin, i was kind of expecting that the logic would have to go in the NMS side of things.

Kevin

[Martin Ermel]

you only mention the sending of traps so I assumed it to happen on the device side.

What you need is some kind of correlation engine and this depends on the managment software you are using. Neiter PI nor LMS do have a correlation engine but if you could use syslogs instead of traps and you are on LMS then there is the posibility to do some scripting with automatic actions. If you are using other NMS software like Solarwinds NPM it is possible with the "Advanced Alerts" feature.

Someone told me - in the long run - PI should get some basic correlation as well.