eBGP PEER FLAP SNMP TRAP

[Vinayaka Raman]

Hi


Whenever there is a bgp neighbour flap, we are not getting snmp traps on the HP NNMI Server.. I believe during the neighbour flap, the device is unable to communicate with NNMI and drop the trap..
So I would like to write a custom EEM SCRIPT that can match a syslog pattern and generate a customised SNMP trap and send it to NNMI. May be I can delay the trap generation or sending so that the device restores the connectivity and then send an alert

Here are my questions:


Is this a good idea?
Can you give me a sample configuration with the MIB Values to be generated?
What MIB Should be loaded on the server?

I am curious how others are monitoring this kind of bgp flaps...



Sent from Cisco Technical Support iPad App

[bjcox]

You could probably do this but you might look into SNMP informs... sounds like it would do what your looking for if your NMS supports it.

http://www.cisco.com/en/US/docs/ios/11_3/feature/guide/snmpinfm.html

[Joe Clarke]

Yeah, if you know traps are being generated, but they aren't making it to NNMI, chances are an EEM-generated trap won't help.  Informs are acknowledged SNMP notifications, so they will be resent until the NMS acknowledges receipt.

[Vinayaka Raman]

thanks..can you tell me how to enable SNMP informs for bgp ?

[Joe Clarke]

The document linked by Brice talks about how to configure informs.  It is very similar to traps.

[Vinayaka Raman]

After i enabled snmp inform using following command

snmp-server host 100.190.19.33 informs version 2c XXXX

I see it is contineously incrementing snmp inform sent messages on the router..I am not sure what it is sending..I would like to be specific like sending only BGP snmp informs to the NMS..is it possible ?

DR1#show snmp
Chassis: FHK0850F0HL
4338622 SNMP packets input
    0 Bad SNMP version errors
    746076 Unknown community name
    0 Illegal operation for community name supplied
    0 Encoding errors
    35020739 Number of requested variables
    0 Number of altered variables
    3303916 Get-request PDUs
    97632 Get-next PDUs
    0 Set-request PDUs
    0 Input queue packet drops (Maximum queue size 1000)
6639622 SNMP packets output
    0 Too big errors (Maximum packet size 1500)
    546341 No such name errors
    0 Bad values errors
    0 General errors
    3592535 Response PDUs
    3047076 Trap PDUs
SNMP Dispatcher:
   queue 0/75 (current/max), 0 dropped
SNMP Engine:
   queue 0/1000 (current/max), 0 dropped

SNMP logging: enabled
    Logging to 10.45.224.19.162, 0/10, 761350 sent, 347 dropped.
    Logging to 10.48.176.1.162, 0/10, 759955 sent, 1886 dropped.
    Logging to 100.190.19.25.162, 0/10, 761329 sent, 368 dropped.
    Logging to 100.190.19.33.162, 0/10, 761367 sent, 474 dropped.

SNMP Manager-role output packets
    0 Get-request PDUs
    0 Get-next PDUs
    0 Get-bulk PDUs
    0 Set-request PDUs
    11 Inform-request PDUs
    0 Timeouts
    0 Drops
SNMP Manager-role input packets
    0 Inform request PDUs
    0 Trap PDUs
    11 Response PDUs
    0 Responses with errors

SNMP informs: enabled
    Informs in flight 0/25 (current/max)
    Logging to 100.190.19.33.162
        11 sent, 0 in-flight, 0 retries, 0 failed, 0 dropped

[Joe Clarke]

Depending on your version of IOS, you can include keywords for specific notification types after the configuration line.  For example:

snmp-server host 100.190.19.33 informs version 2c XXX bgp snmp

[Vinayaka Raman]

Thank you.. Should i upload a different MIB for inform request on the NMS or the existing MIB for traps will do..?

[Joe Clarke]

The MIBs are the same for traps and informs.

[Vinayaka Raman]

The SNMP informs is not supported by the NMS..the tools team is still struggling with the vendor.

I would like to write an applet that would trigger BGP SNMP alerts. There is only one BGP neighbhor and whenever it sees this syslog pattern, it should generate a trap and forward it to NMS.

I also wanted to delay the generation or sending traps. This is because I wanted the router to wait until the bgp session is restored so that it can reach NMS.

What is the current OIDs to use in this program?

Should I upload event manager mib on the NMS ?

Kindly help me completing this

event manager applet BGP_NEIGHBOR_LOSS

event syslog pattern "%BGP-5-ADJCHANGE: neighbor 10.117.38.109 Down"

[Joe Clarke]

If you enable syslog traps, you would get this syslog sent as an SNMP trap anyway:

snmp-server enable traps syslog

If you want to go the EEM route, it could be as simple as:

action 1.0 snmp-trap strdata $_syslog_msg

This will send a trap using the CISCO-EMBEDDED-EVENT-MGR-MIB.  The particular trap will be the

cEventMgrPolicyEvent (1.3.6.1.4.1.9.10.91.0.2).

[Vinayaka Raman]

Strange..The device is sending the trap with OID: .1.3.6.1.4.1.9.10.91.0.2..

But the MIB file uploaded on the NMS (CISCO-EMBEDDED-EVENT-MGR-MIB) resulted in following OID:

.1.3.6.1.4.1.9.10.134.0.2    cEventMgrPolicyEvent

I tried the OID to MIB translation online. Both .1.3.6.1.4.1.9.10.134.0.2 and 1.3.6.1.4.1.9.10.91.0.2 leads to same MIB CISCO-EMBEDDED-EVENT-MGR-MIB

[Vinayaka Raman]

       this was the problem with NMS
It has .1.3.6.1.4.1.9.10.91.0.2.. listed in its blocked cache

[Joe Clarke]

There were two versions of this MIB published sadly.  The .134 OID is for the Nexus 7K.  You can't have both loaded.  If you will be sending traps from IOS devices, then load the MIB with the .91 OID.