I have been trying to figure out an issue I am having with the following applet:
event manager applet HIGH_UTILIZATION
event interface name GigabitEthernet2/0/5 parameter transmit_rate_bps entry-op gt entry-val 100000000 entry-type value poll-interval 1
event tag recv_rate interface name GigabitEthernet2/0/5 parameter receive_rate_bps entry-op gt entry-val 100000000 entry-type value poll-interval 1
correlate event trans_rate or event recv_rate
action 1.0 snmp-trap strdata "$_interface_name link utlization: $_interface_value / $_interface_parameter"
Basically I want a trap send if an interface, in this applet example interfact Gig 2/0/5, if either the transimt or receive rate reaches 10%, this is for test only. Using the show event manager history events and traps command, the applet is being triggered but the traps are not being sent to our snmp server. I do have the snmp-server enable traps event-manager command in the config, and all other traps are appearing on my snmp server except EEM.
I am seeing this same issue with different applets using the action snmp-trap command
Below is the information about the switch that may help.
C3750E Boot Loader (C3750X-HBOOT-M) Version 12.2(53r)SE2
Embedded Event Manager Version 3.20
Here are some show command examples:
switch1#show event manager history traps
No. Time Trap Type Name
1 Thu Nov 8 11:45:02 2012 policy applet: HIGH_UTILIZATION
switch1#show event manager history events
No. Job Id Proc Status Time of Event Event Type Name
1 296 Actv success Thu Nov 8 11:45:02 2012 interface applet: HIGH_UTILIZATION
Enable "debug snmp packet" then have your applet trigger. Post the output of the debug. Also, post your entire SNMP configuration.
I attached the snmp config and the debug file, obvious I had to sanitize the output a little bit. All other snmp traps are being sent to the 2 different monitoring servers. The trap sent by the EEM is not being seen. I just confirmed that the CISCO-EMBEDDED-EVENT-MGR-MIB.my MIB is loaded, but still I do not see any of the events.
Also before I was not seening the snmp debug output, so I erased the config on the 3750 switch and rebuilt the config, now I am getting snmp debug output.
According to this, EEM traps are going out. You should confirm with a sniffer that they are making it to the NMS. It could also be that you loaded the wrong version of the CISCO-EMBEDDED-EVENT-MGR-MIB (and your NMS is dropping unknown traps). Post the version of the MIB you loaded.
I did confirm with a packet capture that the traps are getting to the network the NMS resides on. I was sure they were getting there because all the other traps are showing on the NMS console. But always good to see what is there.
I need to work with the analyst who is responsible for the NMS to get the packet capture on the interface, and to confirm the version number of the MIB.
Get back to you when I have more info
Here is the latest.
The packet capture on the NMS does not show the event manger snmp packets, just the system up snmp packets. I know the packets are getting to the network, the server is not seeing them
The version 2 of the CISCO-EMBEDDED-EVENT-MGR-MIB file was loaded,
This is the wrong version of the MIB. You have the MIB for NX-OS devices. Attached is the version for IOS. This is a bug. There should only be one version of the MIB.
As for why your NMS isn't seeing the packets at all, I think you will need to look at your network. Maybe there is some kind of content filter that is dropping those EEM traps.
Will give the new MIB a try and let you know.
I thought the same thing about something filtering the packets, but don't know that network well. Will try to find out where things are being filtered
An update to this issue.
On a standalone test NMS server I loaded the MIB that Joseph posted, pointed the test switch gear to the test NMS server. Started generating traffic to trigger the EEM applet. same thing happened, no alerts on the NMS system. Used wireshark to grab packets and I can see the snmp packets. dug deeper into the NMS system and found the alerts as unsolicited traps. Created definitions in the NMS for the EEM traps. triggered the EEM applet again and I now have alerts in the alert screen.
Now I just have to do the same thing with the actual NMS system we are using here. hopefully it is a easy as my test NMS system.
Thanks for the help