EEM applet not sending snmp traps

[trapasso]

   Hello,

I have been trying to figure out an issue I am having with the following applet:

event manager applet HIGH_UTILIZATION

  event interface name GigabitEthernet2/0/5 parameter transmit_rate_bps entry-op gt entry-val 100000000 entry-type value poll-interval 1

  event tag recv_rate interface name GigabitEthernet2/0/5 parameter receive_rate_bps entry-op gt entry-val 100000000 entry-type value poll-interval 1

trigger

  correlate event trans_rate or event recv_rate

action 1.0 snmp-trap strdata "$_interface_name link utlization: $_interface_value / $_interface_parameter"

Basically I want a trap send if an interface, in this applet example interfact Gig 2/0/5, if either the transimt or receive rate reaches 10%, this is for test only.  Using the show event manager history events and traps command, the applet is being triggered but the traps are not being sent to our snmp server.  I do have the snmp-server enable traps event-manager command in the config, and all other traps are appearing on my snmp server except EEM.

I am seeing this same issue with different applets using the action snmp-trap command

Below is the information about the switch that may help.

C3750E Boot Loader (C3750X-HBOOT-M) Version 12.2(53r)SE2

flash:/c3750e-ipbasek9-mz.122-58.SE2.bin

Embedded Event Manager Version 3.20

Here are some show command examples:

switch1#show event manager history traps
No.  Time                      Trap Type           Name
1    Thu Nov 8  11:45:02 2012  policy              applet: HIGH_UTILIZATION

switch1#show event manager history events
No.  Job Id Proc Status   Time of Event            Event Type         Name
1    296    Actv success  Thu Nov 8 11:45:02 2012  interface          applet: HIGH_UTILIZATION

thanks

[Joe Clarke]

Enable "debug snmp packet" then have your applet trigger.  Post the output of the debug.  Also, post your entire SNMP configuration.

[trapasso]

I attached the snmp config and the debug file, obvious I had to sanitize the output a little bit.  All other snmp traps are being sent to the 2 different monitoring servers.  The trap sent by the EEM is not being seen.  I just confirmed that the CISCO-EMBEDDED-EVENT-MGR-MIB.my MIB is loaded, but still I do not see any of the events.

Also before I was not seening the snmp debug output, so I erased the config on the 3750 switch and rebuilt the config, now I am getting snmp debug output.

[Joe Clarke]

According to this, EEM traps are going out.  You should confirm with a sniffer that they are making it to the NMS.  It could also be that you loaded the wrong version of the CISCO-EMBEDDED-EVENT-MGR-MIB (and your NMS is dropping unknown traps).  Post the version of the MIB you loaded.

[trapasso]

I did confirm with a packet capture that the traps are getting to the network the NMS resides on.  I was sure they were getting there because all the other traps are showing on the NMS console.  But always good to see what is there.

I need to work with the analyst who is responsible for the NMS to get the packet capture on the interface, and to confirm the version number of the MIB.

Get back to you when I have more info

[trapasso]

Here is the latest. 

The packet capture on the NMS does not show the event manger snmp packets, just the system up snmp packets.  I know the packets are getting to the network, the server is not seeing them

The version 2 of the CISCO-EMBEDDED-EVENT-MGR-MIB file was loaded,

http://tools.cisco.com/Support/SNMP/do/BrowseMIB.do?local=en&step=2&submitClicked=true&mibName=CISCO-EMBEDDED-EVENT-MGR-MIB#dependencies.

[Joe Clarke]

This is the wrong version of the MIB.  You have the MIB for NX-OS devices.  Attached is the version for IOS.  This is a bug.  There should only be one version of the MIB.

As for why your NMS isn't seeing the packets at all, I think you will need to look at your network.  Maybe there is some kind of content filter that is dropping those EEM traps.

[trapasso]

Will give the new MIB a try and let you know.

I thought the same thing about something filtering the packets, but don't know that network well.  Will try to find out where things are being filtered

thanks

[trapasso]

An update to this issue. 

On a standalone test NMS server I loaded the MIB that Joseph posted, pointed the test switch gear to the test NMS server.  Started generating traffic to trigger the EEM applet.  same thing happened, no alerts on the NMS system.  Used wireshark to grab packets and I can see the snmp packets.  dug deeper into the NMS system and found the alerts as unsolicited traps.  Created definitions in the NMS for the EEM traps.  triggered the EEM applet again and I now have alerts in the alert screen. 

Now I just have to do the same thing with the actual NMS system we are using here.  hopefully it is a easy as my test NMS system.

Thanks for the help