How to get IfName in Rmon traps ?

[Amadeous31]

Hi,

I'm currently deploying a Nagios monitoring solution on my network. So what i'm trying to do is getting an alarm when there is a lot of traffic or errors packets on a IF, i get it like that in my snmptrapd :

2011-05-12 10:58:21 <UNKNOWN> [UDP: [10.54.43.60]:62404]:
DISMAN-EVENT-MIB::sysUpTimeInstance = Timeticks: (23989811) 2 days, 18:38:18.11    SNMPv2-MIB::snmpTrapOID.0 = OID: RMON-MIB::risingAlarm    RMON-MIB::alarmIndex.10 = INTEGER: 10    RMON-MIB::alarmVariable.10 = OID: IF-MIB::ifInOctets.10124    RMON-MIB::alarmSampleType.10 = INTEGER: absoluteValue(1)    RMON-MIB::alarmValue.10 = INTEGER: 421353501    RMON-MIB::alarmRisingThreshold.10 = INTEGER: 9000

Of course, don't look at the values, it's just a test trap, but in fact i get the name of the interface only here => IF-MIB::ifInOctets.10124 

But it's not clearly explain which interface it is.

Can I get the IfName with a script, or with an other command or something like that ?

Thank you

[Roman Rodichev]

You need ifIndex.

If you don't already have at least one SNMP command configured on the device, configure something, it will start the SNMP engine

Then issue:

show snmp mib ifmib ifindex

it will show you indexes for the interfaces. You can then use ifInOctests.INDEX

You also want to makes sure that persistent index feature is enabled so that indexes don't change after reboot:

snmp-server ifindex persist

[Amadeous31]

Hi,

Of course, i already did that, but in fact i get the answer "IF-MIB::ifInOctets.10124" from the trap, but i want to get for example "Gi1/0/24" in my trap,

here is my rmon config on my 3750G :

rmon event 1 log trap public description "high ifInOctets" owner david

rmon alarm 10 ifInOctets.10124 60 absolute rising-threashold 9000 1 falling-threshold 8500 1 owner david

So, these 2 lines works great, but in Centreon, or after SNMPTT i didn't see the name of the interface, i only see "IF-MIB::ifInOctets.10124"

I don't know if it's possible, but it's really freaky to see "ifInOctets.10124" because we don't really know which IF it is