How To Send a SNMP Trap Using EEM

[shrikant.Nadiminti1]

Hello All,

I have created EEM script to detect Dial-peer busy out status and If dial-peer goes to "busy out" status then send an SNMP trap to SNMP server.

But as per SNMP team, they are not receiving the trap. From debugs i can see applet is triggered and from router, trap is sent.

Is there any thing else i should be looking ? What kind of MIB should be enabled on the SNMP server to receive the traps..? as of now no MIB is installed on SNMP server.

Regards

Shrikant

[Dan Frey]

Verify that you have snmp-server host x.x.x.x configured in IOS with the proper community to send to the server.

[shrikant.Nadiminti1]

Hi Daniel,

snmp-server host command is configured correctly. I have verified through another gateway as well.

Any other suggestion ?

Shrikant

[Dan Frey]

Start a TCPdump session on the snmp-server and verify that the packet reaches the server.  

[shrikant.Nadiminti1]

NMS team able to see the trap. Previously they were looking for trap in wrong server :(. Thanks Daniel/Palani for your suggestion.

[Palani Mohan]

Hi Shrikant

 action 3.1  syslog msg "PPKLAB-D01-CUBE1 $_cli_result"
 action 3.2  snmp-trap strdata "dial-peer busyout PPKLAB-D01-CUBE1"

I see you have configured action to send a syslog message also. Are these being received ok?

I like Daniel's idea of capturing pkts on the snmp-server. Sometimes, it is possible that you may not have admin access to install Wireshark on the snmp-server. In such cases, add the snmp-server host to any PC you have admin access. Install Wireshark on this PC. The pkts can be captured on this PC and viewed. It is not uncommon for NMS servers to silently ignore a trap PDU when it does not know howto parse.

Another path to pursue is to inspect the show snmp CLI output. Towards the end, you will see trap/PDU count. See if it increments when the syslog message is logged.

I hope this helps ... Palani

[Palani Mohan]

Shrikant

Feb  8 20:48:43.315: SNMP: V1 Trap, ent cEventMgrMIB, addr 10.X.X.X, gentrap 6, spectrap 2
.
.
 ceemHistoryEventEntry.7.255101 = applet: CheckSIP-Trunk
.
.
 ceemHistoryEventEntry.11.255101 = dial-peer busyout PPKLAB-D01-CUBE1
.
.
Feb  8 20:48:43.343: SNMP: Queuing packet to 162.X.X.X
Feb  8 20:48:43.343: SNMP: V1 Trap, ent cEventMgrMIB, addr 10.X.X.X, gentrap 6, spectrap 2

This tells us clearly the SNMP agent handed over the pkt to the IP part within IOS. Usually, when this happens it is almost always the case of NMS server silently dropping the pkt. Go with the idea to capture the pkts, to help the server admins understand where the problem is.

Kind regards .... Palani

[shrikant.Nadiminti1]

Hi Mohan/Daniel,

Thanks for the response. I will ask SNMP team to take the packet capture. I was going through another CSC discussion, someone said event manger MIB needs to be loaded in NMS server. Is it true? As of now I haven't loaded MIB( event manager) into the NMS server.

Link :

https://supportforums.cisco.com/discussion/11654966/eem-applet-not-sending-snmp-traps

[Palani Mohan]

Hi Shrikant

The MIB has to be loaded for the varbinds to be parsed accurately. If not, it should still appear as UNDEFINED. It should not be dropped silently.

Sincerely ... Palani

[TheFox210]

Little bit of an old thread, but didn't see a resolution. However, in order for traps to be sent by the event manager the following has to be enabled in the snmp-server configuration on the device

snmp-server enable traps event-manager

"If the action snmp-trap command is used, the snmp-server enable traps event-manager command must be enabled to permit SNMP traps to be sent from the Cisco IOS device to the SNMP server. Other relevant snmp-server commands must also be configured; for details see the action snmp-trap command page."