SNMP trap messages

[jeanSamarani_2]

Dear Support,

We are getting a huge amount of messages  on our Monitoring system from our 3750 switch. Can you please advise what's wrong?

Tue  Dec 07 09:20:00 Got 271 byte SNMP Trap from:  10.160.124.166

Tue  Dec 07 09:20:01 Got 273 byte SNMP Trap from:  10.160.124.166

Tue  Dec 07 09:20:04 Got 273 byte SNMP Trap from:  10.160.124.166

Tue  Dec 07 09:20:06 Got 273 byte SNMP Trap from:  10.160.124.166

Tue  Dec 07 09:20:17 Got 273 byte SNMP Trap from:  10.160.124.166

Tue  Dec 07 09:20:17 Got 271 byte SNMP Trap from:  10.160.124.166

Tue  Dec 07 09:20:18 Got 273 byte SNMP Trap from:  10.160.124.166

Tue  Dec 07 09:20:20 Got 273 byte SNMP Trap from:  10.160.124.166

Tue  Dec 07 09:20:28 Got 273 byte SNMP Trap from:  10.160.124.166

Tue  Dec 07 09:20:28 Got 271 byte SNMP Trap from:  10.160.124.166

Tue  Dec 07 09:20:30 Got 273 byte SNMP Trap from:  10.160.124.166

Tue  Dec 07 09:20:31 Got 273 byte SNMP Trap from:  10.160.124.166

thanks

[Brahadesh Srinivasaraghavan · Accepted solution]

Can you post the details/ contents of this trap?

[jeanSamarani_2]

How can I do that ? Could you pls advise?

thanks a lot !

[Brahadesh Srinivasaraghavan]

Your monitoring system should also tell you what the contents of the traps are.

If you cant then

1) get a wireshark capture

2) enable "debug snmp packets" only for a short while and get the contents of the trap

Thanks,

Brahadesh

[jeanSamarani_2]

Below the OID. Hope this clarify the content of the trap. Any idea what could be the problem?

Wed  Dec 08 08:45:28 event type:.1.3.6.1.4.1.9.9.41.2.0.1,oid  length:12,specificType:1

clogMessageGenerated

1.3.6.1.4.1.9.9.41.2.0.1

Appreciate your help guys !

Jean

[Brahadesh Srinivasaraghavan]

Wed Dec 08 08:45:28 event type:.1.3.6.1.4.1.9.9.41.2.0.1,oid length:12,specificType:1

The above OID translates to clogMessageGenerated meaning for which is

When a syslog message is generated by the device a clogMessageGenerated notification is sent. The sending of these notifications can be enabled/disabled

via the clogNotificationsEnabled object."

http://tools.cisco.com/Support/SNMP/do/BrowseOID.do?objectInput=1.3.6.1.4.1.9.9.41.2.0.1&translate=Translate&submitValue=SUBMIT

Like the above description says you can disable by setting the value for clogNotificationsEnabled as false.

http://tools.cisco.com/Support/SNMP/do/BrowseOID.do?objectInput=.1.3.6.1.4.1.9.9.41.1.1.2+&translate=Translate&submitValue=SUBMIT&submitClicked=true

Thanks,

Brahadesh

[jeanSamarani_2]

Thanks Brahadesh for your prompt response.

How can i disable sending these notifications ? Is it something that could be done from the switch?

what are the commands?

Thank you again for your help.

[Brahadesh Srinivasaraghavan]

This has to be done thorugh SNMP

If you have a tool called Net-SNMP, open source, google it. Download and install it. Use the following syntax from the command prompt

snmpset -v 2c -c 1.3.6.1.4.1.9.9.41.1.1.2 i 2

Thanks,

Brahadesh

[jeanSamarani_2]

OK will do. I assume once done this will disable the switch from sending these notifications.

Thanks again from you support. I will let you know if I face any issues.

[yjdabear]

That usually means your 3750 has "snmp-server traps syslog" configured, so every "logging history" entry is being sent as a trap to your SNMP server.

To stop the flood, simply configure "no snmp-server traps syslog" on the device.

[Brahadesh Srinivasaraghavan]

Agree. That would do the trick too

Thanks,

Brahadesh