SNMP Traps???

[David_Mitchell]

Hi All,

I am beginning to pull my hair out on this one, maybe I am asking Uncle Google the wrong questions.......

Situation is that I have joined a new company and they have WhatsUp Gold NMS setup to recieve ANY traps from Cisco devices, this means that they are getting SNMP Trap notifications for everything occurring on the network, most of which cannot easily be deciphered and is therefore meaningless.  On top of that it's flooding the database on the NMS server as you can imagine.

What I would like to do is stop the ANY trap listener for all devices and to configure specific traps for the NMS to listen for, such as link up/down, reload, fan failure etc.

I have read-up on this and I know how to achieve my goal within the WhatsUp Gold software but I don't know which traps to listen for exactly.  I have googled and googled for a best practice guide for traps to listen out for but I can't seem to find anything.  I just keep getting tutorials on how SNMP traps work!

Any help would be greately appreciated as I really want to get this in-place as soon as possible

Thanks in advance

David

[daniel.dib]

Welll, as always it depends. Which ones are you getting now that you feel should not be there?

These are some traps that could be useful to have enabled depending on your setup:

bgp

config

cpu

eigrp

envmon

fru-ctrl

hsrp

ipsla

memory

ospf

pim

snmp

The last one will enable linkup, linkdown, coldstart, warmstart and authentication.

I think these would be a good start, remove the ones for protocols that you don't use.

Daniel Dib
CCIE #37149

[David_Mitchell]

Hi Daniel and thanks for the quick reply.

I think I have mislead you with my initial post, apologies.

I was referring to WhatsUp Gold (WUG) being set up currently to receive ANY traps, and that I wanted to configure specific traps for it to listen out for.

My Cisco routers are set up to send traps for specific events like those that you have suggested (and a number we will never need which I will be removing at the end of this process).

The problem I am having is that I am receiving traps coming into WUG that I can't make sense of as the OID is none-descriptive and as it's coming in under the ANY trap listener the type of trap isn't defined anywhere leaving us with a trap but without deciphering the MIB tree it is showing in the payload we are non-the-wiser as to what event has occurred, only that an even has occurred and when.

Unfortunately I work in a sandbox network and can’t provide any screenshots or copy and paste output, but to give you an example, here’s what I see in my NMS reports and Main display:

SNMP TRAP REPORT LOG

Device = R1

Trap Type = Any

Payload = TrapName=cisco.0.1 TrapMajor=6 TrapMinor=1 local.6.1..........and so on for about a hundred or so more dotted decimal values (I am guessing this is the MIB tree)

I have set up a test device with the same configured traps but instead of listening for ANY traps in WUG NMS I have just set it to listen for ciscoConfigManEvent so that I can see when the configs has been copied (this was just an easy test) and the output is as follows:

SNMP TRAP REPORT LOG

Device = R1

Trap Type = ciscoConfigManEvent

Payload = TrapName=ciscoConfigManEvent……….

It’s not perfect but at least I can look up what ciscoConfigManEvent means and decipher the trap we are receiving from the device. In this case ciscoConfigManEvent = the configs has been copied

Like I said in my original post, perhaps I am going about this the wrong way. My main goal would be to see traps come in as they occur and be able to identify immediately what the trap is alerting me to i.e. what event just occurred, so I can react to it accordingly.

Any further help appreciated on this Daniel ••J