cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
1007
Views
0
Helpful
1
Replies

Unknown traps from EEM - parsing in Spectrum

bnpjpoutre
Level 1
Level 1

I have a Cat6509 device sending EEM traps to our CA Spectrum monitoring system.

I've downloaded, compiled, and loaded the EEM MIB from Cisco, but some of the traps coming in aren't being parsed, as their OIDs don't map to the EEM MIB.

This is the "Unknown trap" that Spectrum sees:

Unknown alert received from device uwb485as0101.us.net.intra of type SwCiscoIOS. Device Time 288+16:21:43. (Trap type 1.3.6.1.4.1.9.10.91.6.2)

Trap var bind data:

OID:  1.3.6.1.4.1.9.10.91.1.2.3.1.2.397  Value:  71

OID:  1.3.6.1.4.1.9.10.91.1.2.3.1.3.397  Value:  0

OID:  1.3.6.1.4.1.9.10.91.1.2.3.1.4.397  Value:  0

OID:  1.3.6.1.4.1.9.10.91.1.2.3.1.5.397  Value:  0

OID:  1.3.6.1.4.1.9.10.91.1.2.3.1.7.397  Value:  EEM Policy Director

OID:  1.3.6.1.4.1.9.10.91.1.2.3.1.11.397  Value:  Output packet Drops on GigabitEthernet2/21 are incrementing by more than 10

(The text in the last line is just for testing, and isn't necessarily the actual message.)

The EEM MIB only goes up to 1.3.6.1.4.1.9.10.91.3, so Spectrum isn't handling this trap as we would like.

Thank you for any guidance you can provide.

Joe

1 Reply 1

Joe Clarke
Cisco Employee
Cisco Employee

This looks like a potential problem with your NMS.  It looks like maybe it's building the trap OID incorrectly.  The 6.2 looks like the generic trap number and specific trap number (i.e. cEventMgrPolicyEvent).  Post a sniffer trace of the raw trap to confirm if the device is sending the wrong trap.