How to Test SNMP Traps are Working in CUCM?

[Matthew Martin]

Hello All,

I just went through the process on CUCM Serviceability page to configure a SNMP Trap destination. When I configured it I applied it to all Nodes, created a community string ("cucmtrap!") and restarted the 2 services required to apply the configuration.

In RTMT >> Alert Central, I cleared an existing Alert that was thrown for "AuthenticationFailed" and then I attempted to login to CUCM a few times with the wrong User-ID and Password. Went back to RTMT and saw the Alert was thrown again. Should there have been a trap that was sent to my destination when this alert was thrown..? I actually am doing this to get the MediaResources Alerts sent to my destination as traps, but I thought the AuthFailed one would be a good test because it's easy to throw that Alert manually...

But, on my linux box that I setup to receive the traps, I did not see anything show up in the snmptrapd.log file. The command I ran on my linux box to start snmptrapd is:

      # ps -ef | grep snmptrapd
      root  30002  1  0  17:56  ?  00:00:00  snmptrapd -A -d -n -c /etc/snmp/snmptrapd.conf -Lf /var/log/snmptraps.log

      # cat /etc/snmp/snmptrapd.conf
      authCommunity log,execute,net cucmtrap!

So I believe I have this configured correctly in Linux, maybe someone who has done this before can tell me if it is or not. And also, if someone could tell me how I can verify I have everything is configured correctly in CUCM, that would be great..!

However, any thoughts or suggestions would be greatly appreciated!

Thanks in Advance,
Matt

[Terry Cheema]

I dont think the authentication failed alarms are sent as SNMP traps. To test the SNMP refer to below section:

Review this Setting up and testing SNMP traps:

http://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cucm/service/10_0_1/admin/CUCM_BK_CDDBCDEB_00_cisco-unified-servicability-merge-100/CUCM_BK_CDDBCDEB_00_cisco-unified-servicability-merge-100_chapter_0111.html#CUCM_TK_G2669F27_00

Also refer below:

Ref: http://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cucm/trouble/8_0_2/trbl802/tbsnmp.html#wp1104690
 Frequently Asked Questions

Why am I not getting any SNMP traps from the Cisco Unified Communication Manager node for the CISCO-CCM-MIB?

For receiving SNMP traps in CISCO-CCM-MIB, you need to ensure that the value of the following MIB OIDs is set to appropriate values: ccmPhoneFailedAlarmInterval (1.3.6.1.4.1.9.9.156.1.9.2) and ccmPhoneStatusUpdateAlarmInterv (1.3.6.1.4.1.9.9.156.1.9.4) are set between 30 and 3600. The default specifies zero (0).

Execute the following commands from any Linux machine:

•snmpset -c <Community String> -v 2c <transmitter ip address> 1.3.6.1.4.1.9.9.156.1.9.2.0 i <value>

•snmpset -c <Community String> -v 2c <transmitter ip address> 1.3.6.1.4.1.9.9.156.1.9.4.0 i <value>

Ref: http://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cucm/service/10_0_1/admin/CUCM_BK_CDDBCDEB_00_cisco-unified-servicability-merge-100/CUCM_BK_CDDBCDEB_00_cisco-unified-servicability-merge-100_chapter_0111.html#CUCM_TP_SCA00086_00

CISCO-CCM-MIB/CISCO-CCM-CAPABILITY MIB

The CISCO-CCM-MIB contains both dynamic (real-time) and configured (static) information about the Cisco Unified Communications Manager and its associated devices, such as phones, gateways, and so on, that are visible on this Cisco Unified Communications Manager node. Simple Network Management Protocol (SNMP) tables contain information such as IP address, registration status, and model type.

SNMP supports IPv4, although the CISCO-CCM-MIB includes columns and storage for IPv6 addresses, preferences, and so on.

Note     

Cisco Unified Communications Manager supports this MIB in Cisco Unified Communications Manager systems. IM and Presence Service and Cisco Unity Connection do not support this MIB.

To view the support lists for the CISCO-CCM-MIB and MIB definitions, go to the following link:

ftp:/​/​ftp.cisco.com/​pub/​mibs/​supportlists/​callmanager/​callmanager-supportlist.html

To view MIB dependencies and MIB contents, including obsolete objects, across Cisco Unified Communications Manager releases, go to the following link: http:/​/​tools.cisco.com/​Support/​SNMP/​do/​BrowseMIB.do?local=en&step=2&mibName=CISCO-CCM-CAPABILITY

To send the RTMT alerts to Syslog, see below:
http://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cucm/managed_services/ManagedServices/cucm_health.html#wp1101540

-Terry

Please rate all helpful posts

[Matthew Martin]

Hey Terry, thanks for the reply, very much appreciated!

I'm going to give all that a shot and I'll post back with what happens. Thanks again for the detailed response!

Thanks,

Matt

[Matthew Martin]

Terry,

So I am going through the instructions on the first link you sent me, and I am under the section for Generate SNMP Traps. I am using the instructions in the table for the "MediaResourceListExhausted" alert, and it says:
 

To trigger a MediaResourceListExhausted trap:

1. In Cisco Unified Communications Manager Administration, create a media resource group that contains one of the standard Conference Bridge resources (CFB-2).
2. Create a media resource group list that contains the media resource group that you created.
3. In the Phone Configuration window, set the Media Resource Group List field to the media resource group lis that you just created.
4. Stop the IP Voice Media Streaming service. This action causes the ConferenceBridge resource (CFB-2) to stop working.
5. Make conference calls with phones that use the media resource group list. The "No Conference Bridge available" message appears in the phone screen.

So for number 4, it tells me to stop the IP Voice Media Streaming Service. What will happen if this service is stopped during normal business hours?

Thanks in Advance,
Matt

[Terry Cheema]

Hi Matt,

The Cisco IP Voice Media Streaming service provides the software based media resources like conference bridge, MTP, MoH etc. If you stop this service, all the active calls using any of the resources will drop, following calls will be setup using alternate resources (if available). But you will have dropped calls so please do not use during the normal business hours.

Please refer to below document if you need to know in detail about this service and media resources.

Ref: http://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cucm/srnd/collab09/clb09/media.html#pgfId-1150345

Cisco IP Voice Media Streaming Application

The Cisco IP Voice Media Streaming Application provides the following software-based media resources:

• Conference bridge
• Music on Hold (MoH)
• Annunciator
• Media termination point (MTP)

When the IP Voice Media Streaming Application is activated, one of each of the above resources is automatically configured.

-Terry

Please rate all helpful posts

[Matthew Martin]

Hey Terry, thanks again for the reply!

Ok great, thanks for the info, much appreciated... Good thing I didn't stop/start that service yesterday then.

I'll give this a shot later tonight.

Thanks Again,
Matt

[Matthew Martin]

Hey Terry,

So I had never actually stopped and started that service that it was mentioning in that previous comment. But, what I did do was, I created a new MRG called TestTrap-MRG and then I created a new MRGL called TestTrap-MRGL and added that MRG I created to it. Inside that MRG I had one media resource configured and it was a HW CFB for a router we have in a remote location, which I believe only has 1 or 2 CFB resource(s). Then, I assigned that MRGL to my IP Phone and I initiated a Meet-Me conference from that Phone.

After I started the Conference call I let it run for a little while, and during this I kept checking the log on the server I configured as the Trap Destination. But, I did not see anything come through the log file for that mediaResource Alert while I was watching the snmptrapd.log file... Except for a few of these below, which I have no idea what they are for:

DISMAN-EVENT-MIB::sysUpTimeInstance = Timeticks: (0) 0:00:00.00 SNMPv2-MIB::snmpTrapOID.0 = OID: SNMPv2-MIB::coldStart

But, other then that trap notification, I did not see any others come through at the time I was watching...

Yesterday I spent most of the day working on some other issues and never got back to this until today. When I opened RTMT today and checked the Alert Central page I noticed the MediaListExhausted alert was red and the date of the alert was for 8/25 at 14:17:36... So I checked the Alert Details and it showed this below:

Number of MediaResourceListExhausted events exceeds configured threshold during configured interval 0 within 60 minutes on cluster StandAloneCluster.

There are 1 MediaResourceListExhausted events (up to 30) received during the monitoring interval From Tue Aug 25 13:38:42 EDT 2015 to Tue Aug 25 14:38:42 EDT 2015:

MediaResourceListName : TestTrap-MRGL
MediaResourceType : 7
AppID : Cisco CallManager
ClusterID : StandAloneCluster
NodeID : JWP-CUCM02
TimeStamp : Tue Aug 25 14:17:36 EDT 2015

So I then went to the server configured as the SNMP Traps destination and there was a new log entry in there for this same Alert, which showed:

Received 147 bytes from UDP: [192.168.11.9]:48672->[192.168.2.22]
0000: 30 81 90 02 01 01 04 0B 6E 61 67 69 6F 73 74 72 0.......nagiostr
0016: 61 70 21 A7 7E 02 01 09 02 01 00 02 01 00 30 73 ap!.~.........0s
0032: 30 10 06 08 2B 06 01 02 01 01 03 00 43 04 00 89 0...+.......C...
0048: 53 55 30 1A 06 0A 2B 06 01 06 03 01 01 04 01 00 SU0...+.........
0064: 06 0C 2B 06 01 04 01 09 09 81 1C 02 00 05 30 11 ..+...........0.
0080: 06 0C 2B 06 01 04 01 09 09 81 1C 01 0A 01 02 01 ..+.............
0096: 05 30 11 06 0C 2B 06 01 04 01 09 09 81 1C 01 0A .0...+..........
0112: 06 02 01 01 30 1D 06 0C 2B 06 01 04 01 09 09 81 ....0...+.......
0128: 1C 01 0A 07 04 0D 54 65 73 74 54 72 61 70 2D 4D ......TestTrap-M
0144: 52 47 4C RGL

2015-08-25 14:17:37 UDP: [192.168.11.9]:48672->[192.168.2.22] [UDP: [192.168.11.9]:48672->[192.168.2.22]]:
DISMAN-EVENT-MIB::sysUpTimeInstance = Timeticks: (8999765) 1 day, 0:59:57.65 SNMPv2-MIB::snmpTrapOID.0 = OID: SNMPv2-SMI::enterprises.9.9.156.2.0.5 SNMPv2-SMI::enterprises.9.9.156.1.10.1 = INTEGER: 5 SNMPv2-SMI::enterprises.9.9.156.1.10.6 = INTEGER: 1 SNMPv2-SMI::enterprises.9.9.156.1.10.7 = STRING: "TestTrap-MRGL"

So it looks like my test DID cause the Alert to be raised... Except I'm not exactly sure how to decipher that log message...

Also, any idea what the time-frame is like for how long until it would send the Trap, or how long until the Alert in RTMT is thrown..? Because apparently it does NOT happen right away, or else I would have seen it that same day...

Thanks in Advance,
Matt