Many network devices including but not limited to network switches, routers, remote access servers, UPSs, printers and operating systems such as Unix and Windows NT have the ability to send notifications to an SNMP manager running on a network management station. The notifications can be either SNMP Traps, or SNMP Inform messages.
The notification can contain a wide array of information such as port failures, link failures, access violations, power outages, paper jams, hard drive failures etc. The MIB (Management Information Base) available from the vendor determines the notifications supported by each device.
The MIB file contains TRAP-TYPE (SMIv1) or NOTIFICATION-TYPE (SMIv2) definitions, which define the variables that are passed to the management station when a particular event occurs.
The Net-SNMP program snmptrapd is an application that receives and logs SNMP trap and inform messages via TCP/IP. Following is a sample syslog entry for a Compaq cpqDa3LogDrvStatusChange trap that notifies that the drive array is rebuilding:
Feb 12 13:37:10 server11 snmptrapd: 192.168.110.192: Enterprise Specific Trap (3008) Uptime: 306 days, 23:13:24.29, .220.127.116.11.18.104.22.168.0 = SERVER08, .22.214.171.124.126.96.36.199.188.8.131.52 = 0, .184.108.40.206.220.127.116.11.18.104.22.168.4.8.1 = rebuilding(7)
Feb 12 13:37:10 server11 snmptrapd: 192.168.110.192: Enterprise Specific Trap (3008) Uptime: 306 days, 23:13:24.29, sysName.0 = SERVER08, cpqHoTrapFlags.0 = 0, cpqDaLogDrvStatus.8.1 = rebuilding(7)
The output from snmptrapd can be changed via the -O option to display numeric or symbolic OIDs and other display options, but it generally follows the format of variable name = value, variable name = value etc.
A more descriptive / friendly trap message can be created using SNMPTT's variable substitution. Following is the same trap, logged with SNMPTT:
Feb 12 13:37:13 server11 TRAPD: .22.214.171.124.126.96.36.199.3008 Normal "XLOGONLY" server08 - Logical Drive Status Change: Status is now rebuilding
The definition for the cpqDa3LogDrvStatusChange trap in the SNMPTT configuration file would be defined as follows:
FORMAT Logical Drive Status Change: Status is now $3.
The $3 represents the third variable as defined in the MIB file, which for this particular trap, is the cpqDaLogDrvStatus variable.
Another example of an SNMPTT configuration entry is:
FORMAT Compaq Drive Array Spare Drive on controller $4, bus $5, bay $6 status is $3.
Which could result in the following output:
"Compaq Drive Array Spare Drive on controller 3, bus 0, bay 3 status is Failed."
Snmptt can log to any of the following destinations: text log, syslog, NT Event log or a SQL database. External programs can also be run to pass the translated trap to an email client, paging software etc.
In addition to variable substitution, SNMPTT allows complex configurations allowing:
The following picture illustrates how the network device, Net-SNMP and SNMPTT are integrated to process a trap.
Last modified: Wednesday, 18-Jan-2006 01:16:41 UTC
Copyright © 2002-2010 Alex Burger