nvevent shows incorrect OID string in RMON trap/events for some mib2-variables

[Siegbert Kleiner <Siegbert.Kleiner@T-ONLINE.DE>]

Hi all,

we want to monitor our Cisco routers (C250x, IOS 11.3) with
RMON thresholds. But for some MIB2 variables the netview
event application (AIX 4.2.1, Netview v5.1.1) don't display the
correct OID string including the interface instance for the RMON
trap variable #2 as specified in RFC1757. e.g. it shows the string
"Unicast packets xmtd" for ifEntry.ifOutUcastPkts.3. Problem
details see below.
We need the interface instance to identify the critical interface/subnet.
If we use the private Cisco MIB variable avgBusy1 it works fine.

There must be an invalid "hidden" conversion for some MIB-2 OIDs
within the trapd processing.

Any help is appreciated.

Thanks in advance

Regards Siggi

Siegbert Kleiner
Network Consulting Bazzanella GmbH
Benzstrasse 32
71083 Herrenberg - Germany
skleiner@ncb.de


Problem details:

The router commands below should do it:

> snmp-server community public RO
> snmp-server community cisco RW
> snmp-server trap-source Ethernet0
> snmp-server host 192.168.20.55 public
> rmon event 1 trap public description "Test Event Nr. 1" owner monitor
> rmon event 2 trap public description "Test Event Nr. 2" owner monitor
> rmon alarm 1 lsystem.57.0 60 absolute rising-threshold 20 1
falling-threshold 10 2 owner monitor
> ...
> rmon alarm 4 ifEntry.17.3 10 delta rising-threshold 10 1 falling-threshold
5 2 owner monitor

The capture decoding shows the correct OID value for trap variable #2

SNMP: ----- Simple Network Management Protocol (Version 1) -----
      ...
      SNMP: Command      = Trap
      SNMP: Enterprise      = {1.3.6.1.2.1.16}
      SNMP: Network address = [192.168.20.2], 192.168.20.2
      SNMP: Generic trap    = 6 (Enterprise specific)
      SNMP: Specific trap   = 2
      SNMP: Time ticks      = 577904
      SNMP:
      SNMP: Object = {1.3.6.1.2.1.16.3.1.1.1.4} (rmon.3.1.1.1.4)
      SNMP: Value  = 4
      SNMP:
      SNMP: Object = {1.3.6.1.2.1.16.3.1.1.3.4} (rmon.3.1.1.3.4)
      SNMP: Value  = {1.3.6.1.2.1.2.2.1.17.3}
                  ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
                  OID = ifEntry.ifOutUcastPkts.3
      SNMP:
      SNMP: Object = {1.3.6.1.2.1.16.3.1.1.4.4} (rmon.3.1.1.4.4)
      SNMP: Value  = 2
      SNMP:
      SNMP: Object = {1.3.6.1.2.1.16.3.1.1.5.4} (rmon.3.1.1.5.4)
      SNMP: Value  = 0
      SNMP:
      SNMP: Object = {1.3.6.1.2.1.16.3.1.1.8.4} (rmon.3.1.1.8.4)
      SNMP: Value  = 5
      SNMP:


But I've got the following RMON trap messages in the netview events
application for the "rmon alarm 4 ifEntry.ifOutUcastPkts.3" command:

> DESCRIPTION : Tue Jul 13 07:32:11 1999 router1
>     A RMON Falling Alarm: Unicast packets xmtd fell below
>     threshold 5; value = 0. (Sample type = 2; alarm index = 4) ->
> [1] rmon.alarm.alarmTable.alarmEntry.alarmIndex.4 (Integer): 4
> [2] rmon.alarm.alarmTable.alarmEntry.alarmVariable.4
>     (ObjectIdentifier): Unicast packets xmtd
      ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^???????
> [3] rmon.alarm.alarmTable.alarmEntry.alarmSampleType.4 (Integer): 2
> [4] rmon.alarm.alarmTable.alarmEntry.alarmValue.4 (Integer): 0
> [5] alarmTable.alarmEntry.alarmFallingThreshold.4 (Integer): 5
> ...
> HOSTNAME   : router1
> ENTERPRISE : rmon 1.3.6.1.2.1.16
> GENERIC    : 6
> SPECIFIC   : 2

And a working example for the Cisco private MIB variable avgBusy1:

> DESCRIPTION : Tue Jul 13 06:35:56 1999 router1
>     A RMON Falling Alarm:
private.enterprises.cisco.local.lsystem.avgBusy1.0
>     fell below threshold 10; value = 10. (Sample type = 1; alarm index =
1) ->
> [1] rmon.alarm.alarmTable.alarmEntry.alarmIndex.1 (Integer): 1
>  [2] rmon.alarm.alarmTable.alarmEntry.alarmVariable.1
>      (ObjectIdentifier):
private.enterprises.cisco.local.lsystem.avgBusy1.0

^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
^^^^^!!!!!!!
>  [3] rmon.alarm.alarmTable.alarmEntry.alarmSampleType.1 (Integer): 1
>  [4] rmon.alarm.alarmTable.alarmEntry.alarmValue.1 (Integer): 10
>  [5] alarmTable.alarmEntry.alarmFallingThreshold.1 (Integer): 10
>  HOSTNAME   : router1
>  ENTERPRISE : rmon 1.3.6.1.2.1.16
>  GENERIC    : 6
>  SPECIFIC   : 2