nv-l
[Top] [All Lists]

Re: nvevent shows incorrect OID string in RMON trap/events for

To: nv-l@lists.tivoli.com
Subject: Re: nvevent shows incorrect OID string in RMON trap/events for some mib2-variables
From: Siegbert Kleiner <Siegbert.Kleiner@T-ONLINE.DE>
Date: Thu, 15 Jul 1999 22:41:55 +0100
Reply-to: Discussion of IBM NetView and POLYCENTER Manager on NetView <NV-L@UCSBVM.UCSB.EDU>
Sender: Discussion of IBM NetView and POLYCENTER Manager on NetView <NV-L@UCSBVM.UCSB.EDU>
Thanks for your help James. But there are still some questions and
additional infos. See comments inline:

>Trapd displays what he is sent, period.  If the nth variable of a trap
>contains a particular value, then that is what he will display if you put
>$n (for whatever number n is) on the Event Log display message line in
>xnmtrap.   In short, you can, and should format the trap, and make the text
>say whatever you want.


In above statements you describe that no conversion happens through
trapd. But in the next section you're talking about OID string to name
conversions through trapd.

>..., trapd tries to show the name of the MIB value which accompanies each
>value, he gets that MIB name from some MIB or other you have loaded in the
MIB
>browser.  ...
>


After collecting some more informations I suppose that this
OID-string-to-name-conversion happens also for MIB values,
if this value contains an OID string. I've added the string "$*"
to the default RMON trap definitions from Nways Campus Mgr.
installation script. Therefore I get now all varbinds. Further we
got the correct values for other MIB variable threshold messages.

I've added some problem details:


The following RMON trap messages are displayed in the netview
events application for the "ifEntry.ifOutUcastPkts.3" threshold:

>> DESCRIPTION : Tue Jul 13 07:32:11 1999 router1
>>     A RMON Falling Alarm: Unicast packets xmtd fell below
>>     threshold 5; value = 0. (Sample type = 2; alarm index = 4) ->
>> [1] rmon.alarm.alarmTable.alarmEntry.alarmIndex.4 (Integer): 4
>> [2] rmon.alarm.alarmTable.alarmEntry.alarmVariable.4
>>     (ObjectIdentifier): Unicast packets xmtd
>>      ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^???????
>> [3] rmon.alarm.alarmTable.alarmEntry.alarmSampleType.4 (Integer): 2
>> [4] rmon.alarm.alarmTable.alarmEntry.alarmValue.4 (Integer): 0
>> [5] alarmTable.alarmEntry.alarmFallingThreshold.4 (Integer): 5
>> ...
>> HOSTNAME   : router1
>> ENTERPRISE : rmon 1.3.6.1.2.1.16
>> GENERIC    : 6
>> SPECIFIC   : 2
>>

Where does the string "Unicast packets xmtd" come from? This
is not an ObjectIdentifier!

The capture decoding from my network analyzer shows the correct
OID value for trap variable #2 (e.g. OID = ifEntry.ifOutUcastPkts.3)

>>SNMP: ----- Simple Network Management Protocol (Version 1) -----
>>      ...
>>      SNMP: Command      = Trap
>>     SNMP: Enterprise      = {1.3.6.1.2.1.16}
>>      SNMP: Network address = [192.168.20.2], 192.168.20.2
>>      SNMP: Generic trap    = 6 (Enterprise specific)
>>      SNMP: Specific trap   = 2
>>      SNMP: Time ticks      = 577904
>>      SNMP:
>>      SNMP: Object = {1.3.6.1.2.1.16.3.1.1.1.4} (rmon.3.1.1.1.4)
>>      SNMP: Value  = 4
>>      SNMP:
>>      SNMP: Object = {1.3.6.1.2.1.16.3.1.1.3.4} (rmon.3.1.1.3.4)
>>      SNMP: Value  = {1.3.6.1.2.1.2.2.1.17.3}
>>                  ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

>>      SNMP:
>>      SNMP: Object = {1.3.6.1.2.1.16.3.1.1.4.4} (rmon.3.1.1.4.4)
>>      SNMP: Value  = 2
>>      SNMP:
>>      SNMP: Object = {1.3.6.1.2.1.16.3.1.1.5.4} (rmon.3.1.1.5.4)
>>      SNMP: Value  = 0
>>      SNMP:
>>      SNMP: Object = {1.3.6.1.2.1.16.3.1.1.8.4} (rmon.3.1.1.8.4)
>>      SNMP: Value  = 5
>>      SNMP:
>>


And now a correct example for the Cisco private MIB variable avgBusy1:
>>
>> DESCRIPTION : Tue Jul 13 06:35:56 1999 router1
>>     A RMON Falling Alarm:
>>     private.enterprises.cisco.local.lsystem.avgBusy1.0
>>     fell below threshold 10; value = 10.
>>     (Sample type = 1; alarm index = 1) ->
>> [1] rmon.alarm.alarmTable.alarmEntry.alarmIndex.1 (Integer): 1
>> [2] rmon.alarm.alarmTable.alarmEntry.alarmVariable.1
>>      (ObjectIdentifier): private.enterprises.cisco.local.
>>                                lsystem.avgBusy1.0
>^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
>> [3] rmon.alarm.alarmTable.alarmEntry.alarmSampleType.1 (Integer): 1
>> [4] rmon.alarm.alarmTable.alarmEntry.alarmValue.1 (Integer): 10
>> [5] alarmTable.alarmEntry.alarmFallingThreshold.1 (Integer): 10
>>   HOSTNAME   : router1
>>   ENTERPRISE : rmon 1.3.6.1.2.1.16
>>   GENERIC    : 6
>>   SPECIFIC   : 2

Both traps use the same trap definition!
I think this is a Netview related problem.

Regards Siggi

Siegbert Kleiner
Network Consulting Bazzanella GmbH
Benzstrasse 32
71083 Herrenberg - Germany
skleiner@ncb.de

<Prev in Thread] Current Thread [Next in Thread>

Archive operated by Skills 1st Ltd

See also: The NetView Web