Mike/Leslie/James/All,
Wow, I'll have to pay closer attention to the mailing list!
Here's the (customized) trap to look for in our/your trapd that gets emailed
to myself & a service account for the admins:
ENTERPRISEDEF {1.3.6.1.4.1} -1 0 ? 1 0 "Log Only Events"
Trap found with no known format in trapd.conf(4)\n Enterprise $E ($e)
community $C\n generic trap:$G specific trap:$S\n Timestamp:$T Agentaddr:$A
args($#):\n$*
EXEC echo "Trap found with no known format in trapd.conf(4)\n Enterprise $E
($e) community $C\n generic trap:$G specific trap:$S\n Timestamp:$T
Agentaddr:$A args($#):\n$*" | mail -s "Unformatted Trap: E: $E, e: $e, S:
$S" dermott netview
When an admin does a 'netmon -y' to pick up changes to the seed file, we
usually get the 'netmon action event' in the log and an email (since it is
unformatted).
Good Luck,
--Dermott
p.s. Leslie, "...really large ugly trapd.conf files...",
we'll have to take that comment off line, let alone the one about
whose fault it is ;)
-----Original Message-----
From: Leslie Clark [mailto:lclark@US.IBM.COM]
Sent: Friday, November 09, 2001 4:25 PM
To: IBM NetView Discussion
Subject: Re: [NV-L] Mail Problems
Update.. (I knew this was Dermott's fault...)
Mike has NVMAPGLOBALACK set in the users' profiles for sharing of
Ack status, so a flurry of Acknowledged traps is normal at map open time.
Some customers, notably those with really large ugly trapd.conf files,
occasionally see that an internal netview event shows up as unformatted.
This has been seen now with the Acknowledge event and the Action
event (like netmon -a 3). This usually happens while you are updating
the trapd.conf through the gui or other stressful times. And admittedly I
have only heard of it at Dermott's shop and Mike's....Hmmm
So the real mystery here was why mail was being generated for an
unformatted trap. It was in fact being generated for ALL unformatted traps.
Well, it turns out that it was doing that because Mike got his trapd.conf
from Dermott in a spinoff, and Dermott set it up that way. The entry
for ENTERPRISEDEF was configured with an action to send mail to
the administrators to remind them to update the trap definitions for new
things. Mystery solved.
Cordially,
Leslie A. Clark
IBM Global Services - Systems Mgmt & Networking
Detroit
James
Shanks/Raleigh To: IBM NetView Discussion
<nv-l@tkg.com>
/IBM@IBMUS cc:
Sent by: Subject: Re: [NV-L] Mail
Problems
owner-nv-l@tkg
.com
11/08/01 04:54
PM
Please respond
to IBM NetView
Discussion
I recognize the message but you'll have to tell us what it is doing in
/var/mail/netview.
The trap is the new global Acknowldeged trap, though I am mystified as to
why you get the Unformatted trap part, because by default NetView will
format all his own traps whether there is an entry in trapd.conf or not.
You could always add one if you wanted to format the trap yourself.
But what have you got set up that is sending this as a mail message?
You'd have to have some customization in place to do that.
What level of code and what OS are you using? Has someone customized traps
in trapd to send mail?
James Shanks
Level 3 Support for Tivoli NetView for UNIX and NT
Tivoli Software / IBM Software Group
Mike Walsh
<Mike.Walsh@reliastar.com> To: IBM NetView
Sent by: owner-nv-l@tkg.com Discussion <nv-l@tkg.com>
cc:
Subject: [NV-L] Mail
11/08/2001 04:31 PM Problems
Please respond to IBM NetView
Discussion
Hi,
My Netview server is being flooded by the following messages in the
/var/mail/netview file. I cannot identify where they are comeing from.
Does anyone out there recognise these messages and could you provide
some guidence in controlling this. It is bringing my box to it's knees.
Thanks,
Mike
From: Super-User <root>
Message-Id:
<200111081908.fA8J7oo06749@dsm21001.nws.us.americas.intranet>
To: netview
Subject: Unformatted Trap: E: NetView, e: 1.3.6.1.4.1.2.6.3.1, S:
50790450
Content-Length: 555
Trap found with no known format in trapd.conf(4)
Enterprise NetView (1.3.6.1.4.1.2.6.3.1) community public
generic trap:6 specific trap:50790450
Timestamp:31938 Agentaddr:dsm21001 args(5):
[1] private.enterprises.ibm.ibmProd.3.1.1.2.0 (Integer): 4
[2] private.enterprises.ibm.ibmProd.3.1.1.3.0 (OctetString): dsm21001
[3] private.enterprises.ibm.ibmProd.3.1.1.4.0 (OctetString): default:
Acknowled
ged 211382
[4] private.enterprises.ibm.ibmProd.3.1.1.5.0 (OctetString): 211382
[5] private.enterprises.ibm.ibmProd.3.1.1.6.0 (OctetString): openview
>From root Thu Nov 8 13:03:45 2001
Return-Path: <root>
Received: (from root@localhost)
by dsm21001.nws.us.americas.intranet (8.10.2+Sun/8.10.2) id
fA8J2aj04228
for netview; Thu, 8 Nov 2001 13:02:36 -0600 (CST)
Date: Thu, 8 Nov 2001 13:02:36 -0600 (CST)
From: Super-User <root>
Message-Id:
<200111081902.fA8J2aj04228@dsm21001.nws.us.americas.intranet>
To: netview
Subject: Unformatted Trap: E: NetView, e: 1.3.6.1.4.1.2.6.3.1, S:
50790450
Content-Length: 554
Trap found with no known format in trapd.conf(4)
Enterprise NetView (1.3.6.1.4.1.2.6.3.1) community public
generic trap:6 specific trap:50790450
Timestamp:4263 Agentaddr:dsm21001 args(5):
[1] private.enterprises.ibm.ibmProd.3.1.1.2.0 (Integer): 4
[2] private.enterprises.ibm.ibmProd.3.1.1.3.0 (OctetString): dsm21001
[3] private.enterprises.ibm.ibmProd.3.1.1.4.0 (OctetString): default:
Acknowled
ged 211382
[4] private.enterprises.ibm.ibmProd.3.1.1.5.0 (OctetString): 211382
[5] private.enterprises.ibm.ibmProd.3.1.1.6.0 (OctetString): openview
_________________________________________________________________________
NV-L List information and Archives: http://www.tkg.com/nv-l
|