I had to read this four times to fully understand it. I don't mean to be
critical, but your terminology here is incorrect and clarifying it will
help a lot if you want suggestions from others.
"private enterprises" is the standard MIB OID, .1.3.6.1.4.1 or in words,
"iso.org.dod.internet.private.enterprises". But that is not what you
really want. despite what you said. What you want is really the MIB OID
of the first variable sent with the trap.
Your difficulty is that this vendor sends out the same trap for all
events, and that the traps differ only by the first (and only) variable.
The have the same enterprise number, and the same generic and specific
numbers. Only the first variable, shown by [1] is different. Furthermore,
that variable is an integer, so there is no text to distinguish on trap
from another, and you therefore need to know the full MIB OID which that
integer is an instance of in order to know what the trap means. That is
what you are saying isn't it?
So the $NVE variable is correct. That is the enterprise value in the
trap. What you want is the OID value of that first variable -- that's
what you highlighted in your original note. And you are correct -- the
OIDs of the variables are not passed to nvcorrd (what he gets is a
structure containing the values of the trap elements but not the OIDs
which were used to send them), so there are no nvcorrd environment
variables which you can reference that contain them. So how can you
reference the OIDs? Well, the short answer is that you would have to
build a script to run out of ovactiond, as an automatic action, on receipt
of that trap.
Using xnmtrap you can define an automatic action for the trap in question.
Suppose you called yours "myscript". Then in the automatic action field
you would put: <full_path>myscript "$+1"
This should pass the OID and the integer value as a string to your script
in the first variable, which you would reference inside the script as
simply "$1". You can do your own processing from there, and either
re-issue a new trap of your own devising using snmptrap and forward that
one to TEC, or end your script with a wpostemsg to send your own
customized event directly.
If you prefer, you could also call myscript with "$-1" which would make
the variable look like it does now in the trapd.log extract you put in
your note. That format includes the variable number in brackets, [1], and
the value type in parens, (Integer), if you want to have those items as
well.
Hope this helps.
For what it is worth, someone should have a talk with the vendor of this
product about sending out more meaningful traps. His method, while simple
for him, borders on the silly, in my opinion. Cryptic traps help no one.
He should not be depending on the MIB OID to identify what the trap is
about. He should be supplying some text in another variable or using
different specific trap numbers to identify them as the rest of the
industry does. Can you image Cisco having one trap instead of the
hundreds they send? Good heavens, what a nightmare. My two cents.
James Shanks
Level 3 Support for Tivoli NetView for UNIX and NT
Tivoli Software / IBM Software Group
"Mahon, Ray" <Ray.Mahon@itsis.ie>
11/12/2002 09:40 AM
To: "'nv-l@lists.tivoli.com'" <nv-l@lists.tivoli.com>
cc:
Subject: [nv-l] FW: [NV] NetView:How can one extract
private.enterprises from a t
rap
Hi ,
We have just recently installed an environment monitoring system(RIT
Patchview). All alerts raised are via SNMP, hence Netview receiving them.
The problem
I'm having is that all of there traps are coming in with the same event
info, i.e. "Event name, Generic Trap no., Specific Trap no." and can not
be changed? The only info that does change depending on the problem is
the return value of the integer, hostname and private.enterprise.
Event:
ritAuxIndicatorTable = Event Name
6 = Generic trap number
50 = Specific trap number
Sample Traps:
ns_master_ems A ritAuxIndicatorTable 6 50 1 args:
[1]
private.enterprises.663.1.2.4.2.1.3.1.6 (Integer): 2
ns_master_ems A ritAuxIndicatorTable 6 50 1 args:
[1]
private.enterprises.663.1.2.4.2.1.3.1.6 (Integer): 1
ns_master_ems A ritAuxIndicatorTable 6 50 1 args:
[1]
private.enterprises.663.1.2.4.2.1.3.1.8 (Integer): 2
ns_master_ems A ritAuxIndicatorTable 6 50 1 args:
[1]
private.enterprises.663.1.2.4.2.1.3.1.7 (Integer): 2
ns_master_ems A ritAuxIndicatorTable 6 50 1 args:
[1]
private.enterprises.663.1.2.4.2.1.3.1.9 (Integer): 2
ns_master_ems A ritAuxIndicatorTable 6 50 1 args:
[1]
private.enterprises.663.1.2.4.2.1.3.1.10 (Integer): 2
ns_master_ems A ritAuxIndicatorTable 6 50 1 args:
[1]
private.enterprises.663.1.2.4.2.1.3.1.11 (Integer): 2
TRAP Variables:
The following environment variables are allow: NVE, NVA, NVG, NVS, NVT,
NVC, NVATTR_1-50
NVE - only gives the trap enterprise 1.3.6.1.4.1.663.1.2.4.2. None of the
above will give the private.enterprise number, unless I missed one.
When one configures/creates an event you can specific "$*" to display all
event information, which includes private.enterprise.
The process I was looking for was looking take was as follows:
Receive event.
Rule will forward all trap details to a scripts.
This script will evaluate the private.enterprise number.
Generate another more meaningful trap.
Rule to forward trap to TEC.
IF Not, I'll set-up an ACP over trapd.log.
Anybody any ideas?
Tivoli Systems (TSG) ext:2146
Mobile: 0866017253
|