[nv-l] trap DEFAULT FMT

[Brian Kraftchick <Brian.Kraftchick@odfl.com>]

NetView 7.1.2 on Win2K

 

Okay....James, you mentioned before that when I see a trap in trapd.log specified as "DEFAULT FMT" that this means that NetView did not know how to interpret the trap that was received and put a default "wrapper" around it and logged it and placed it as an event.  That's what I've been seeing for some time now with the traps that I am receiving from the Bay Networks (Nortel) Advanced Remote Node (ARN) routers.   We have one of these routers in our test lab with a Frame Relay connection to our office, and a configured internal ethernet interface for that router's LAN.  When I pull the cable on the ethernet interface, the router produces a trap and sends it to NetView.  According to our consultant, who configured the router to send a trap when something like that happens, the trap being sent is not  an Enterprise specific trap, and is simply a mgmt.mib-II.x.x.x .....link down type trap.  This is where my problem lies.....if the trap isn't Enterprise specific (wellfleet), but is of mgmt.mib-2.x.x.x type, how come NetView does not know what it is ?  When I see the event in the Event Viewer, I do see what "node" it came from, which is meaningful, but the description field states "DEFAULT FMT: mgmt.mib-2 (1.3.6.1.2.1) generic:2 specific:0", and the Enterprise column shows "1.3.6.1.2.1".  All of this I assume is because as James stated, NetView doesn't know what to do with the trap.........if it doesn't know....how does it know that this was a "Link Down" type of trap?  Does "generic:2" mean link down ????  And most importantly...when these are received, as I mentioned before, nothing in the NetView map gets updated....the status of that device (which is managed) should go to yellow, meaning that it has a problem...mainly, an interface down.  (Right now I have turned off all polling so that I can work only with traps and KNOW what is happening and why...we are intending on relying on these and other backup devices to send traps when their are issues vs. just relying on polling).   In our situation, we need to know exactly when these devices have problems, vs. waiting for a polling period to check the device.  We do have the TEC adapter installed, but when the events above get there, they are very "vanilla"....stating simply that there is a Link Down.....drilling down into the attributes of the TEC event does tell you which device (ip address) sent the trap....but there's nothing in the "Host" attribute.....What the ultimate goal is, is to have that Event in TEC show up with the "message" attribute giving a Link Down message with the exact interface, and at least the router's IP address as the host.  Back on the NetView server, I understand that in the "Trap Settings" I can configure the event description, and I understand how to do that.....but WHAT trap definition would I be editing?  the Link Down trap under the NetView enterprise ???????

 

 

 

Brian Kraftchick

Network Administrator

Old Dominion Freight Line

Ph: (336) 822-5938

Fax: (336) 822-5149

E-mail: brian.kraftchick@odfl.com

Web Site: www.odfl.com