Leslie, is there an optimal way to only
pick up flapping-ports from certain routers (in our case vBNS backbone routers)
while disregarding the rest? Currently all router alerts are collected via a smartset
(isRouter=TRUE) and displayed to the NOC. So I would somehow have to disable
interface downs from being picked up in this smartset, so I only pipe them
through the thresholding ruleset and script as mentioned in your "case 2".
-----Original Message-----
From: owner-nv-l@lists.us.ibm.com
[mailto:owner-nv-l@lists.us.ibm.com] On
Behalf Of Leslie Clark
Sent: Saturday, March 06, 2004
4:45 PM
To: nv-l@lists.us.ibm.com
Subject: RE: [nv-l] monitoring
port flapping
Sanjeev, here are two different examples. You are
talking about the second case, but seeing them both will probably help clear up
some misunderstanding. All of the information about the trap is available to
your script from the environment in "NVxx" variables, so it is not
necessary to pass it any variables when you call it, unless you want to. These
snippets would be in the scripts your action function calls after the threshold
function.
===================
Case 1 ==================================
#This
example is for when you are acting on repeating Netview events
#
like Interface Down.
#
First you must clean the escape characters out of the environment
#
variables. Note that the node that the trap is about is in the second
#
varbind. The Agent slot ($NVA) also contains that information.
NODE=`echo
$NVATTR_2 | sed "s:\\\\\\::g"`
ADDR=`echo
$NVATTR_7 | sed "s:\\\\\\::g"`
IFACE=`echo
$NVATTR_8 | sed "s:\\\\\\::g"`
#
Now construct and send your custom trap. This trap has been added to
# the
Netview Enterprise in trapd.conf as specific trap id 1007
SID=1007
MSG="$NODE
interface $IFACE $ADDR is failing repeatedly"
/usr/OV/bin/snmptrap
$NVSERVER .1.3.6.1.4.1.2.6.3.1 $NODE 6 $SID 1 \
.1.2
Integer 14 \
.1.2
OctetString $NODE \
.1.2
OctetString "$MSG" \
.1.2
OctetString "$ADDR" \
.1.2
OctetString "$IFACE"
======================
Case 2 ===============================================
#
This example is for when you are acting on repeating unsolicited link down
#
traps that come from devices.
#
First you must clean the escape characters out of the environment variables.
#
Note that the source of the trap is in the Agent variable in this case.
NODE=`echo
$NVA | sed "s:\\\\\\::g"`
#
The interface index is usually in the first varbind. There may be more info
#
in additional varbinds
IFINDEX=$NVATTR_1
#
Now construct and send your custom trap. This trap has been added to the
#
Netview Enterprise in trapd.conf as specific trap id 1008
SID=1008
MSG="$NODE
interface index $IFINDEX is failing repeatedly"
/usr/OV/bin/snmptrap
$NVSERVER .1.3.6.1.4.1.2.6.3.1 $NODE 6 $SID 1 \
.1.2
Integer 14 \
.1.2
OctetString $NODE \
.1.2
OctetString "$MSG" \
.1.2
OctetString "$IFINDEX"
================================================================================================
Note
that the custom traps should be added by you to trapd.conf. You are free to use
the Netview enterprise. Specific trapids 1000 to 1999 are reserved for customer
use. In this case I made up the variable bindings with the
expection that I might want to be able to refer to them separately some day.
Cordially,
Leslie A. Clark
IBM Global Services - Systems Mgmt & Networking
Detroit
|
"Mansabdar, Sanjeev"
<sanjeev.mansabdar@spcorp.com>
03/03/2004
03:38 PM
|
|
To
|
Leslie Clark/Southfield/IBM@IBMUS
|
|
cc
|
|
|
Subject
|
RE: [nv-l] monitoring port flapping
|
|
Leslie,
Could you please share
the snmptrap custom trap generated script with me. I'm unable to get the
hostname variable into the trap.
Thanks in advance
sanjeev
-----Original Message-----
From: Leslie Clark [mailto:lclark@us.ibm.com]
Sent: Thursday, February 26, 2004 10:05 PM
To: nv-l@lists.us.ibm.com
Subject: Re: [nv-l] monitoring port flapping
I usually run a ruleset that watches for link down traps from devices. Include
a threshold set for something like 3 in 5 minutes on the same node (Origin) and
interface index number (variable 1), and at the 3rd one, run an action. That
action should issue a new custom event in the Netview enterprise using the
snmptrap command. That is the trap I would act on in whatever ruleset I'm
using to do notification or forward to the TEC.
The reason for watching these, of course, is that the netmon polling cycle can
easily miss an interface in the down state when it is going up and down
repeatedly. And of course if it is for an unnumbered port that is not
represented on the map, it would be the only indication of a problem.
Cordially,
Leslie A. Clark
IBM Global Services - Systems Mgmt & Networking
Detroit
|
|
"Qureshi, Fawad"
<Fawad.Qureshi@ssa.gov>
Sent by: owner-nv-l@lists.us.ibm.com
02/26/2004
03:58 PM
Please respond to nv-l
|
To:
"'nv-l@lists.us.ibm.com'" <nv-l@lists.us.ibm.com>
cc:
Subject: [nv-l]
monitoring port flapping
|
NV 7.1.3 / AIX 5.1
Any one monitoring for port flapping via Netview?
We experienced a VIP interface failure on a Cisco device, which seem to have
started a chain of flapping ports.
Cheers
Fawad Qureshi
*********************************************************************
This message and any attachments are solely for the intended recipient. If you
are not the intended recipient, disclosure, copying, use or distribution of the
information included in this message is prohibited -- Please immediately and
permanently delete.