nv-l
[Top] [All Lists]

RE: [nv-l] monitoring port flapping

To: nv-l@lists.us.ibm.com
Subject: RE: [nv-l] monitoring port flapping
From: Leslie Clark <lclark@us.ibm.com>
Date: Fri, 19 Mar 2004 09:07:54 -0500
Delivery-date: Fri, 19 Mar 2004 14:37:29 +0000
Envelope-to: nv-l-archive@lists.skills-1st.co.uk
In-reply-to: <077A7BB7EF7DB04E81162552C1D47F544FB295@s1ffcd2.ba.ssa.gov>
Reply-to: nv-l@lists.us.ibm.com
Sender: owner-nv-l@lists.us.ibm.com

Sorry, I am really confused by your question. If you have not already figured it out, can you restate it? If you have figured out, how about sharing your solution?

Cordially,

Leslie A. Clark
IBM Global Services - Systems Mgmt & Networking
Detroit



"Qureshi, Fawad" <Fawad.Qureshi@ssa.gov>
Sent by: owner-nv-l@lists.us.ibm.com

03/10/2004 12:37 PM
Please respond to
nv-l

To
"'nv-l@lists.us.ibm.com'" <nv-l@lists.us.ibm.com>
cc
Subject
RE: [nv-l] monitoring port flapping





Leslie, is there an optimal way to only pick up flapping-ports from certain routers (in our case vBNS backbone routers) while disregarding the rest? Currently all router alerts are collected via a smartset (isRouter=TRUE) and displayed to the NOC. So I would somehow have to disable interface downs from being picked up in this smartset, so I only pipe them through the thresholding ruleset and script as mentioned in your "case 2".
 
Cheers
 
Fawad Qureshi
 
-----Original Message-----
From:
owner-nv-l@lists.us.ibm.com [mailto:owner-nv-l@lists.us.ibm.com] On Behalf Of Leslie Clark
Sent:
Saturday, March 06, 2004 4:45 PM
To:
nv-l@lists.us.ibm.com
Subject:
RE: [nv-l] monitoring port flapping

 

Sanjeev, here are two different examples.  You are talking about the second case, but seeing them both will probably help clear up some misunderstanding. All of the information about the trap is available to your script from the environment in "NVxx" variables, so it is not necessary to pass it any variables when you call it, unless you want to. These snippets would be in the scripts your action function calls after the threshold function.


=================== Case 1 ==================================

#This example is for when you are acting on repeating Netview events

# like Interface Down.

# First you must clean the escape characters out of the environment
# variables. Note that the node that the trap is about is in the second
# varbind. The Agent slot ($NVA) also contains that information.
NODE=`echo $NVATTR_2 | sed "s:\\\\\\::g"`

ADDR=`echo $NVATTR_7 | sed "s:\\\\\\::g"`

IFACE=`echo $NVATTR_8 | sed "s:\\\\\\::g"`

# Now construct and send your custom trap. This trap has been added to
# the Netview Enterprise in trapd.conf as specific trap id 1007

SID=1007

MSG="$NODE interface $IFACE $ADDR is failing repeatedly"

/usr/OV/bin/snmptrap $NVSERVER .1.3.6.1.4.1.2.6.3.1 $NODE 6 $SID 1 \

.1.2 Integer 14            \

.1.2 OctetString $NODE         \

.1.2 OctetString "$MSG"         \

.1.2 OctetString "$ADDR"     \

.1.2 OctetString "$IFACE"  


====================== Case 2 ===============================================

# This example is for when you are acting on repeating unsolicited link down
# traps that come from devices.

# First you must clean the escape characters out of the environment variables.
# Note that the source of the trap is in the Agent variable in this case.
NODE=`echo $NVA | sed "s:\\\\\\::g"`

# The interface index is usually in the first varbind. There may be more info

# in additional varbinds

IFINDEX=$NVATTR_1

# Now construct and send your custom trap. This trap has been added to the
# Netview Enterprise in trapd.conf as specific trap id 1008

SID=1008

MSG="$NODE interface index $IFINDEX is failing repeatedly"

/usr/OV/bin/snmptrap $NVSERVER .1.3.6.1.4.1.2.6.3.1 $NODE 6 $SID 1 \

.1.2 Integer 14            \

.1.2 OctetString $NODE         \

.1.2 OctetString "$MSG"         \

.1.2 OctetString "$IFINDEX"    


================================================================================================



Note that the custom traps should be added by you to trapd.conf. You are free to use the Netview enterprise. Specific trapids 1000 to 1999 are reserved for customer use.  In this case I made up the variable bindings  with the expection that I might want to be able to refer to them separately some day.

Cordially,

Leslie A. Clark
IBM Global Services - Systems Mgmt & Networking
Detroit


"Mansabdar, Sanjeev" <sanjeev.mansabdar@spcorp.com>

03/03/2004 03:38 PM


To
Leslie Clark/Southfield/IBM@IBMUS
cc
 
Subject
RE: [nv-l] monitoring port flapping

 


   





Leslie,

Could you please share the snmptrap custom trap generated script with me. I'm unable to get the hostname variable into the trap.

Thanks in advance

sanjeev

-----Original Message-----
From:
Leslie Clark [mailto:lclark@us.ibm.com]
Sent:
Thursday, February 26, 2004 10:05 PM
To:
nv-l@lists.us.ibm.com
Subject:
Re: [nv-l] monitoring port flapping


I usually run a ruleset that watches for link down traps from devices. Include a threshold set for something like 3 in 5 minutes on the same node (Origin) and interface index number (variable 1), and at the 3rd one, run an action. That action should issue a new custom event in the Netview enterprise using the snmptrap command.  That is the trap I would act on in whatever ruleset I'm using to do notification or forward to the TEC.

The reason for watching these, of course, is that the netmon polling cycle can easily miss an interface in the down state when it is going up and down repeatedly. And of course if it is for an unnumbered port that is not represented on the map, it would be the only indication of a problem.

Cordially,

Leslie A. Clark
IBM Global Services - Systems Mgmt & Networking
Detroit

  "Qureshi, Fawad" <Fawad.Qureshi@ssa.gov>
Sent by: owner-nv-l@lists.us.ibm.com

02/26/2004 03:58 PM
Please respond to nv-l

       
      To:        "'nv-l@lists.us.ibm.com'" <nv-l@lists.us.ibm.com>
      cc:        
      Subject:        [nv-l] monitoring port flapping




NV 7.1.3 / AIX 5.1

Any one monitoring for port flapping via Netview?

We experienced a VIP interface failure on a Cisco device, which seem to have started a chain of flapping ports.

Cheers


Fawad Qureshi

 



*********************************************************************
This message and any attachments are solely for the intended recipient. If you are not the intended recipient, disclosure, copying, use or distribution of the information included in this message is prohibited -- Please immediately and permanently delete.

<Prev in Thread] Current Thread [Next in Thread>

Archive operated by Skills 1st Ltd

See also: The NetView Web