RE: [nv-l] monitoring port flapping

[Leslie Clark <lclark@us.ibm.com>]

Sorry, I am really confused by your
question. If you have not already figured it out, can you restate it? If
you have figured out, how about sharing your solution?

Cordially,

Leslie A. Clark
IBM Global Services - Systems Mgmt & Networking
Detroit

"Qureshi, Fawad" <Fawad.Qureshi@ssa.gov>
Sent by: owner-nv-l@lists.us.ibm.com

03/10/2004 12:37 PM

Please respond to
nv-l

To	"'nv-l@lists.us.ibm.com'" <nv-l@lists.us.ibm.com>
cc
Subject	RE: [nv-l] monitoring port flapping

Leslie, is there an optimal
way to only pick up flapping-ports from certain routers (in our case vBNS
backbone routers) while disregarding the rest? Currently all router alerts
are collected via a smartset (isRouter=TRUE) and displayed to the NOC.
So I would somehow have to disable interface downs from being picked up
in this smartset, so I only pipe them through the thresholding ruleset
and script as mentioned in your "case 2".
 
Cheers 
 
Fawad Qureshi
 
-----Original Message-----
From: owner-nv-l@lists.us.ibm.com [mailto:owner-nv-l@lists.us.ibm.com]
On Behalf Of Leslie Clark
Sent: Saturday, March 06, 2004 4:45 PM
To: nv-l@lists.us.ibm.com
Subject: RE: [nv-l] monitoring port flapping
 

Sanjeev, here are two different examples.  You are talking about the
second case, but seeing them both will probably help clear up some misunderstanding.
All of the information about the trap is available to your script from
the environment in "NVxx" variables, so it is not necessary to
pass it any variables when you call it, unless you want to. These snippets
would be in the scripts your action function calls after the threshold
function. 

=================== Case 1 ==================================
#This example is for when you are acting on repeating Netview events
# like Interface Down. 
# First you must clean the escape characters out of the environment 
# variables. Note that the node that the trap is about is in the second
# varbind. The Agent slot ($NVA) also contains that information. 
NODE=`echo $NVATTR_2 | sed "s:\\\\\\::g"`
ADDR=`echo $NVATTR_7 | sed "s:\\\\\\::g"`
IFACE=`echo $NVATTR_8 | sed "s:\\\\\\::g"`
# Now construct and send your custom trap. This trap has been added to
# the Netview Enterprise in trapd.conf as specific trap id 1007
SID=1007 
MSG="$NODE interface $IFACE $ADDR is failing repeatedly"
/usr/OV/bin/snmptrap $NVSERVER .1.3.6.1.4.1.2.6.3.1 $NODE 6 $SID 1 \
 .1.2 Integer 14            \
 .1.2 OctetString $NODE         \
 .1.2 OctetString "$MSG"         \
 .1.2 OctetString "$ADDR"     \
 .1.2 OctetString "$IFACE"  

====================== Case 2 ===============================================
# This example is for when you are acting on repeating unsolicited link
down 
# traps that come from devices.
# First you must clean the escape characters out of the environment variables.
# Note that the source of the trap is in the Agent variable in this case.
NODE=`echo $NVA | sed "s:\\\\\\::g"`
# The interface index is usually in the first varbind. There may be more
info 
# in additional varbinds 
IFINDEX=$NVATTR_1 
# Now construct and send your custom trap. This trap has been added to
the 
# Netview Enterprise in trapd.conf as specific trap id 1008
SID=1008 
MSG="$NODE interface index $IFINDEX is failing repeatedly"
/usr/OV/bin/snmptrap $NVSERVER .1.3.6.1.4.1.2.6.3.1 $NODE 6 $SID 1 \
 .1.2 Integer 14            \
 .1.2 OctetString $NODE         \
 .1.2 OctetString "$MSG"         \
 .1.2 OctetString "$IFINDEX"     

================================================================================================


Note that the custom traps should be added by you to trapd.conf. You are
free to use the Netview enterprise. Specific trapids 1000 to 1999 are reserved
for customer use.  In this case I made up the variable bindings  with
the expection that I might want to be able to refer to them separately
some day. 

Cordially,

Leslie A. Clark
IBM Global Services - Systems Mgmt & Networking
Detroit

"Mansabdar, Sanjeev" <sanjeev.mansabdar@spcorp.com>

03/03/2004 03:38 PM

To	Leslie Clark/Southfield/IBM@IBMUS
cc
Subject	RE: [nv-l] monitoring port flapping

 

Leslie,

Could you please share the snmptrap custom trap generated script with me. I'm unable to get the hostname variable into the trap.

Thanks in advance

sanjeev

-----Original Message-----
From: Leslie Clark [mailto:lclark@us.ibm.com]
Sent: Thursday, February 26, 2004 10:05 PM
To: nv-l@lists.us.ibm.com
Subject: Re: [nv-l] monitoring port flapping

I usually run a ruleset that watches for link down traps from devices. Include a threshold set for something like 3 in 5 minutes on the same node (Origin) and interface index number (variable 1), and at the 3rd one, run an action. That action should issue a new custom event in the Netview enterprise using the snmptrap command.  That is the trap I would act on in whatever ruleset I'm using to do notification or forward to the TEC.

The reason for watching these, of course, is that the netmon polling cycle can easily miss an interface in the down state when it is going up and down repeatedly. And of course if it is for an unnumbered port that is not represented on the map, it would be the only indication of a problem.

Cordially,

Leslie A. Clark
IBM Global Services - Systems Mgmt & Networking
Detroit

"Qureshi, Fawad" <Fawad.Qureshi@ssa.gov> Sent by: owner-nv-l@lists.us.ibm.com 02/26/2004 03:58 PM Please respond to nv-l

To:        "'nv-l@lists.us.ibm.com'" <nv-l@lists.us.ibm.com>       cc:               Subject:        [nv-l] monitoring port flapping

NV 7.1.3 / AIX 5.1

Any one monitoring for port flapping via Netview?

We experienced a VIP interface failure on a Cisco device, which seem to have started a chain of flapping ports.

Cheers

Fawad Qureshi
 

*********************************************************************
This message and any attachments are solely for the intended recipient. If you are not the intended recipient, disclosure, copying, use or distribution of the information included in this message is prohibited -- Please immediately and permanently delete.