Re: [nv-l] SAN switch traps

[James Shanks <jshanks@us.ibm.com>]

Well, then it is just a matter of changing
your trapd.conf.   The first question I might ask is, how did you
mess it up?
Where did you get the trap definitions
which are bad?  That might tell you how to fix it.

Do you have a MIB which defines the
trapd or not?  Did you run \usr\ov\bin\mib2trap on it?

If not,  this is not rocket science
in any case.
Pick a garbled message and go look at
it in trapd.conf.  Those % signs are meaningless to trapd; in NetView
he only recognizes $ 
If you change your trap message to be
just $*, trapd will print all the variables to the trapd.log and then you
can look at them, and decide how you want the message to read the next
time and change it.

James Shanks
Level 3 Support  for Tivoli NetView for UNIX and Windows
Tivoli Software / IBM Software Group

"Lucian Vanghele" <lucian.vanghele@bisnet.ro>
Sent by: owner-nv-l@lists.us.ibm.com

04/29/2004 03:17 AM

Please respond to
nv-l

To	<nv-l@lists.us.ibm.com>
cc
Subject	Re: [nv-l] SAN switch traps

for J Shanks: sorry for this late response

yes, all 3 points below are correctly, and
yes that's what I'm trying to do: modify trap definitions with trap settings
in order to have correctly formated events 
thanks!
Lucian
----- Original Message ----- 
From: James
Shanks 
To: nv-l@lists.us.ibm.com

Sent: Thursday, April 08, 2004 4:32 PM
Subject: Re: [nv-l] SAN switch traps


OK, so you are saying that you get the traps but they are garbled; the
format is not what you expected.  That's what I was trying to clarify.
So that is good.  It means (1) that the traps are being sent by Brocade,
(2) they are in SNMP V1 format so NetView for Windows can receive them,
and (3) they  are being received, and formatted in some fashion, even
if not correctly, by what you have in trapd.conf. 

So at this point you should be able to edit the definition for these traps
in trapd.conf with Trap Settings  and change it.  Is that what
you are having trouble with?     Or did you want to review the
process by which you imported the trap definitions into trapd.conf in the
first place to figure out where it went wrong? 

James Shanks
Level 3 Support  for Tivoli NetView for UNIX and Windows
Tivoli Software / IBM Software Group

lucian_vanghele/bisms/ro@BISNET.RO

04/08/2004 09:17 AM

To	nv-l@lists.us.ibm.com
cc	James Shanks/Raleigh/IBM@IBMUS
Subject	Re: [nv-l] SAN switch traps

in the mean time I realized that those traps are not correctly because
in their definition I have %d and not $d (for example) so they are only
some kind of models (?) as far as I understand....

referring to your question: I don' have "no fmt found" traps.

I'm sure lots of such traps are sent by brocade switches: my events is somtehing like:

trapname: swFCPortScn        severity : Warning

source: Agent                        category: Error

Enterprise: sw                        Trap: 3

time:......

Node: 10.16.131.26   -  and this is the switch address

Description .... what I sent before

I'm not sure what you mean with "device or software log ...to find out".

I don't think traps are sent in V2 format as far as I can see them in my event console (even if uncorrecly formated) and I see them all in trapd.log. BUT in my mib file these are notification-type (this is snmp V2 name for trap-type ?) and also I think I had some problem to import them with mib2trap. in nv.log not traps are discarded!

I have ethereal installed to capture traffic especially on port 162 but I don't see why to start capture at this moment as far as I'm very sure these traps are from Brocade switch ...

thanks a lot James.. as allways your response are very good!

Lucian

ps

I hope I made my self clear... :)

What you installed are just definitions for how trapd should display those traps IF he gets them.
Do you see anything at all?  I mean are there unformatted traps which say "no fmt found" or  some garbled version of what you expect?

If not, there are two possibilities.
(1) Brocade is not sending the traps.  Is there some device or software log you can look at to find out?
(2) The traps are sent in SNMP V2 format.  NetView for Windows does not display SNMP V2 traps.  It has no code to interpret them, so they will be discarded.  How can you tell if you are getting V2 traps?   Well, you might see error messages in \usr\ov\log\nv.log about traps being discarded.

Alternatively you can answer both questions in a short time by downloading a free tool off the web.  It's called the Ethereal packet analyzer and it's available from http://www.ethereal.com.  It installs easily in about five minutes.  Then you can set a capture filter for "udp and port 162" and see what is being sent to the MS Trap Service.  The packets will be nicely formatted.

James Shanks
Level 3 Support  for Tivoli NetView for UNIX and Windows
Tivoli Software / IBM Software Group

"Lucian Vanghele" <lucian.vanghele@bisnet.ro>
Sent by: owner-nv-l@lists.us.ibm.com

04/08/2004 04:22 AM

Please respond to
nv-l

To	<nv-l@lists.us.ibm.com>
cc
Subject	[nv-l] SAN switch traps

hi there list ! 

I want to send traps from a Brocade SAN switch to a windows nv 713 and
I receive allways messages like that: 

- PORT INDEX %d changed to %d Port Name: %s and SSN is #%s, GroupName %s,
GroupType %s, GroupMemPosition %d 

I'm sure I imported correctly the traps from the switch mib file so...
what could be the reason? It really doesn't help now. 

thanks 

Lucian 

Sincerely Yours / al Dvs.
Lucian Vanghele,
Senior System Engineer, Business Information Systems- BIS srl
tf./fax:+4021 255 4579
 
This message is strictly confidential, between the emitter's and the
addressee's companies.
It's mandatory to have the approval of the initiator, to send it entirely
or
partially, to a third company. 
 
Acest mesaj este strict confidential , pentru companiile emitentului si
receptorului.
Pentru a putea fi transmis, intreg sau partial, unei terte companii, este
obligatoriu a avea aprobarea initiatorului.