Re: [nv-l] SAN switch traps

[James Shanks <jshanks@us.ibm.com>]

Lucian,

You are mistaken about mib2trap.  It
does work on SNMP V2 MIBs with Notifications statements.  I know,
I fixed that myself several years ago.  

Your confusion comes from assuming that
because the MIB uses SNMP V2 constructs, that the agent cannot send the
trap in SNMP V1 format.  Most can and do.  Almost all agents
which support SNMP V2 also support SNMP V1, but often only an SNMP V2 MIB
is provided.  So mib2trap reads both.

The deal with this Brocade MIB is that
they are actually expecting you to run mib2trap on it, to get the formatting
correct.  I can see that from what you have provided.  Brocade
has provided all sorts of formatting hints in the comments in the MIB.
 The  variables found in  the - -#ARGUMENTS statements map
into those %d  placeholders in the - -#SUMMARY statements.  
 Actually,  since the ARGUMENTS start with zero and the trapd
variables start with 1, you have to add 1 to each argument to get the mapping
correct.  But mib2trap will do that for you.

If you run mib2trap, and get an addtrap
bat file, when you run the bat, it  should overlay the definitions
you already added with good ones.

James Shanks
Level 3 Support  for Tivoli NetView for UNIX and Windows
Tivoli Software / IBM Software Group

"Lucian Vanghele" <lucian.vanghele@bisnet.ro>
Sent by: owner-nv-l@lists.us.ibm.com

04/29/2004 09:23 AM

Please respond to
nv-l

To	<nv-l@lists.us.ibm.com>
cc
Subject	Re: [nv-l] SAN switch traps

Thanks james
mib2trap doesn't worked on it (because I
have notification-type for trap definition - so I suppose definitions are
trap V2 but the switch is sending trap V1 as far as the server can receive
them). So I think I added them manually. Anyway I tried $* and it prints
all the variables. I know I should edit the traps and put there $1, $2
and so on but I'm not sure about the order. 
maybe I should send you one trap definition:
 
swFCPortScn  NOTIFICATION-TYPE
 OBJECTS { swFCPortOpStatus, swFCPortIndex, swFCPortName,
     swSsn, swGroupName, swGroupType, swGroupMemPos }
 STATUS current
 DESCRIPTION "A swFCPortScn(3) is generated whenever an FC_Port
  changes its operational state. For instance, the FC_Port
  goes from on-line to offline. The VarBind in the Trap Data
  Unit shall contain the corresponding instance of the
  FC_Port's operational status, index, swFCPortName and
  swSsn. swFCPortName, swSsn are optional."
 --#TYPE  "A Fibre Channel Port changed its operational state."
 --#SUMMARY "Port Index %d changed state to %d  Port Name: %s
and SSN is #%s, GroupName %s,GroupType %s,GroupMemPosition %d"
 --#ARGUMENTS { 1, 0, 2, 3, 4, 5, 6 }
 --#SEVERITY INFORMATIONAL
 --#TIMEINDEX 1
 --#STATE OPERATIONAL
 ::= { swTrapsV2 3 } 
 
thanks again
Lucian
----- Original Message ----- 
From: James
Shanks 
To: nv-l@lists.us.ibm.com

Sent: Thursday, April 29, 2004 4:05 PM
Subject: Re: [nv-l] SAN switch traps


Well, then it is just a matter of changing your trapd.conf.   The
first question I might ask is, how did you mess it up?
Where did you get the trap definitions which are bad?  That might
tell you how to fix it. 

Do you have a MIB which defines the trapd or not?  Did you run \usr\ov\bin\mib2trap
on it? 

If not,  this is not rocket science in any case.
Pick a garbled message and go look at it in trapd.conf.  Those % signs
are meaningless to trapd; in NetView he only recognizes $ 
If you change your trap message to be just $*, trapd will print all the
variables to the trapd.log and then you can look at them, and decide how
you want the message to read the next time and change it.

James Shanks
Level 3 Support  for Tivoli NetView for UNIX and Windows
Tivoli Software / IBM Software Group

"Lucian Vanghele" <lucian.vanghele@bisnet.ro>
Sent by: owner-nv-l@lists.us.ibm.com

04/29/2004 03:17 AM

Please respond to
nv-l

To	<nv-l@lists.us.ibm.com>
cc
Subject	Re: [nv-l] SAN switch traps

for J Shanks: sorry for this late response 
yes, all 3 points below are correctly, and yes that's what I'm trying to
do: modify trap definitions with trap settings in order to have correctly
formated events 
thanks! 
Lucian 
----- Original Message ----- 
From: James
Shanks 
To: nv-l@lists.us.ibm.com
Sent: Thursday, April 08, 2004 4:32 PM 
Subject: Re: [nv-l] SAN switch traps 


OK, so you are saying that you get the traps but they are garbled; the
format is not what you expected.  That's what I was trying to clarify.
So that is good.  It means (1) that the traps are being sent by Brocade,
(2) they are in SNMP V1 format so NetView for Windows can receive them,
and (3) they  are being received, and formatted in some fashion, even
if not correctly, by what you have in trapd.conf. 

So at this point you should be able to edit the definition for these traps
in trapd.conf with Trap Settings  and change it.  Is that what
you are having trouble with?     Or did you want to review the
process by which you imported the trap definitions into trapd.conf in the
first place to figure out where it went wrong? 

James Shanks
Level 3 Support  for Tivoli NetView for UNIX and Windows
Tivoli Software / IBM Software Group

lucian_vanghele/bisms/ro@BISNET.RO

04/08/2004 09:17 AM

To	nv-l@lists.us.ibm.com
cc	James Shanks/Raleigh/IBM@IBMUS
Subject	Re: [nv-l] SAN switch traps

in the mean time I realized that those traps are not correctly because
in their definition I have %d and not $d (for example) so they are only
some kind of models (?) as far as I understand....

referring to your question: I don' have "no fmt found" traps.

I'm sure lots of such traps are sent by brocade switches: my events is somtehing like:

trapname: swFCPortScn        severity : Warning

source: Agent                        category: Error

Enterprise: sw                        Trap: 3

time:......

Node: 10.16.131.26   -  and this is the switch address

Description .... what I sent before

I'm not sure what you mean with "device or software log ...to find out".

I don't think traps are sent in V2 format as far as I can see them in my event console (even if uncorrecly formated) and I see them all in trapd.log. BUT in my mib file these are notification-type (this is snmp V2 name for trap-type ?) and also I think I had some problem to import them with mib2trap. in nv.log not traps are discarded!

I have ethereal installed to capture traffic especially on port 162 but I don't see why to start capture at this moment as far as I'm very sure these traps are from Brocade switch ...

thanks a lot James.. as allways your response are very good!

Lucian

ps

I hope I made my self clear... :)

What you installed are just definitions for how trapd should display those traps IF he gets them.
Do you see anything at all?  I mean are there unformatted traps which say "no fmt found" or  some garbled version of what you expect?

If not, there are two possibilities.
(1) Brocade is not sending the traps.  Is there some device or software log you can look at to find out?
(2) The traps are sent in SNMP V2 format.  NetView for Windows does not display SNMP V2 traps.  It has no code to interpret them, so they will be discarded.  How can you tell if you are getting V2 traps?   Well, you might see error messages in \usr\ov\log\nv.log about traps being discarded.

Alternatively you can answer both questions in a short time by downloading a free tool off the web.  It's called the Ethereal packet analyzer and it's available from http://www.ethereal.com.  It installs easily in about five minutes.  Then you can set a capture filter for "udp and port 162" and see what is being sent to the MS Trap Service.  The packets will be nicely formatted.

James Shanks
Level 3 Support  for Tivoli NetView for UNIX and Windows
Tivoli Software / IBM Software Group

"Lucian Vanghele" <lucian.vanghele@bisnet.ro>
Sent by: owner-nv-l@lists.us.ibm.com

04/08/2004 04:22 AM

Please respond to
nv-l

To	<nv-l@lists.us.ibm.com>
cc
Subject	[nv-l] SAN switch traps

hi there list ! 

I want to send traps from a Brocade SAN switch to a windows nv 713 and
I receive allways messages like that: 

- PORT INDEX %d changed to %d Port Name: %s and SSN is #%s, GroupName %s,
GroupType %s, GroupMemPosition %d 

I'm sure I imported correctly the traps from the switch mib file so...
what could be the reason? It really doesn't help now. 

thanks 

Lucian 

Sincerely Yours / al Dvs.
Lucian Vanghele,
Senior System Engineer, Business Information Systems- BIS srl
tf./fax:+4021 255 4579

This message is strictly confidential, between the emitter's and the
addressee's companies.
It's mandatory to have the approval of the initiator, to send it entirely
or
partially, to a third company. 

Acest mesaj este strict confidential , pentru companiile emitentului si
receptorului.
Pentru a putea fi transmis, intreg sau partial, unei terte companii, este
obligatoriu a avea aprobarea initiatorului.