Brian,
This is awfully hard to follow without the actual trapd.conf entry in
front of me. I realize that you have to respect privacy but then perhaps
you should make a call to Support rather than seek an answer on the list.
But here's my guess.
It looks to me like the enterprise is indeed being properly sent by
snmptrap, because what you have in trapd.log does not say "no fmt found"
or did you leave that out? The fact that the trap is formatted at all
means that trapd has caught the enterprise and matched it to an entry in
trapd.conf. If there were no enterprise being sent, or it did not match
one in trapd.conf, you'd get a NO FMT FOUND wrapper around this. Of
course, to really see what was sent you'd have to use the -d operand on
the snmptrap command and then you'd have to interpret the hex. Or turn on
the hex tracing in trapd and get a trapd.trace.
But, it appears to me that the trapd.conf entry for this trapd must say
something very close to this:
Trap: generic $G specific $S args $#: $*
in order for you to get this output:
1102082938 2 Fri Dec 03 09:08:58 2004 hostname A Trap:
generic 6 specific 2 args (2): [1] .2.11.0 (OctetString): TEST
1102082938 2 Fri Dec 03 09:08:58 2004 hostname A [2]
.2.12.0 (OctetString): TEST2
So you must be saying that after the text "Trap: " you have a $E or $e
coded in trapd.conf, and that is not being formatted, correct?
OK, but that's different from it not being sent. The former is a
trapd.conf problem, the latter is an snmptrap problem.
Try changing your trapd.conf log message statement to say the opposite of
what you had before. If it was $E (enterprise name) then change it to $e
(enterprise oid) and see what you get. If the OID works and the name
doesn't, then take a look at your enterprise definition in trapd.conf
using xnmtrap and make sure that it doesn't have any spaces in it or
preceding it.
HTH
James Shanks
Level 3 Support for Tivoli NetView for UNIX and Windows
Tivoli Software / IBM Software Group
|