Isn't it bad edicate to respond to yourself? Anyhow, I was play with the
script below
a bit and was annoyed that I could not figure out an easy way to sort
the output and
print it in reverse order! Well, I figured it out, and here it is for
your pleasure:
for i in `grep " A " trapd.log | awk '{print $8}' | sort -u`; do echo
`grep -c $i trapd.log` $i; done \
| sort -rn | awk '{print $2,$1}'
and say, for starters, you only wanted to see the first 10:
for i in `grep " A " trapd.log | awk '{print $8}' | sort -u`; do echo
`grep -c $i trapd.log` $i; done \
| sort -rn | awk '{print $2,$1}' | head
or 20:
for i in `grep " A " trapd.log | awk '{print $8}' | sort -u`; do echo
`grep -c $i trapd.log` $i; done \
| sort -rn | awk '{print $2,$1}' | head -20
You could even create a cron job and have it sent via email so you could
check it
every morning! Well maybe I am getting a bit over enthusiastic;-)
Enjoy...
Paul
Paul wrote:
Robert,
Loading the mib does not load the traps. Take a look at mib2trap. That
is a utility
that takes the traps defined and a mib and creates a series of addtrap
commands
that will add the traps to trapd.conf.
mib2trap <mibfile> <outfile>
sh ./outfile
This is how I normally add them.
The "reached the maximum number of outstanding events" is bad. Since
you have
already tried increasing the buffer space, you need to address the
core of your
problem, too many traps. Here is a quick script that will capture all
the agent traps
from NetView, then print them out:
for i in `grep " A " trapd.log | awk '{print $8}' | sort -u`; do echo
$i `grep -c $i trapd.log`; done
This should give you a fairly good idea who the problem machines are,
depending
on your environment and the size of your trapd.log, this may be a
fairly large
output, and you may want to redirect it to a file.
Paul
Robert Jensen wrote:
I am attempting to install and understand NetView (v7.14) and whilst
I have successfully installed NetView and created an MLM, I have had
a couple of concerns while configuring the product which I do not
understand that I am hoping someone may be able to assist with.
I am constantly receiving two (2) types of messages;
The first one :
Wed Jul 20 13:01:41 2005 koguxap36 ? Trap found with no known
format in trapd.conf(4) Enterprise systemsMonitor6000
(1.3.6.1.4.1.2.6.12) community public
generic trap:6 specific trap:41
Timestamp:172534392 Agentaddr:koguxap36 args(4):
[1] 1.78.86.49.48.46.53.49.46.51.51.46.49.51.54.46.50
(OctetString): smMlmAliasState
[2] 1.78.86.49.48.46.53.49.46.51.51.46.49.51.54.46.50
(OctetString): NV10.51.33.136.2
[3] 1.78.86.49.48.46.53.49.46.51.51.46.49.51.54.46.50
(OctetString): enabled
[4] 1.78.86.49.48.46.53.49.46.51.51.46.49.51.54.46.50
(OctetString): invalid
What does this mean, the MIB is loaded (as it is listed in the
trapd.conf file and via the MIB browser) yet these messages keep
appearing. Am I missing a MIB that I am not aware of ?.
Can I confirm that the MIB required here is "ibm-sysmon6k.mib" ? I
was on the understanding that it is loaded etc as part of the MLM
deployment.
nb: Via the MIB browser, I can get down to 1.3.6.1.4.1.2.6.12 BUT I
can only see trap "1" (smMlmAnalysisTable).
The second message I am constantly receiving :
1121907638 2 Thu Jul 21 11:00:38 2005 <none> T netmon-related
Application reached maximum number of outstanding events,
disconnecting from trapd
I have increased the queue from 2000 to 10000 (which only delayed the
incomming messages) and also performed a trace of "trapd" which did
not give me any clues to what is causing the "constant" stream of
messages.
I have checked the NetView archive's and can see a few instances of
this problem occurring and even a suggestion on modifying the midmand
trap destination table and filtering mechanism which allows you to
only forward you do want to trapd and throw away anything else. I
assume this is part of and located in the MLM Configuration, however
I am not sure how to set this up if this is the best way to resolve
the problem.
And finally, how can I determine (via the trace) where the
"excessive" traps are coming from so I can tweak it or stop them.
Thanks
**********************************************************************
***** IMPORTANT INFORMATION *****
This document should be read only by those persons to whom it is
addressed and its content is not intended for use by any other
persons. If you have received this message in error, please notify
us immediately. Please also destroy and delete the message from
your computer. Any unauthorised form of reproduction of this message
is strictly prohibited.
St George Bank Limited AFSL 240997, Advance Asset Management Limited
AFSL 240902, PACT Accountants Investment Group Pty Limited AFSL 240693,
St George Life Limited AFSL 240900, ASGARD Capital Management Limited
AFSL 240695 and Securitor Financial Group Limited AFSL 240687 is not
liable for
the proper and complete transmission of the information contained in
this communication, nor for any delay in its receipt.
**********************************************************************
|