We had considerable troubles with Macafee IDS sensor mibs, and I gave up.
The smnp varbind contents that was sent in the SNMP payload rarely matched
what was documented in the actual mib, and made it impossible for me to code
anything. You may want to look at the contents of trapd.log, and trace it
them back to through the mibs to see if this is indeed the case.
We ended up setting up syslog from the ids sensors to send to a syslog
server and used tecadapter to scrap and sending interesting alerts to tec.
I kind of sense a pattern here that the vendor as popular as it is does not
spend resources on manageability or want them to use their point solutions.
-----Original Message-----
From: nv-l-bounces@lists.ca.ibm.com [mailto:nv-l-bounces@lists.ca.ibm.com]
On Behalf Of James Shanks
Sent: July-21-08 9:32 AM
To: Tivoli NetView Discussions
Subject: Re: [NV-L] Mcafee 'trap found with no known format' -
NaiComplete.mib
To open a problem with NetView Level 2 you would follow the procedure that
all IBM customers follow in your local community. There is one standard
phone number and one e-mail address for all IBM products. I cannot tell
you what that is in the UK, but your IBM sales team surely knows it. And
if you do not have a service agreement, the call will confirm that. Who
knows? You might be pleasantly surprised.
I suggested that you call service because getting "No FMT found" in
trapd.log, after you have run mib2trap on the MIB and then run the output
addtrap script to add these traps to trapd.conf, indicates there is an
mismatch between what's in the MIB and what the agent is actually sending.
You can correct this manually, as Shawn suggested. The "No FMT found"
message in trapd.log will tell you the enterprise id, the specific trap
number, all the varbinds sent with the trap, and their contents. That's
enough to construct your own definition using xnmtrap.
I sent you to Level 2 because just starting out with NetView can be
daunting, and they are well -equipped to handle all kinds of newbie
questions and issues. It's one of the things they do best.
James Shanks
Level 3 Support for Tivoli NetView for UNIX and Windows
Network Availability Management
Network Management - Development
Tivoli Software, IBM Corp
Greg Chown
<greg.chown@uk.ib
m.com> To
Sent by: nv-l@lists.ca.ibm.com
nv-l-bounces@list cc
s.ca.ibm.com
Subject
Re: [NV-L] Mcafee 'trap found with
07/21/2008 03:49 no known format' - NaiComplete.mib
AM
Please respond to
Tivoli NetView
Discussions
<nv-l@lists.ca.ib
m.com>
Thanks for your responses!
Sean - Netview (V7R1) is running on AIX 5.3.
James - Forgive my perpetual ignorance! - how do I get in touch with
Netview Level 2? I'm not sure we have any support in place for this
product, due to its age and lack of relative importance (pah!!) in what we
do... Will they not talk to me without a support agreement?
I'll do the tracing you suggested in the meantime.
Thanks again,
Greg
_________________________
Greg Chown
TP Developer / Infrastructure Specialist
RAF LITS
External: +44 (0) 1438 769 074
Internal: 449 074
email: greg.chown@uk.ibm.com
IBM Global Services
Unless stated otherwise above:
IBM United Kingdom Limited - Registered in England and Wales with number
741598.
Registered office: PO Box 41, North Harbour, Portsmouth, Hampshire PO6 3AU
_______________________________________________
NV-L mailing list
NV-L@lists.ca.ibm.com
Unsubscribe:NV-L-leave@lists.ca.ibm.com
http://lists.ca.ibm.com/mailman/listinfo/nv-l (Browser access limited to
internal IBM'ers only)
_______________________________________________
NV-L mailing list
NV-L@lists.ca.ibm.com
Unsubscribe:NV-L-leave@lists.ca.ibm.com
http://lists.ca.ibm.com/mailman/listinfo/nv-l (Browser access limited to
internal IBM'ers only)
No virus found in this incoming message.
Checked by AVG.
Version: 7.5.524 / Virus Database: 270.5.3/1565 - Release Date: 21/07/2008
6:36 PM
No virus found in this outgoing message.
Checked by AVG.
Version: 7.5.524 / Virus Database: 270.5.3/1565 - Release Date: 21/07/2008
6:36 PM
_______________________________________________
NV-L mailing list
NV-L@lists.ca.ibm.com
Unsubscribe:NV-L-leave@lists.ca.ibm.com
http://lists.ca.ibm.com/mailman/listinfo/nv-l (Browser access limited to
internal IBM'ers only)
|