SNMP trap monitoring

Hi Jamma,

setting up snmp monitoring on the switch side is very easy. Just add the correct snmp manager hostip and set the severity level to 2(errors) or 3(warning). The command to do this is snmpconfig --set (or agtcfgset for older switches).

Setting up the monitoring with a specific monitoring framework/software is a totally different story. It all depends on which software you use.

If I remember correctly the switches send port events most of the time like port offline/online (should be swFCPort) or switch events like status down, temp/fan/power failure as swEventTrap or swFault. (I'm not really sure with that).

My recommendation would be just set up the monitoring and watch it for some days or even weeks. Then after you received some events you can implement filter rules according to your monitoring requirements.

regards,
bernd

Thanks Bernd for your reply.

We use Argent software for monitoring, but actually it isn't my job to configure/filter Argent to receive the traps. I should just figure out/guess what kind of traps are expected, and document them to be used by our 24/7 control center guys. ....so that THEY wouldn't have to go for the manuals/MIB reference guides to figure out what each Argent message is about.

Like I said, it's all quite new stuff to, and I'm having a little difficulties undestanding how to interpret these MIBs and traps.

Hi Jamma,

let's use swFault as example. The other traps are pretty much the same.

This is the definition of swFault from the Fibre Channel Switch MIB:

  swFault		NOTIFICATION-TYPE
	OBJECTS	{ swDiagResult, swSsn , swGroupName, swGroupType, swGroupMemPos }
	STATUS	current
	DESCRIPTION	"A swFault(1) is generated whenever the diagnostics
		detects a fault with the switch."
	--#TYPE		"Switch is faulty."
	--#SUMMARY	"Faulty reason: %d and SSN is #%s,GroupName %s,GroupType %s,GroupMemPosition %d""
	--#ARGUMENTS	{ 0, 1, 2, 3, 4}
	--#SEVERITY	CRITICAL
	--#TIMEINDEX	1
	--#STATE	NONOPERATIONAL
	::= { swTrapsV2 1 }

The description line tells you what this trap is about / when it is sent. With a trap so called varbinds are sent, this is the objects line. These objects (values) are sent with the trap.
The summary line shows an error message as example. Just replace all %d and %s occurences with the values of the objects line. The arguments line show in which order the objects should be placed into the above error message.
So for swFault the message would read: Faulty reason: and SSN is #,GroupName ,GroupType ,GroupMemPosition .
Keep in mind that this error message is just an example, in reality the trap only contains the numerical oid's of all the objects.
With the swFault trap the really important object is swDiagResult. When you look up swDiagResult in the mib file you see that it is an integer object with three defined values:
(1) sw-ok
(2) sw-faulty
(3) sw-embedded-port-fault

So this trap is either sent as "switch ok" or "switch faulty" message. It's a very generic trap, normally the switch would send additional traps specifying the failed component.

That is it basically. Just look at the traps and wich objects they send, then look up the objects to understand what they mean and what values they can take.

regards,
bernd

Again, big thanks Bernd! It was very informative reply...

I think I'm getting the basic principle now.

There's this one trap in the sw-mib...swEventTrap. This trap sends all (if so configured) the switch events to management station. So, there's gonna be lots of unwanted data if no filtering is done.
If I understood right, one can filter events with the event severity level -config(??) So, if I set the "Trap recipient Severity level" on switches configuration to 1(critical), the swEventTrap only sends the critical events to Argent?


Jamma

Hi Jamma,

yes, exactly. If you set the severity level to 1 only critical events are sent. If you set it to 2 error and critical events would be sent and so on.

rgds,bernd

Hi again,

I'm having a bit trouble reading this trap I received from our switch... :

------------------------------------------------
production SNMP Trap Monitor: Trap generic=6 specific=6
Enterprise Oid=.iso.org.dod.internet.experimental.94 (.1.3.6.1.3.94)
From xx.xx.xx.xx
Variable (Integer) =
.iso.org.dod.internet.experimental.94.1.10.1.7.16.0.0.5.30.6.108.195.0.0.0.0.0.0.0.0.7
(.1.3.6.1.3.94.1.10.1.7.16.0.0.5.30.6.108.195.0.0.0.0.0.0.0.0.7)
Value = 3
Variable (Integer) =
.iso.org.dod.internet.experimental.94.1.10.1.6.16.0.0.5.30.6.108.195.0.0.0.0.0.0.0.0.7
(.1.3.6.1.3.94.1.10.1.6.16.0.0.5.30.6.108.195.0.0.0.0.0.0.0.0.7)
Value = 2
Variable (String) =
.iso.org.dod.internet.experimental.94.1.10.1.17.16.0.0.5.30.6.108.195.0.0.0.0.0.0.0.0.7
(.1.3.6.1.3.94.1.10.1.17.16.0.0.5.30.6.108.195.0.0.0.0.0.0.0.0.7)
-----------------------------------------------------

It know it is one of the FiberAlliance MIB trap(?)...connUnitPortStatusChange , if I'm correct? But how should I interpret those longish OIDs? My MIB goes as far as 1.3.6.1.3.94.1.10.X .....but what do those following numbers stand for??

Thanks in advance....

Jamma

About that actual port number...

It says in the values of swFCPortIndex: "The physical port number of the switch, plus 1."

So, am I correct when asuming that in swFcPortScn-trap:
------------------------------------------
.....

Variable (Integer) =
.iso.org.dod.internet.private.enterprises.1588.2.1.1.1.6.2.1.1.7
(.1.3.6.1.4.1.1588.2.1.1.1.6.2.1.1.7)
Value = 7
....

-----------------------------------------------
... the actual physical port is 6?

Hello Bernd,

and thank you for your answer.

In fact I think I figured out what those mysterious digits are. It has something to do with the switch/ports WWN. It's something like the WWN+8 octets of 0.

I also figured that the rightmost digit would be the port number. Just wondering if the actual port number here is 6??... because I remember it saying somewhere in the MIB that the physical port number is actually the OID port index -1.(??)

But the actual analysis is that there must be something wrong about that port, because I'm getting that particular trap giving status/state-values 3/2, and then 1/3 on the next trap.

Also my enterprise specific SW-mib is giving me swFCPortScn trap for the same port.

Hi Jamma,

these are very strange OIDs indeed. I guess you are right with a connUnitPortStatusChange. Reading only the leftmost part of the OIDs would translate to this:
1.3.6.1.3.94.1.10.1.7 = connUnitPortStatus (3=ready)
1.3.6.1.3.94.1.10.1.6 = connUnitPortState (2=online)
1.3.6.1.3.94.1.10.1.17 = connUnitPortName (user defined port name, if any)

The rightmost digit is most likely the port number (7 in your case) but I have no idea what those digits in between stand for or why the switch sends them. They probably can be ignored safely but this is only my personal opinion I don't really know it.

Excellent summary!

Thank you,

Amir