LinkUp/LinkDown alert - identifying NICs

Hello

How do I know what "Port or number 25" is referring to?

The message indicates that port 25 on the server is not available. OME uses port 25 for email alerts. I would suggest checking to see if there is security software/hardware that is blocking that port on your network or server.

You can review the ports used by OME in the user's guide under:

Managing Security Settings>Supported Protocols and Ports in OpenManage Essentials>Supported Protocols and Ports on Management Stations

http://www.dell.com/support/home/us/en/04/product-support/product/dell-ome-v2.0.1/manuals

Thanks

Hi, thanks for the query.

LinkDown trap is sent by the SNMP agents sitting on the targets, like servers. A linkDown trap signifies that the SNMP entity, acting in an agent role, has detected that the operational status for one of its communication links is about to enter the down state from some other operational state (e.g. up -> down). The value (25) which is shown as part of trap details is a unique value assigned to each of the network interfaces. Again, the SNMP agent assigns this value to each of the interfaces which can further be translated to specific IP addresses (if configured).

You can refer RFC-1213 if you are interested in knowning the impacted NIC's IP address using the unique index.

Hope this information helps.

Thanks for the replies. I think Shivendra is on the right track, as the port numbers on the alerts don't match protocol ports.

How can there be so many different "links" (i.e. I get alerts for many different port numbers) when I only have two or three NICs active on the server? How do I identify the NIC that is being affected by the alert from the port number?

Just to make sure, the solution to find the IfIndex (e.g. 25) associated IP address is out of the scope of OME. It requires usage of a third party tool (like MIB Browser) or any other utility which can collect data using SNMP.

Steps are as follows:

1. Perform SNMP walk on ".1.3.6.1.2.1.4.20.1.2" OID on the target sending the linkDown alert.

2. Observe the results for ".1.3.6.1.2.1.4.20.1.2. " OID(s) in the SNMP walk output.

Result will be something similar to this:

1.3.6.1.2.1.4.20.1.2.10.10.10.1 : 5
1.3.6.1.2.1.4.20.1.2.10.10.10.2 : 1
1.3.6.1.2.1.4.20.1.2.10.10.10.3 : 2
1.3.6.1.2.1.4.20.1.2.10.10.10.4 : 6

Here, the strings appearing after ".1.3.6.1.2.1.4.20.1.2." are the IP addresses, and, the received values are shown after ":" (colon).

3. Now, pick the record that has the value reported by the alert (i.e. 25).

4. is the concerned NIC on the target machine.

From the example above, if the reported value is 2 (in the linkDown alert), then the concerned IP address is 10.10.10.3.

Let us know if this helps.

This helps!!

Thanks Shivendra :)

Thanks very much.

Shivendra,

When I do the SNMP walk as you suggested I only get three entries for the loopback, primary, and secondary NICs (ID 1, 21, and 15). However when this particular server reboots OME gives me numerous alerts with different identifiers that aren't in that list (37, 36, 35, etc).

Any ideas which OID I can look at to find all the other identifiers for the other "links"?

Hi,

Perform SNMP walk on ".1.3.6.1.2.1.2.2" OID:

a) ".1.3.6.1.2.1.2.2.1.1.x" will give the ifIndex of the interface (value in the trap).

b) Now, ".1.3.6.1.2.1.2.2.1.2.x" will give the description.

c) And ".1.3.6.1.2.1.2.2.1.3.x" will give the type.

You can correlate the above mentioned values to understand more about the concerned NIC interface.

Hope this helps!