SNMP Traps handling
-
Hi!
-
Looks like you need to create filtering script to perform additional filtering when creating alarms from traps. If you can tell me how important traps can be distinguished from non-important (probably different message text or error code, etc.), I can help with filtering script creation.
-
Most likely you have incorrectly configured alarm key. Ensure that it includes unique node ID (macro %i), or make it empty to disable alarm duplication checking at all.
Best regards,
Victor -
-
Hello Victor,
1)important traps contain in message text this string "ALARMA" and all others doesn't contain. I don't know which is the error code in SNMP trap or if it is different for different alarms but I can program the radio equipment to put that string in SNMP traps that I'm interested, so we can look for that.
2) If I'm not using an alarm key then I'm flooded with alarms because it seems that all SNMP traps that are coming from equipments are coming with same trap OID .1.3.6.1.4.1.2509.8.21.3.1, so now i'm using macro %i as alarm key and right now it logs alrms from diferent equipments but for the same equipment not (for example I get an important alarm from equipment A and after that I get a non-important alarm from the same equipment A and this last alarm is logged over the first one and I lose the important one). Anyway after I have the filtering script I think that I can use an empty alarm key because then I can filter the alrms using that filter.Many thakns for your prompt answer,
Best regards
Calin -
Hi!
In that case filtering script could be very simple - you just need to filter out all events which does not contain string ALARMA in text message. Assuming that you have extracted message into event parameter number 2, you need the following filtering script:
return $2 like "*ALARMA*";or, using regular expressions
return $2 match ".*ALARMA.*";Best regards,
Victor -
Hi Victor,
I added in Event Processing Policy Editor in script field both
return $3(because this is the parameter used in sys log praser to send the text contained in the SNMP trap) like "ALARMA"
and
return $3 match "ALARMA"
but it doesn't works. Is it something that maybe I missed? For example you put some strange characters in syntax form 1 before and after string ALARMA and the same characters plus point sign in syntax form 2. Are these necessary?
Thank you,
Best regards,
Calin -
Hi Victor,
I think that the strange character is the asterisk character that means everything, but I still don't understand the point sign before and after asterisk in syntax form 2.I tried also the sintax
return $3 like "*ALARMA*"
But still doesn't work.
Thanks,
Looking forward for your help -
Hi!
Yes, * character means "everything" - you need this if your message contains string ALARMA and not equals to it. About syntax - did you enter script exactly as I write it, with semicolon at the end? Otherwise it will fail with syntax error.
Best regards,
Victor -
First time I missed semicolon but I had no error. I tried also with semicolon, had no error but is not filtering.
I also tried someting like:
sub main()
{
if ( $3 match "ALARMA")
return true
else
return false
}
but still no result.
It is correct the place where I put the script?(Event processing policy editor - Script)
I don't have any idea now. What else can I try?
Thanks,
Calin -
Could you please send me screenshots of your trap configuration, event configuration, rule in event processing policy, and record in SNMP trap log?
Best regards,
Victor -
Victor,
attached you can find the screen shots that you asked.
One question please, as long as I was not able to execute comands or scripts from Actions section in your program could be there any connection with the present situation ? I tried a simple command like "cmd.exe /C "mplay32"" and even it seems that is fine is not working.I tried to put the same command in a bat file and add that bat file in actions and still not working even if everything is fine (I read all your post on the forum regarding this subject and follow the recomandations). Anyway doesn't matter, I was just asking if can be any connection between the present situation and that situation as long as your program should execute/interpret some syntax/command.
Thanks,
Best regards,
Calin
-
-
-
-
Hi!
As I can see from your config, you extract only one varbind from SNMP trap - with OID .1.3.6.1.4.1.2509.8.21.2.2.1.7. Value of this varbind will become event's parameter number 2, as you can see from column "No." in trap configuration's "Parameter buindings" list. But, in your event configuration and event processing policy you refer to parameter number 3 (by using macro %3 and variable $3 in script), which will always be empty string, because you don't extract anything else from trap. If you change $3 in your script to $2, it should start working.
Also, why you are using syslog parser? Do you receive anything via syslog as well?
Best regards,
Victor -
@calin.sarac said in SNMP Traps handling:
One question please, as long as I was not able to execute comands or scripts from Actions section in your program could be there any connection with the present situation ? I tried a simple command like "cmd.exe /C "mplay32"" and even it seems that is fine is not working.I tried to put the same command in a bat file and add that bat file in actions and still not working even if everything is fine (I read all your post on the forum regarding this subject and follow the recomandations).
If you are running NetXMS server as a Windows service, you will not see any GUI for the programs started by the server. If you really wish to see GUI program started by the server, you should turn on "Allow service to interact with desktop" in NetXMS Core service properties. For simple tests, I recommend you to start simple program or bat file which writes something to some file, and check content of that file.
Best regards,
Victor -
Hi!
As I can see from your config, you extract only one varbind from SNMP trap - with OID .1.3.6.1.4.1.2509.8.21.2.2.1.7. Value of this varbind will become event's parameter number 2, as you can see from column "No." in trap configuration's "Parameter buindings" list. But, in your event configuration and event processing policy you refer to parameter number 3 (by using macro %3 and variable $3 in script), which will always be empty string, because you don't extract anything else from trap. If you change $3 in your script to $2, it should start working.
Also, why you are using syslog parser? Do you receive anything via syslog as well?
Best regards,
VictorFirst of all I changed $3 with $2 and it seems that it works.
Now regarding the syslog parser, the situation is like this. In one moment in the past I was not able to get alarm message in Alarm Browser. So as long as I didn't find in the documentation which files ar processed by syslog parser
I suposed that the syslog parser process the default logs (like SNMP Trap log) and there for I tried to extract from SNMP Trap Log the message that contains string "201" and all that next (this because I observed that all messages contains the yaear 2010 or 2011), and for some reasons I belived that it really works. It is obviously that I was wrong. So now, what files are processed by syslog parser or which is the syntax that indicates the the file processed.
Anyway, problem solved,
Thanks a lot,
Calin -
@victor said in SNMP Traps handling:
@calin.sarac said in SNMP Traps handling:
One question please, as long as I was not able to execute comands or scripts from Actions section in your program could be there any connection with the present situation ? I tried a simple command like "cmd.exe /C "mplay32"" and even it seems that is fine is not working.I tried to put the same command in a bat file and add that bat file in actions and still not working even if everything is fine (I read all your post on the forum regarding this subject and follow the recomandations).
If you are running NetXMS server as a Windows service, you will not see any GUI for the programs started by the server. If you really wish to see GUI program started by the server, you should turn on "Allow service to interact with desktop" in NetXMS Core service properties. For simple tests, I recommend you to start simple program or bat file which writes something to some file, and check content of that file.
Best regards,
VictorI turned on "Allow service to interact with desktop" but still no result. I'm missing something but not sure what.
Thanks a lot
Calin -
Did you try console programs as well (something very simple like cmd /c echo test > c:\test.txt)?
-
Yes I tried, but nothing. Please take a look at attachements if you have time and tell me where I'm wrong.
-
-
@calin.sarac said in SNMP Traps handling:
Yes I tried, but nothing. Please take a look at attachements if you have time and tell me where I'm wrong.
In action configuration, backslash character (\) is an escape character, so if you need it in resulting string, you should use two backslash characters. So, in your case you must write
cmd /c "echo test > c:\\test.txt"Best regards,
Victor
Hello! It looks like you're interested in this conversation, but you don't have an account yet.
Getting fed up of having to scroll through the same posts each visit? When you register for an account, you'll always come back to exactly where you were before, and choose to be notified of new replies (either via email, or push notification). You'll also be able to save bookmarks and upvote posts to show your appreciation to other community members.
With your input, this post could be even better 💗
Register Login