OpenNMS 101 - Module 7: SNMP Traps Video Lecture | A Complete Guide: OpenNMS - IT & Software

hello and welcome to another episode of
open MS 101 the training course that
helps to bring you up to speed on the
open in domestic network management
platform in this lesson we're going to
discuss SNMP traps now assume you've
watched the previous lesson on SP or
you're familiar with estimate traps but
um SP and opening a message is many
things the two major things are events
from SNP which call s new traps and the
other thing is performance data
collection now this is my my system that
I've been running on my VM and if you
remember we have our node and in the
last episode we enabled SMP what's been
running for a couple of days now I can
click on resource graphs and I can look
at node level information let's say and
this will show me a nice little graph of
things like PCP errors segments context
swapping number of processes total
memory number of users interrupts etc
system uptime and this is always done
this is done automatically like I didn't
have to do anything special all I had to
do is enable SNMP and it turns out that
all this data is already pre-configured
and open in the masking with these cool
little reports that show us what's going
on with this pretty idle system there's
not much going on at all in the system
now for this lesson we want to talk
about the other half which is the events
side and so Ogun items can receive SNP
traps now unfortunately the internet
engineering task force hasn't seen fit
to require all the vendors to use a
unique event identifier so that it would
be easy to map to open in a mess so we
have to map our stuff manually and we do
that using a mask so traps will look at
certain aspects of the trap that come in
and we'll map it to an event once that
event is in open in the mess it's pretty
much the same as any other event nothing
to mess so you can do alarms you can do
notifications everything like that so um
many traps are plea to predefined so let
me go back over here to my system and
I'm going to
do a service as the TV restart yes I'm
still an old guy so I don't use much in
the way of system control which is what
I should have used there but now if I go
into my event list
I just restarted the SNMP trap daemon
and as you can see there is the shutdown
trap that comes from net SMP so when
medicine P agent shuts down it sends a
shutdown trap and then we've got this
cold start trap
now where's cold start mean if you will
actually look I assume you guys still
have your hand out so if you look at the
handout on the back page so you've got
your mix two on one side on the box page
you'll see there is all the different
commands for s computers and when
there's five of them there's a get
request get next request get response a
set and a trap
now this middle section here breaks down
the traps you identify a trap usually
with flee items first there's an
enterprise ID so the enterprise idea is
a number that defines the trap usually
traps are defined in a mid provided by
the vendor and they will set the
enterprise ID because it's a vendor
supplied mid almost all the enterprise
of eve's will start with 1.3 that 6.1.2
one that's something which if you
remember from the last lesson is our
private enterprise branch
now that next number will tell us
usually who the vendor is now the second
value so enterprise ID is the first
value the second value is the generic
type and there are a set of generic
traps out of the box 0 again this is
ordinal so 0 is cold start then this
means the SP agent was started from
scratch a warm start which is type 1 is
that the SP agent was like a warm
restarted so you could just say you did
a reload of a config or something like
that never really seen warm start on net
f2p
it's usually just cold start the next to
type 2 and type 3 are linked down and
linked up these are very very common so
if I go and unplug a cable from a switch
or a router that will usually generate a
link down
because we've lost the link light plug
it back in
that's a link-up so cold start warm
start link down link up very very common
the fourth type is annoying
it's called authentication failure trap
this is a trap that gets sent if someone
tries to access your ASP agent and they
don't have either the right community
string or they're not coming from the
right IP address what most agents will
allow you to turn this on or turn this
off I think they're on by default on a
number of agents the reason I say
they're painful is that you can get a
lot of authentication value traps and
unfortunately there's not much
information set with the trap that will
tell you what to do with them it doesn't
exactly tell you who set the traps so
you either have to put some kind of
Wireshark trace on or find out who's
doing it in many cases I say you know if
you have a lots I mean I had one
customer call us up many years ago they
said look this was a little slow and I
went in they had 2.4 million events in
their event database and 2.2 of those or
authentication failure traps so use them
at your own risk
but if you're in a small enough
environment you can find out who is
making these requests do it that's the
way to do it but if you end up having
hundreds of thousands of these your big
company's lots of people were doing
monitoring they may be talking to your
equipment without the proper credentials
you may just want to disable them so the
next one type 5 is EGP neighbor loss
I've never seen it
I can probably look it up and find out
what it is obviously it's a neighbor
connection loss of some sort I don't
know why that rates one of the you know
7 generic types but it does the one we
see most often is a generic type of 6
which is enterprise specific so you have
an enterprise ID and an enterprise
specific value of a generic value of 6
says this trap came from an enterprise
mint so third credential we use to
identify trap is a specific number so if
an enterprise does send a trap it has
the ability to put a specific number
and these are defining a myth you don't
you don't have to like make things up
but they should be defined in a mid
somewhere and when they are what you can
do is um put them in open an MS event so
a specific type of type of one might be
a down like a discus down an array and
then the type of two would be that hey
its back it's six to get things like
that
there are also variable bindings it is
possible to send variables with the
traps and sometimes you have to look at
those to determine exactly what's going
on with the trap but every trap should
have an enterprise I'd be a generic
value and a specific value so moving
forward and get back to my slides here
so here's how we send a trap
okay so smv trap - v1 - feed public so
let's start with that
I'm going now SNP trap if you actually
just run it
SNP trap is in that net SP tills package
that we installed in last module it's in
the SNMP package on UNIX I mean on
Ubuntu and Debian machines but it's it
on CentOS and Red Hat machines it's in
the net SP utils package and what we're
going to do is run a semi trap so we'll
do SP trap - version 1 XE public you use
community strings when you send traps
now we usually talk about community
strings when we're trying to query an
agent but you can actually limit who can
send traps like that the agent has to
have a community string in order to send
traps open in term as pretty much
ignores that so there's no configuration
or anything which you have to do you can
simply just put in public which is what
I do so that's pretty easy we're going
to send a version 1 trap and we're going
to set the community name to public now
this one 27001 is the destination so
we'll send it to local host so 127 go
those one is the destination and then we
have to put in the enterprise ID now in
this example I just may
so if you remember from the last lesson
our there's about forty nine thousand
five hundred different enterprise IDs
and so I just made up 99.9999 there will
be a while before I think we we have a
hundred thousand enterprise agree so I
just knew I made it up and I just made
up dot two I just made it up again if
you actually have a myth like opening a
mess has a move and there are traps to
find the net nib will actually define
what the the enterprise ID is there but
for this example I'm just I just want to
spend something about what about three
to six dot one dot 4 dot one that's
private enterprises one nine nine nine
nine nine is a baaad nines as what I
just made up and then to I just decided
to make a tube as a type of trap now
this is usually a class this enterprise
ending user if we're going to class of
traps and we want to use the specific
value to differentiate between the two
now this localhost here is the source of
the trap so I'm going to put in
localhost this is just a field that f2p
send espy trap requires and then the
next two numbers are the generic value
and the specific value so we'll have a
generic value of six a specific value of
one so again the generic value of six is
enterprise specific the value of one is
just something I made up and then I put
these two little ticks I'm not again I'd
have to look in the S&P trap they're
just required into little ticks as a
placeholder now if I sent this in it
would send a trap so I'm just going to
get boom I just sent a trap in and now
if I go to my events and you'll see I
got a new message here this event 169 in
my system so it was an uninterpreted
fault trap now this is slightly
different than the default event we got
with the ue y su way back in lesson
three if we just send the ue i in using
the same event script that hits the
default but we know a little bit more
about this we know there's SNMP data
associated with this
and so this is why I gets assigned the
enterprise default UEI
and not just the generic default event
UVI now I'm going to go back here I want
to show you one last thing
you can add variable bindings so I'm
going to again this should be defined
somewhere but I'm just gonna make up one
now one that's ready to loop I screwed
that up and I'll eventually that six got
one that's we that's one times three
that's six dot one dot 4 dot one so left
off Department events that one that is
at 6.1 that 4.1.1 i99 and I'm putting
that as dot one this is my variable
binding and again the this is 3.1 which
I'm adding here in a normal mid that is
a real mid it would be defined and it
would represent something in this case
it's going to be a reason it's we're
going to have a reason code and in this
so it's going to be a string so I'll use
a type of s and then I'll put they be
board what we're going to do is we're
going to use this trap to represent that
the classroom is in a mood so I used to
do this with with beer but when you
there's certain countries you go to
where alcohol is is socially forbidden
and so I wanted to do some more generic
so again the class is happy the class is
unhappy the classes is moody the class
is joyful we're just going to work and
work with that analogy so I'm going to
send this event in and as you see it
will also generate we haven't defined it
anywhere so it will also generate a
Enterprise to fall to bed if I click on
this event 170 you'll see the assault
event format was used with an enterprise
specific event trap is received with no
configuration and the enterprise idea is
that one that's free def 6.12 4.1 nine
nine nine nine nine to generic value was
six specific values one and it sent one
argument one variable binding dot one
dot 306 that one to 401 that 99.3 that
one and it's a string with that reason
okay now this is very very helpful it'll
say now what you should do is if you are
getting unformatted traps what you
should do is actually go and find the
vendors nib and import the mid in the
open ms will have a lesson on just doing
that importing and dealing with nib
files but for now if you wanted to you
can take our normal event like we had
with our class happiness event or a
class unhappiness event and you can add
what's called a mask and in that mask
you define what the enterprise ID is
with a generic value is and what's a
specific value is that's all the import
does with a mid file is it looks through
the mid file finds this information and
not American puts it in this format but
we do try to be helpful in the fact that
in the event text itself we will show
you what mask is required to match this
event and this is in the case if you if
you if you can't find a myth I have a
Xerox printer right there and one of the
problems it has is it's sending me a
trap I cannot find the nib form so I
don't know what the event means so I
could define it here and just put I
don't know what this means and it gets
it out of my enterprise default queue
what I try to do when I do consulting
for open in the mess is I will look for
this event and try to configure all of
them so that we don't get enterprise
default events and every time we do a
release we tend to add a lot more of it
a lot more event definitions as well so
we could do that now so formatting the
SNP traps it's just like um an event
except we're going to add that mask so I
have a file now called class event stub
XML again you can type these files in
but I was thinking you might not want to
do that so if you go to www.hsn.com also
I like looking at the source because
it's a little bit easier for me to read
and so here's our happiness event here's
our other happiness event these are the
ones that we've had since lesson three
and as you can see there's the event tag
there but then we define the ubi now
we're adding a couple more events so
we've got this event here and here's the
mask so here's the enterprise ID that
we're trying to match the generic value
we're trying to match in the specific
value and one if all three of these
match we are going to assign the uei of
moody at the open MS class is moody and
then we're going to print in the log
message of the reason which is going to
be that parameter one which goes back to
our detail here so this is going to
print out the reason now first match
wins so when we actually go through this
file so you'll have this ID you'll have
the ID generic value specific value of
one first match wins so sometimes I'll
actually leave one mask which just has
the enterprise ID in it which may say so
I could say oh this is a Cisco event or
this is an HP undefined event um quite
often you can add um into this mask you
can also add variable bindings a lot of
vendors will have a down event and an up
event so trap will get sent when say
temperatures are treated and another
trap will get said when the temperatures
back to normal
those are easy to deal with however
sometimes they'll have a status change
event like disk status change and you'll
have to dig into the variable binding to
determine what the status is did it go
from down to up which is good I don't
need to do anything or did it go from up
to down which is bad well you can define
in your mask um you can add variable
bindings as well so you can say if this
ID matches
if this generic value matches or the
specific value matches and this VAR bind
says the current status is down well
that's a uei of a Down event and then
you can do the same where you have the
same ID say
generic values a specific value but a
different bar by match for the up event
and just I put those in order when I
make my file I put those first and then
I might have one without any variable
bindings because maybe that's the status
I don't know about so I'll still get a
formatted event but I'd say this has an
unknown status because it didn't match
any of the known statuses that I've
predefined in France okay so so anyway
what we are going to do is we're going
to go to this file and again what I tend
to do is I just right mouse click on it
choose copy link location and then I
jump back to my command line and I'm
going to go into the events directory
and I'm going to do a double you get -
capital n so it'll overwrite the
existing classes in file and but I've
got my class event file downloaded if I
actually look at that file you'll see
that the new events are in there and now
remember I have to do that reload demon
can sake so I will type in my sin event
reload demon config for event B which
lets open an MS no to go look at that
file it doesn't scan continually to see
if the files have changed so once you
want you so you can edit your file and
go to lunch and come back and not do
anything until you send this event or
until you restore open MS it won't be
read so you can make sure everything is
exactly the way you want it before you
do it so now here's the down trap and so
here's my ID again I made up the numbers
it has generic value of 6 or specific
value of one for my up trap same thing
same ID same made-up ID same generic
value 6 but a specific value of 2 so
specific value of 1 is the down trap
specific value of 2 is the up trap now I
can go back to my screen and when I send
my event lets in the same event that I
said before
[Music]
I can go and see them now and you'll see
there's a a warning level event that
says open a message moody and the reason
is baby board again this is just an
example and you'll get more useful
things out of nib files themselves but
this is trying to tell you kind of how
we take SMT traps and convert them in
you reaiize we do the same thing for any
source like syslog syslog of course
doesn't have an enterprise ID in a
specific value a generic value they have
basically strings and we use regular
expressions and so we say if this six
log comes in and it matches this regular
expression then assign it to CBI so you
can think so
Yui is the unique event identifiers
identify internal open earnest events we
need send event to send those in but if
we get external events such as traps or
sis logs then we have to convert them to
an event which has a UV I to make them
useful now demonstrate the up event when
I teach this class we usually do this on
pizza day so I put that pizza so this is
the up event so I'm just going to change
the specific value here to till you see
the difference everything is the same
except so we've got this generic value
this ID generic value of six specific
value of one for the down to for the up
so when I send that in and refresh
you'll see I've got a normal event class
has pizza now again I could I could add
alarm data to these traps that I can
match this as and up with the down with
the Moody and do things like that
so now that I have this event in
everything that I've done with events
before such as send notifications and
dual arms I can do with traps kind of
cool calm so we do have other event
sources so we have sent event for normal
events we have SNMP traps we do syslog
we have transaction language one which
is the telephony protocol we have a few
examples of that where we'll actually
with TL one you have to connect to a
machine and look at a list of events and
then return those
in a mess but we do have the ability to
do that as well so we generated the
Moody trap which was this first event
here we generated a joyful trap both of
those showed up as unformatted we
downloaded or a class event XML file
which had that mask in it and then now
we have their formatted so play with
this so free to add other variable
bindings you can change the text you can
do lots of cool things but that's
basically us to be trapped now we will
be revisiting these in in another lesson
so I hope that you guys are following
along again I have a VM that does these
for me and here I just put all these
commands in here just so you have a
reference so again remember this
specific we just randomly decided that
its value one would be the down event
and it's a surprise
two would be the up event these will
usually be defined with your equipment
vendors and then we demonstrated what it
was like to have a variable binding as I
said compared to the last lesson which
was rather long this is a little bit
more involved but I hope that this
serves as good a good introduction to
SNP traps and join us again for the next
lesson again we are building all this
stuff so if you remember we started off
with an overview of open and a mess and
we installed it and we created our own
users and then we did events and
notifications and we did alarms and then
we talked about SNMP and now we've done
that sticky traps and we're just going
to build on this in the next lesson
we're going to talk about service
monitoring so we're finally going to get
to that last little section of open and
amass service monitoring anyway I hope
you guys found this useful
and see you next time