This is a very brief response as I rush to go pack for a flight... You mention that you browsed the MIB. This tool works directly with the file MIB.TXT and thus contains no information about traps (which are all contained in traps.txt). I find that the browse tool is useful when you want to create an event which will (say) capture all traps that come from Microsoft. Pick from the tree and get "1.3.6.1.4.1.311" which is very generic but which won't end up matching against Novell or any other traps.
Given the rest of what you have said I would recommend trying the Autofill feature to help define your events... because that takes away all the worry of instances, etc. Mark Symons Ipswitch, Inc Augusta GA -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of [EMAIL PROTECTED] Sent: Friday, February 28, 2003 10:18 To: [EMAIL PROTECTED] Subject: RE: [WhatsUp Forum] Pruning Notification from "Annoying" traps Actually, Mark, I created that name myself (CleverSoft-Candle-6.6). That name in the trap message is actually the DISPLAY NAME that I gave it. I know that because in further testing, I had recreated an SNMP trap under the name csc66 and csc66 would then show up in the same location in the SNMP trap message. Here's what I did: imported the CleverSoft MIB to WUG EVENTS LIBRARY-SNMP TRAPS didn't see specific CleverSoft entries in there so I created new entries for the trap numbers that I wanted, based on what I see for trap messages coming from my Notes servers in the activity log there are 6 specific CleverSoft-Candle SNMP traps that I want to notify on (6.1 thru 6.6) And my Notes engineers told me which which servers (devices in WUG) to configure for 6.1 and 6.6, and which servers to configure for all 6 of them so in creating a new one, I'd name it CleverSoft-Candle-6.1 and on down the line...... then I chose 6 Enterprise Specific under GENERAL TYPE then under ENTERPRISE/OID I browsed the MIBs to CleverSoft-IntelliwatchMonitor-iwtrap selections under iwtrap were trapString, trapNumber and trapServer I chose trapNumber, but there is no further drill-down to pick a specific trap or number so with the OID I get when selecting trapNumber, I decided to put 1 in the INSTANCE field for CleverSoft-Candle-6.1 then I did the same procedure for creating 6.2 thru 6.6 (putting 2,3,4,5,6 in the INSTANCE field for each one) I'm not too sure about how I went about that, so that's when I decided that I'd try to just capture a text string in the traps and try to set up SNMP trap notification based on the text string. I'll try to make some sense with what you said below, but if you (or anybody else in the forum) could offer any further clarification, based on what I said above, then I'd appreciate it. Thank you........ Chris Powers Systems Engineer MCSE, CNA, Network+, A+ Keane IT Technical Services "Mark Symons" <[EMAIL PROTECTED] To: <[EMAIL PROTECTED]> > cc: Sent by: Subject: RE: [WhatsUp Forum] Pruning Notification from "Annoying" [EMAIL PROTECTED] traps switch.com 02/27/2003 05:11 PM Please respond to WhatsUp_Forum Chris, The fact that your log contains "CleverSoft-Candle-6.6" (instead of a raw OID) indicates that you have already got the appropriate MIB compiled into MIB.TXT/TRAPS.TXT. Thus, the appropriate event should already be listed in your event library. All you then have to do is associate it with the device on the map that will generate the event. If you want to create the event definition from scratch then the easiest way is to use the Autofill feature - seeing as how you've already got a log entry for the trap that you are interested in. This would involve pasting the log line into the "New SNMP Event" dialog. This autofills the OID and Major/Minor type fields for you. Once this is done there would be no need to bother with a payload check unless there was something else that needed to be tested for. For instance, one could have a trap from an environmental monitor where the payload check could examine the temperature - data which is not part of the OID of the trap. One observation... if you do create payload checks then bear in mind that they use regular expressions. The dot in "CleverSoft-Candle-6.6" is a regex metacharacter that means "any character". So you would also get a match against (say) "CleverSoft-Candle-6a6" Of course, it's not likely that you will get a false match in reality for such a long string. Mark Symons Ipswitch, Inc Augusta GA -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of [EMAIL PROTECTED] Sent: Thursday, February 27, 2003 10:58 To: [EMAIL PROTECTED] Subject: RE: [WhatsUp Forum] Pruning Notification from "Annoying" traps Hi, people. Ever since my SNMP traps notifications started failing, I have been unable to successfully get them back in normal working order again. I even did a complete re-install of WUG. At any rate, I want to try capturing SNMP traps by searching for a particular string in the trap message. Here is a test SNMP trap generated on one of our Notes servers. 20020227 103815 EVENT SNMP Trap/Unsolicited 192.168.66.21 Trap(CleverSoft-Candle-6.6) trapString.0="test from adminhub01" trapNumber.0=6 trapServer.0=ADMINHUB01/Keane Addr:192.168.66.21 Int:6 Int:6 Tick:"12 days 08:10:43" So, I go into NEW SNMP TRAP EVENT I give it a display name of CSC6.6 under Payload, I add the string CleverSoft-Candle-6.6 to the MATCH ON box that's with no parentheses or quotation marks........CleverSoft-Candle-6.6 I then add the new SNMP trap event to the device I then add the new SNMP trap event to the device's notification to the Notes pager Question: Should this work, as I've configured it above? Did I select a valid string of chars from the actual SNMP message above? Thanks.......... Chris Powers Systems Engineer MCSE, CNA, Network+, A+ Keane IT Technical Services Please visit http://www.ipswitch.com/support/mailing-lists.html to be removed from this list. An Archive of this list is available at: http://www.mail-archive.com/whatsup_forum%40list.ipswitch.com/ Please visit http://www.ipswitch.com/support/mailing-lists.html to be removed from this list. An Archive of this list is available at: http://www.mail-archive.com/whatsup_forum%40list.ipswitch.com/ Please visit http://www.ipswitch.com/support/mailing-lists.html to be removed from this list. An Archive of this list is available at: http://www.mail-archive.com/whatsup_forum%40list.ipswitch.com/
