Note: A product listed in this article has either reached hardware End of Life (EOL) OR software End of Engineering (EOE). Refer to End of Life Products & Milestones for the EOL, EOE, and End of Support (EOS) dates.
This article describes the Objects used in trap messages from NSM appliances.
Describe the traps that can be generated on an NSMXpress appliance.
The NSM Appliance sends only SNMP v2 traps.
The triggers for the traps generated on an NSM appliance are below:
- Disk space low percent
- Memory low percent
- CPU high percent
- NSM start/stop
- Admin Logon/Logoff
- External IP Unreachable
The traps generated by an NSM appliance do not contain any enterprise OID.
The format of the SNMP v2 traps is described below in snippets from RFCs:
The first two variable bindings in the variable binding list of an SNMPv2-Trap-PDU are sysUpTime.0 [RFC3418] and snmpTrapOID.0 [RFC3418] respectively.
If the OBJECTS clause is present in the invocation of the corresponding NOTIFICATION-TYPE macro, then each corresponding variable,as instantiated by
this notification is copied, in order, to the variable-bindings field. If any additional variables are being included (at the option of the generating
SNMP entity), then each is copied to the variable-bindings field.
SNMPv2 notification parameters consist of:
- A sysUpTime parameter (TimeTicks). This appears in the first variable-binding in an SNMPv2-Trap-PDU or InformRequest-PDU.
- An snmpTrapOID parameter (OBJECT IDENTIFIER). This appears in the second variable-binding in an SNMPv2-Trap-PDU or InformRequest-PDU.
- A list of variable-bindings (VarBindList). This refers to all but the first two variable-bindings in an SNMPv2-Trap-PDU or InformRequest-PDU.
For the snmpTrapOID (second variable-binding), the NSM appliance uses RMON trap "risingAlarm" whose Object ID is ".1.3.6.1.2.1.16.0.1" (RMON MIB- tools.ietf.org/html/rfc2819#section-5). In the third variable-binding field, the NSM appliance-generated trap contains the message describing the event that generated the trap. The object used as the variable is sysDescr (.1.3.6.1.2.1.1.1.0), and the value against it describes the event.
Examples: Traps Received from NSM Appliance for Various Events
External IP Unreachable Event
Note: The text in red is the explanation of the trap's content and not part of the trap. The blue text highlights the variable bindings of the trap and are present in the trap message.
{SNMPv2c { V2Trap(144) R=262280491
.1.3.6.1.2.1.1.3.0=526633442 (varBind 1 - sysUptime OID="Uptime value for snmp agent on the node")
.1.3.6.1.6.3.1.1.4.1.0=.1.3.6.1.2.1.16.0.1 (varBind 2 - snmpTrapOID="rmonEventsV2.risingAlarm OID")
.1.3.6.1.2.1.1.1.0="PING: could not ping 172.30.73.214: --- 172.30.73.214 ping statistics ---" (varBind 3 - sysDescr OID="Message describing the event that caused trap generation") }
}
NSM Service Stop
{SNMPv2c { V2Trap(101) R=2124582316
.1.3.6.1.2.1.1.3.0=526639488
.1.3.6.1.6.3.1.1.4.1.0=.1.3.6.1.2.1.16.0.1
.1.3.6.1.2.1.1.1.0="NSM status change: guiSvr: DOWN" }
}
Admin User (root) Login via SSH
{SNMPv2c { V2Trap(170) R=954123037
.1.3.6.1.2.1.1.3.0=526639575
.1.3.6.1.6.3.1.1.4.1.0=.1.3.6.1.2.1.16.0.1
.1.3.6.1.2.1.1.1.0="ADMIN: Jun 23 04:22:33 walsh su: pam_unix(su:session): session opened for user root by admin(uid=0)" }
}
NSM Service Start
{SNMPv2c { V2Trap(99) R=68367090
.1.3.6.1.2.1.1.3.0=526645724
.1.3.6.1.6.3.1.1.4.1.0=.1.3.6.1.2.1.16.0.1
.1.3.6.1.2.1.1.1.0="NSM status change: guiSvr: UP" }
}
Admin (root) Logout via SSH
{SNMPv2c { V2Trap(154) R=1879589579
.1.3.6.1.2.1.1.3.0=526670741
.1.3.6.1.6.3.1.1.4.1.0=.1.3.6.1.2.1.16.0.1
.1.3.6.1.2.1.1.1.0="ADMIN: Jun 23 04:27:50 walsh su: pam_unix(su:session): session closed for user root" }
}
Low Disk Space
Note: This message indicates that the threshold for used disk space is set to 70% but the current usage is 80%.
{SNMPv2c { V2Trap(114) R=138265638
.1.3.6.1.2.1.1.3.0=165647410
.1.3.6.1.6.3.1.1.4.1.0=.1.3.6.1.2.1.16.0.1
.1.3.6.1.2.1.1.1.0="Disk low: threshold 70, now 80 on /var/cores" }
}
2020-10-18: Tagged article for EOL/EOE.