Support Support Downloads Knowledge Base Case Manager My Juniper Community

Knowledge Base

Search our Knowledge Base sites to find answers to your questions.

Ask All Knowledge Base Sites All Knowledge Base Sites JunosE Defect (KA)Knowledge BaseSecurity AdvisoriesTechnical BulletinsTechnotes Sign in to display secure content and recently viewed articles

Trap OIDs on NSMXpress appliance

0

0

Article ID: KB29264 KB Last Updated: 25 Jun 2014Version: 2.0
Summary:

This article describes the Objects used in trap messages from NSM appliances.

Symptoms:

Describe the traps that can be generated on an NSMXpress appliance.

Cause:

Solution:

The NSM Appliance sends only SNMP v2 traps.

The triggers for the traps generated on an NSM appliance are below:

  • Disk space low percent
  • Memory low percent
  • CPU high percent
  • NSM start/stop
  • Admin Logon/Logoff
  • External IP Unreachable

The traps generated by an NSM appliance do not contain any enterprise OID.

The format of the SNMP v2 traps is described below in snippets from RFCs:

RFC3416 (tools.ietf.org/html/rfc3416#section-4.2.6)

The first two variable bindings in the variable binding list of an SNMPv2-Trap-PDU are sysUpTime.0 [RFC3418] and snmpTrapOID.0 [RFC3418] respectively.
If the OBJECTS clause is present in the invocation of the corresponding NOTIFICATION-TYPE macro, then each corresponding variable,as instantiated by
this notification is copied, in order, to the variable-bindings field. If any additional variables are being included (at the option of the generating
SNMP entity), then each is copied to the variable-bindings field.

RFC2576 (tools.ietf.org/html/rfc2576#section-3)

SNMPv2 notification parameters consist of:
- A sysUpTime parameter (TimeTicks). This appears in the first variable-binding in an SNMPv2-Trap-PDU or InformRequest-PDU.

- An snmpTrapOID parameter (OBJECT IDENTIFIER). This appears in the second variable-binding in an SNMPv2-Trap-PDU or InformRequest-PDU.
- A list of variable-bindings (VarBindList). This refers to all but the first two variable-bindings in an SNMPv2-Trap-PDU or InformRequest-PDU.

For the snmpTrapOID (second variable-binding), the NSM appliance uses RMON trap "risingAlarm" whose Object ID is ".1.3.6.1.2.1.16.0.1" (RMON MIB- tools.ietf.org/html/rfc2819#section-5). In the third variable-binding field, the NSM appliance-generated trap contains the message describing the event that generated the trap. The object used as the variable is sysDescr (.1.3.6.1.2.1.1.1.0), and the value against it describes the event.


Examples: Traps Received from NSM Appliance for Various Events

External IP Unreachable Event

Note: The text in red is the explanation of the trap's content and not part of the trap. The blue text highlights the variable bindings of the trap and are present in the trap message.

{SNMPv2c { V2Trap(144) R=262280491
           .1.3.6.1.2.1.1.3.0=526633442 
(varBind 1 - sysUptime OID="Uptime value for snmp agent on the node")
           .1.3.6.1.6.3.1.1.4.1.0=.1.3.6.1.2.1.16.0.1 
(varBind 2 - snmpTrapOID="rmonEventsV2.risingAlarm OID")
           .1.3.6.1.2.1.1.1.0="PING: could not ping 172.30.73.214: --- 172.30.73.214 ping statistics ---" 
(varBind 3 - sysDescr OID="Message describing the event that caused trap generation") }
}


NSM Service Stop

{SNMPv2c { V2Trap(101) R=2124582316
           .1.3.6.1.2.1.1.3.0=526639488
           .1.3.6.1.6.3.1.1.4.1.0=.1.3.6.1.2.1.16.0.1
           .1.3.6.1.2.1.1.1.0="NSM status change: guiSvr: DOWN" }
}


Admin User (root) Login via SSH

{SNMPv2c { V2Trap(170) R=954123037
           .1.3.6.1.2.1.1.3.0=526639575
           .1.3.6.1.6.3.1.1.4.1.0=.1.3.6.1.2.1.16.0.1
           .1.3.6.1.2.1.1.1.0="ADMIN: Jun 23 04:22:33 walsh su: pam_unix(su:session): session opened for user root by admin(uid=0)" }
}

 
NSM Service Start

{SNMPv2c { V2Trap(99) R=68367090
           .1.3.6.1.2.1.1.3.0=526645724
           .1.3.6.1.6.3.1.1.4.1.0=.1.3.6.1.2.1.16.0.1
           .1.3.6.1.2.1.1.1.0="NSM status change: guiSvr: UP" }
}


Admin (root) Logout via SSH

{SNMPv2c { V2Trap(154) R=1879589579
           .1.3.6.1.2.1.1.3.0=526670741
           .1.3.6.1.6.3.1.1.4.1.0=.1.3.6.1.2.1.16.0.1
           .1.3.6.1.2.1.1.1.0="ADMIN: Jun 23 04:27:50 walsh su: pam_unix(su:session): session closed for user root" }
}


Low Disk Space

Note: This message indicates that the threshold for used disk space is set to 70% but the current usage is 80%.

{SNMPv2c { V2Trap(114) R=138265638
           .1.3.6.1.2.1.1.3.0=165647410
           .1.3.6.1.6.3.1.1.4.1.0=.1.3.6.1.2.1.16.0.1
           .1.3.6.1.2.1.1.1.0="Disk low: threshold 70, now 80 on /var/cores" }
}

Related Links

Comment on this article > Affected Products Browse the Knowledge Base for more articles related to these product categories. Select a category to begin.

Getting Up and Running with Junos

Getting Up and Running with Junos Security Alerts and Vulnerabilities Product Alerts and Software Release Notices Problem Report (PR) Search Tool EOL Notices and Bulletins JTAC User Guide Customer Care User Guide Pathfinder SRX High Availability Configurator SRX VPN Configurator Training Courses and Videos End User Licence Agreement Global Search