Discussion:
[jffnms-users] Eliminating the Cisco TTY Trap
Doug Veldhuisen
2006-01-11 19:05:06 UTC
Permalink
I have Jffnms 0.8.2 installed on a Fedora RedHat 3 system.

The system runs very well and monitors just what I need it to do. However,
could someone please tell me how to get jffnms to not look a specific trap
from cisco devices?

What I want to eliminate is the tty trap. Documentation says this is
enabled by default, but cannot find a good spot to disable it. I think the
OID = .1.3.6.1.4.1.9.0.1

I am covered in these traps and would like to drop them from existence or
could someone please tell me a way to manage them.

Doug Veldhuisen
Javier Szyszlican
2006-01-12 00:00:04 UTC
Permalink
You could create a new trap receiver (in admin/internal config/event analizer).
Match it to the 'static' Receiver command without any more parameters.

This is what I did with the TCP Port trap.

+-------+----------+-----------------------+---------------------+----------------------+-------------------------+------------------------+--------------------------+-----------------+
| ID | Position | Description | Interface Type | OID Match
| Receiver Command (file) | Parameters | Backend
| Stop if Matches |
+-------+----------+-----------------------+---------------------+----------------------+-------------------------+------------------------+--------------------------+-----------------+
| 3 | 10 | Link Down | Physical Interfaces |
.1.3.6.1.6.3.1.1.5.3 | static | down,interfacenumber,1 | Alarm
Verify Operational | X |
| 2 | 10 | Link Up | Physical Interfaces |
.1.3.6.1.6.3.1.1.5.4 | static | up,interfacenumber,1 | Alarm
Verify Operational | X |
| 10001 | 10 | TCP Port Trap | TCP Ports |
.1.3.6.1.4.1.9.0.1 | static | | No
Backend | X |
| 1 | 99 | Default Trap Receiver | No Interface Type | .*
| unknown | | Unknown Event
| X |
+-------+----------+-----------------------+---------------------+----------------------+-------------------------+------------------------+--------------------------+-----------------+


Javier
Post by Doug Veldhuisen
I have Jffnms 0.8.2 installed on a Fedora RedHat 3 system.
The system runs very well and monitors just what I need it to do.
However, could someone please tell me how to get jffnms to not look a
specific trap from cisco devices?
What I want to eliminate is the tty trap. Documentation says this is
enabled by default, but cannot find a good spot to disable it. I think
the OID = .1.3.6.1.4.1.9.0.1
I am covered in these traps and would like to drop them from existence
or could someone please tell me a way to manage them.
Doug Veldhuisen
-------------------------------------------------------
This SF.net email is sponsored by: Splunk Inc. Do you grep through log
files
for problems? Stop! Download the new AJAX search engine that makes
searching your log files as easy as surfing the web. DOWNLOAD SPLUNK!
http://ads.osdn.com/?ad_id=7637&alloc_id=16865&op=click
_______________________________________________
jffnms-users mailing list
https://lists.sourceforge.net/lists/listinfo/jffnms-users
--
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
Javier Szyszlican, Project Leader, JFFNMS
***@jffnms.org

I hope JFFNMS or I were helpful to you, if you
can, please donate at http://jffnms.org/donate
Doug Veldhuisen
2006-01-12 14:31:12 UTC
Permalink
Thank you very much, cleared up all that clutter,

Doug
Post by Javier Szyszlican
You could create a new trap receiver (in admin/internal config/event analizer).
Match it to the 'static' Receiver command without any more parameters.
This is what I did with the TCP Port trap.
+-------+----------+-----------------------+---------------------+----------------------+-------------------------+------------------------+--------------------------+-----------------+
| ID | Position | Description | Interface Type | OID
Match | Receiver Command (file) | Parameters |
Backend | Stop if Matches |
+-------+----------+-----------------------+---------------------+----------------------+-------------------------+------------------------+--------------------------+-----------------+
| 3 | 10 | Link Down | Physical Interfaces |
.1.3.6.1.6.3.1.1.5.3 | static | down,interfacenumber,1 |
Alarm Verify Operational | X |
| 2 | 10 | Link Up | Physical Interfaces |
.1.3.6.1.6.3.1.1.5.4 | static | up,interfacenumber,1 |
Alarm Verify Operational | X |
| 10001 | 10 | TCP Port Trap | TCP Ports |
.1.3.6.1.4.1.9.0.1 | static | |
No Backend | X |
| 1 | 99 | Default Trap Receiver | No Interface Type |
.* | unknown | | Unknown
Event | X |
+-------+----------+-----------------------+---------------------+----------------------+-------------------------+------------------------+--------------------------+-----------------+
Javier
Post by Doug Veldhuisen
I have Jffnms 0.8.2 installed on a Fedora RedHat 3 system.
The system runs very well and monitors just what I need it to do.
However, could someone please tell me how to get jffnms to not look a
specific trap from cisco devices?
What I want to eliminate is the tty trap. Documentation says this is
enabled by default, but cannot find a good spot to disable it. I think
the OID = .1.3.6.1.4.1.9.0.1
I am covered in these traps and would like to drop them from existence or
could someone please tell me a way to manage them.
Doug Veldhuisen
-------------------------------------------------------
This SF.net email is sponsored by: Splunk Inc. Do you grep through log files
for problems? Stop! Download the new AJAX search engine that makes
searching your log files as easy as surfing the web. DOWNLOAD SPLUNK!
http://ads.osdn.com/?ad_id=7637&alloc_id=16865&op=click
_______________________________________________
jffnms-users mailing list
https://lists.sourceforge.net/lists/listinfo/jffnms-users
--
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
Javier Szyszlican, Project Leader, JFFNMS
I hope JFFNMS or I were helpful to you, if you
can, please donate at http://jffnms.org/donate
-------------------------------------------------------
This SF.net email is sponsored by: Splunk Inc. Do you grep through log files
for problems? Stop! Download the new AJAX search engine that makes
searching your log files as easy as surfing the web. DOWNLOAD SPLUNK!
http://ads.osdn.com/?ad_id=7637&alloc_id=16865&op=click
_______________________________________________
jffnms-users mailing list
https://lists.sourceforge.net/lists/listinfo/jffnms-users
LIMA David
2006-01-13 09:20:06 UTC
Permalink
Hi Doug,

You can eliminate those traps before inserting them into JFFNMS DB

1 - At cisco stage this should work for the conf
no snmp-server enable traps tty

2 - At snmp trap daemon

traphandle .1.3.6.1.4.1.9.0.1 /bin/true

or traphandle SNMPv2-SMI::enterprises.9.0.1 /bin/true

if you didn't specify "printNumericOids yes" in /etc/snmp/snmp.conf

Cheers,


_______________
David LIMA
Professional Services
www.scc.com


_____

De : jffnms-users-***@lists.sourceforge.net [mailto:jffnms-users-***@lists.sourceforge.net] De la part de Doug Veldhuisen
Envoyé : jeudi 12 janvier 2006 16:53
À : Javier Szyszlican
Cc : jffnms-***@lists.sourceforge.net
Objet : Re: [jffnms-users] Eliminating the Cisco TTY Trap



Thank you very much, cleared up all that clutter,

Doug


At 07:59 PM 1/11/2006, Javier Szyszlican wrote:


You could create a new trap receiver (in admin/internal config/event analizer).
Match it to the 'static' Receiver command without any more parameters.

This is what I did with the TCP Port trap.

+-------+----------+-----------------------+---------------------+----------------------+-------------------------+------------------------+--------------------------+-----------------+
| ID | Position | Description | Interface Type | OID Match | Receiver Command (file) | Parameters | Backend | Stop if Matches |
+-------+----------+-----------------------+---------------------+----------------------+-------------------------+------------------------+--------------------------+-----------------+
| 3 | 10 | Link Down | Physical Interfaces | .1.3.6.1.6.3.1.1.5.3 | static | down,interfacenumber,1 | Alarm Verify Operational | X |
| 2 | 10 | Link Up | Physical Interfaces | .1.3.6.1.6.3.1.1.5.4 | static | up,interfacenumber,1 | Alarm Verify Operational | X |
| 10001 | 10 | TCP Port Trap | TCP Ports | .1.3.6.1.4.1.9.0.1 | static | | No Backend | X |
| 1 | 99 | Default Trap Receiver | No Interface Type | .* | unknown | | Unknown Event | X |
+-------+----------+-----------------------+---------------------+----------------------+-------------------------+------------------------+--------------------------+-----------------+


Javier

Doug Veldhuisen wrote:


I have Jffnms 0.8.2 installed on a Fedora RedHat 3 system.
The system runs very well and monitors just what I need it to do.
However, could someone please tell me how to get jffnms to not look a specific trap from cisco devices?
What I want to eliminate is the tty trap. Documentation says this is enabled by default, but cannot find a good spot to disable it. I think the OID = .1.3.6.1.4.1.9.0.1
I am covered in these traps and would like to drop them from existence or could someone please tell me a way to manage them.
Doug Veldhuisen

-------------------------------------------------------
This SF.net email is sponsored by: Splunk Inc. Do you grep through log files
for problems? Stop! Download the new AJAX search engine that makes
searching your log files as easy as surfing the web. DOWNLOAD SPLUNK!
http://ads.osdn.com/?ad_id=7637&alloc_id=16865&op=click
_______________________________________________
jffnms-users mailing list
jffnms-***@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/jffnms-users
--
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
Javier Szyszlican, Project Leader, JFFNMS
***@jffnms.org

I hope JFFNMS or I were helpful to you, if you
can, please donate at http://jffnms.org/donate



-------------------------------------------------------
This SF.net email is sponsored by: Splunk Inc. Do you grep through log files
for problems? Stop! Download the new AJAX search engine that makes
searching your log files as easy as surfing the web. DOWNLOAD SPLUNK!
http://ads.osdn.com/?ad_id=7637&alloc_id=16865&op=click
_______________________________________________
jffnms-users mailing list
jffnms-***@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/jffnms-users


------------------------------------------------------------------------------------------

Ce message contient des informations dont le contenu est susceptible d'être confidentiel.
Il est destiné au(x) destinataire(s) indiqué(s) exclusivement.

A moins que vous ne fassiez partie de la liste des destinataires, ou que vous soyez
habilité à recevoir le mail à leur place, il vous est interdit de le copier, de l'utiliser
ou de dévoiler son contenu à un tiers.

Si vous avez reçu cet email par erreur, merci de prendre contact avec l'émetteur.

Les opinions exprimées dans cet e-mail sont celles de l'émetteur et ne reflètent pas
nécessairement celles de l'entreprise.

Ce e-mail peut contenir des pièces jointes dont certaines pourraient contenir des virus
qui pourraient endommager votre système informatique.

La compagnie a pris toutes dispositions afin de minimiser ce risque et décline toute
responsabilité pour toute perte ou dommage résultant directement ou indirectement de
l'utilisation de cet email ou de son contenu.

Il vous appartient d'effectuer vos propres contrôles anti-virus avant d'ouvrir
la ou les pièces jointes.
------------------------------------------------------------------------------------------
Doug Veldhuisen
2006-01-13 14:34:03 UTC
Permalink
David: Thank you for the response: Tried your solutions and the only one
that works for me is the traphandle. the cisco one does not. Its an
invalid statement. Might work on newer hardware, but the stuff I have, no.

Thanks much
Doug
Post by LIMA David
Hi Doug,
You can eliminate those traps before inserting them into JFFNMS DB
1 – At cisco stage this should work for the conf
no snmp-server enable traps tty
On the version of devices I have: 2924xl, 2950's and 8510 this command is
invalid.
Post by LIMA David
2 – At snmp trap daemon
These work nicely.
Post by LIMA David
traphandle .1.3.6.1.4.1.9.0.1 /bin/true
or traphandle SNMPv2-SMI::enterprises.9.0.1 /bin/true
if you didn’t specify “printNumericOids yes” in /etc/snmp/snmp.conf
Cheers,
688041.gif
_______________
David LIMA
Professional Services
<http://www.scc.com>www.scc.com
----------
Envoyé : jeudi 12 janvier 2006 16:53
À : Javier Szyszlican
Objet : Re: [jffnms-users] Eliminating the Cisco TTY Trap
Thank you very much, cleared up all that clutter,
Doug
You could create a new trap receiver (in admin/internal config/event analizer).
Match it to the 'static' Receiver command without any more parameters.
This is what I did with the TCP Port trap.
+-------+----------+-----------------------+---------------------+----------------------+-------------------------+------------------------+--------------------------+-----------------+
| ID | Position | Description | Interface Type | OID
Match | Receiver Command (file) | Parameters |
Backend | Stop if Matches |
+-------+----------+-----------------------+---------------------+----------------------+-------------------------+------------------------+--------------------------+-----------------+
| 3 | 10 | Link Down | Physical Interfaces |
.1.3.6.1.6.3.1.1.5.3 | static | down,interfacenumber,1 |
Alarm Verify Operational | X |
| 2 | 10 | Link Up | Physical Interfaces |
.1.3.6.1.6.3.1.1.5.4 | static | up,interfacenumber,1 |
Alarm Verify Operational | X |
| 10001 | 10 | TCP Port Trap | TCP Ports |
.1.3.6.1.4.1.9.0.1 | static | |
No Backend | X |
| 1 | 99 | Default Trap Receiver | No Interface Type |
.* | unknown | | Unknown
Event | X |
+-------+----------+-----------------------+---------------------+----------------------+-------------------------+------------------------+--------------------------+-----------------+
Javier
I have Jffnms 0.8.2 installed on a Fedora RedHat 3 system.
The system runs very well and monitors just what I need it to do.
However, could someone please tell me how to get jffnms to not look a
specific trap from cisco devices?
What I want to eliminate is the tty trap. Documentation says this is
enabled by default, but cannot find a good spot to disable it. I think
the OID = .1.3.6.1.4.1.9.0.1
I am covered in these traps and would like to drop them from existence or
could someone please tell me a way to manage them.
Doug Veldhuisen
-------------------------------------------------------
This SF.net email is sponsored by: Splunk Inc. Do you grep through log files
for problems? Stop! Download the new AJAX search engine that makes
searching your log files as easy as surfing the web. DOWNLOAD SPLUNK!
http://ads.osdn.com/?ad_id=7637&alloc_id=16865&op=click
_______________________________________________
jffnms-users mailing list
https://lists.sourceforge.net/lists/listinfo/jffnms-users
--
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
Javier Szyszlican, Project Leader, JFFNMS
I hope JFFNMS or I were helpful to you, if you
can, please donate at http://jffnms.org/donate
-------------------------------------------------------
This SF.net email is sponsored by: Splunk Inc. Do you grep through log files
for problems? Stop! Download the new AJAX search engine that makes
searching your log files as easy as surfing the web. DOWNLOAD SPLUNK!
http://ads.osdn.com/?ad_id=7637&alloc_id=16865&op=click
_______________________________________________
jffnms-users mailing list
https://lists.sourceforge.net/lists/listinfo/jffnms-users
------------------------------------------------------------------------------------------
Ce message contient des informations dont le contenu est susceptible d'être confidentiel.
Il est destiné au(x) destinataire(s) indiqué(s) exclusivement.
A moins que vous ne fassiez partie de la liste des destinataires, ou que vous soyez
habilité à recevoir le mail à leur place, il vous est interdit de le copier, de l'utiliser
ou de dévoiler son contenu à un tiers.
Si vous avez reçu cet email par erreur, merci de prendre contact avec l'émetteur.
Les opinions exprimées dans cet e-mail sont celles de l'émetteur et ne reflètent pas
nécessairement celles de l'entreprise.
Ce e-mail peut contenir des pièces jointes dont certaines pourraient contenir des virus
qui pourraient endommager votre système informatique.
La compagnie a pris toutes dispositions afin de minimiser ce risque et décline toute
responsabilité pour toute perte ou dommage résultant directement ou indirectement de
l'utilisation de cet email ou de son contenu.
Il vous appartient d'effectuer vos propres contrôles anti-virus avant d'ouvrir
la ou les pièces jointes.
------------------------------------------------------------------------------------------
LIMA David
2006-01-13 15:59:01 UTC
Permalink
Hi Doug,

The problem is not related to your Hardware, the error is mine, I didn't use Cisco snmp trap for a long time. TTY traps are not in the notification-type group like others.

Cisco Snmp article explain why http://www.cisco.com/warp/public/477/SNMP/snmp_traps.html

...........................
In order to enable the router to send SNMP traps, use the snmp-server enable traps global configuration command. Use the no form of this command to disable SNMP notifications.

snmp-server enable traps [notification-type] [notification-option]
no snmp-server enable traps [notification-type] [notification-option]

In order to enable the router to send SNMP traps, issue the snmp-server enable traps global configuration command. Issue the no form of this command in order to disable SNMP notifications.

... BUT .....

Note: Not all [notification-type] options are supported on both of these commands. For example, [notification-type] x25 and teletype (tty) are not used for snmp-server enable trap. x25, and tty traps are enabled by default.

For example, in order to make a Cisco IOS Software device report only configuration, Border Gateway Protocol (BGP), and tty traps to Network Management System 10.10.10.10, issue these commands:

snmp-server host 10.10.10.10 public config bgp tty
snmp-server enable traps config
snmp-server enable traps bgp

.................

Cheers,

_______________
David LIMA
Professional Services
www.scc.com
 
 
________________________________________
De : Doug Veldhuisen [mailto:***@bartlesville.oilfield.slb.com]
Envoyé : vendredi 13 janvier 2006 17:22
À : LIMA David; Doug Veldhuisen; Javier Szyszlican
Cc : jffnms-***@lists.sourceforge.net
Objet : RE: [jffnms-users] Eliminating the Cisco TTY Trap


David:  Thank you for the response:  Tried your solutions and the only one that works for me is the traphandle.  the cisco one does not.  Its an invalid statement.  Might work on newer hardware, but the stuff I have, no.

Thanks much
Doug


At 05:21 AM 1/13/2006, LIMA David wrote:

Hi Doug,
 
You can eliminate those traps before inserting them into JFFNMS DB
 
1 - At cisco stage this should work
for the
conf

no snmp-server enable traps tty

On the version of devices I have: 2924xl, 2950's and 8510 this command is invalid.



 

2 - At snmp trap daemon


These work nicely.



 

traphandle .1.3.6.1.4.1.9.0.1
/bin/true

 

or traphandle SNMPv2-SMI::enterprises.9.0.1 
/bin/true

 

if you didn't specify "printNumericOids yes" in
/etc/snmp/snmp.conf

 
Cheers,
 
 
   _______________
David LIMA
Professional Services
www.scc.com
 
 
________________________________________
De : jffnms-users-***@lists.sourceforge.net [mailto:jffnms-users-***@lists.sourceforge.net] De la part de Doug Veldhuisen
Envoyé : jeudi 12 janvier 2006 16:53
À : Javier Szyszlican
Cc : jffnms-***@lists.sourceforge.net
Objet : Re: [jffnms-users] Eliminating the Cisco TTY Trap
 


Thank you very much, cleared up all that clutter,

Doug


At 07:59 PM 1/11/2006, Javier Szyszlican wrote:

You could create a new trap receiver (in admin/internal config/event analizer).
Match it to the 'static' Receiver command without any more parameters.

This is what I did with the TCP Port trap.

+-------+----------+-----------------------+---------------------+----------------------+-------------------------+------------------------+--------------------------+-----------------+
| ID    | Position | Description           | Interface Type      | OID Match         | Receiver Command (file) | Parameters             | Backend        | Stop if Matches |
+-------+----------+-----------------------+---------------------+----------------------+-------------------------+------------------------+--------------------------+-----------------+
| 3     | 10       | Link Down             | Physical Interfaces | .1.3.6.1.6.3.1.1.5.3 | static                  | down,interfacenumber,1 | Alarm Verify Operational | X               |
| 2     | 10       | Link Up               | Physical Interfaces | .1.3.6.1.6.3.1.1.5.4 | static                  | up,interfacenumber,1   | Alarm Verify Operational | X               |
| 10001 | 10       | TCP Port Trap         | TCP Ports           | .1.3.6.1.4.1.9.0.1   | static                  |                        | No Backend               | X               |
| 1     | 99       | Default Trap Receiver | No Interface Type   | .*         | unknown                 |                        | Unknown Event        | X               |
+-------+----------+-----------------------+---------------------+----------------------+-------------------------+------------------------+--------------------------+-----------------+


Javier

Doug Veldhuisen wrote:

I have Jffnms 0.8.2 installed on a Fedora RedHat 3 system.
The system runs very well and monitors just what I need it to do. 
However, could someone please tell me how to get jffnms to not look a specific trap from cisco devices?
What I want to eliminate is the tty trap.  Documentation says this is enabled by default, but cannot find a good spot to disable it.  I think the OID = .1.3.6.1.4.1.9.0.1
I am covered in these traps and would like to drop them from existence or could someone please tell me a way to manage them.
Doug Veldhuisen

-------------------------------------------------------
This SF.net email is sponsored by: Splunk Inc. Do you grep through log files
for problems?  Stop!  Download the new AJAX search engine that makes
searching your log files as easy as surfing the  web.  DOWNLOAD SPLUNK!
http://ads.osdn.com/?ad_id=7637&alloc_id=16865&op=click
_______________________________________________
jffnms-users mailing list
jffnms-***@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/jffnms-users
--
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
Javier Szyszlican, Project Leader, JFFNMS
***@jffnms.org

I hope JFFNMS or I were helpful to you, if you
can, please donate at http://jffnms.org/donate



-------------------------------------------------------
This SF.net email is sponsored by: Splunk Inc. Do you grep through log files
for problems?  Stop!  Download the new AJAX search engine that makes
searching your log files as easy as surfing the  web.  DOWNLOAD SPLUNK!
http://ads.osdn.com/?ad_id=7637&alloc_id=16865&op=click
_______________________________________________
jffnms-users mailing list
jffnms-***@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/jffnms-users


------------------------------------------------------------------------------------------

Ce message contient des informations dont le contenu est susceptible d'être confidentiel.
Il est destiné au(x) destinataire(s) indiqué(s) exclusivement.

A moins que vous ne fassiez partie de la liste des destinataires, ou que vous soyez
habilité à recevoir le mail à leur place, il vous est interdit de le copier, de l'utiliser
ou de dévoiler son contenu à un tiers.

Si vous avez reçu cet email par erreur, merci de prendre contact avec l'émetteur.

Les opinions exprimées dans cet e-mail sont celles de l'émetteur et ne reflètent pas
nécessairement celles de l'entreprise.

Ce e-mail peut contenir des pièces jointes dont certaines pourraient contenir des virus
qui pourraient endommager votre système informatique.

La compagnie a pris toutes dispositions afin de minimiser ce risque et décline toute
responsabilité pour toute perte ou dommage résultant directement ou indirectement de
l'utilisation de cet email ou de son contenu.

Il vous appartient d'effectuer vos propres contrôles anti-virus avant d'ouvrir
la ou les pièces jointes.
------------------------------------------------------------------------------------------
Loading...