Traps From Cisco Devices Not Seen

[Shane Ketterman]

Shane Ketterman [http://community.zenoss.org/people/shaneketterman] created the discussion

"Traps From Cisco Devices Not Seen"

To view the discussion, visit: http://community.zenoss.org/message/73422#73422

--------------------------------------------------------------
Hi,

As stated before, I'm fairly new to Zenoss but getting up to speed fairly quickly. 

I noticed that a lot of our cisco gear has traps being sent to Zenoss such as environmental traps, DHCP pool traps, etc.  However,  we have had several instances of switches that overheated and I could not find one single trap in Zenoss.  The device is there and we have most all of the cisco device MIBs loaded as well.  I just don't see these traps coming in and ideally I'd like to be able to have it do something such as:

1. Trap arrives
2. Event created for the device that the trap arrived from
3. Alert sent letting us know of the trap event

How does one do this and assure that traps are getting properly places with the devices and events/alerts are being created? 

Thanks for any help/advice!
--------------------------------------------------------------

Reply to this message by replying to this email -or- go to the discussion on Zenoss Community
[http://community.zenoss.org/message/73422#73422]

Start a new discussion in zenoss-users at Zenoss Community
[http://community.zenoss.org/choose-container!input.jspa?contentType=1&containerType=14&container=2003]

[jmp242]

jmp242 [http://community.zenoss.org/people/jmp242] created the discussion

"Re: Traps From Cisco Devices Not Seen"

To view the discussion, visit: http://community.zenoss.org/message/73425#73425

--------------------------------------------------------------
Are any traps coming into your Zenoss instance from that device? Are you using Zenoss 4.2.3? Do you have the severity mapping set up correctly for them? (check if they're info and the events are being hidden in the event UI). Check your zentrap logs and see if that's seeing them - probably need to enable debug logging - see the FAQs I pointed you to at zcaportal.org...

--
James Pulver
ZCA Member
CLASSE Computer Group
Cornell University
--------------------------------------------------------------

Reply to this message by replying to this email -or- go to the discussion on Zenoss Community
[http://community.zenoss.org/message/73425#73425]

Start a new discussion in zenoss-users at Zenoss Community
[http://community.zenoss.org/choose-container!input.jspa?contentType=1&containerType=14&container=2003]

[Shane Ketterman]

Shane Ketterman [http://community.zenoss.org/people/shaneketterman] created the discussion

"Re: Traps From Cisco Devices Not Seen"

To view the discussion, visit: http://community.zenoss.org/message/73429#73429

--------------------------------------------------------------
Hi James,

I checked the zentrap daemon log as I figured that would indicate if any traps were coming in but I will double-check it again to verify as I can't recall if I saw them or not.  I'll do that first.  We are using 4.2.3.  You mentioned the severity mapping beign set up.  Is this something I would set specifically for traps? 
--------------------------------------------------------------

Reply to this message by replying to this email -or- go to the discussion on Zenoss Community
[http://community.zenoss.org/message/73429#73429]

Start a new discussion in zenoss-users at Zenoss Community
[http://community.zenoss.org/choose-container!input.jspa?contentType=1&containerType=14&container=2003]

[jmp242]

jmp242 [http://community.zenoss.org/people/jmp242] created the discussion

"Re: Traps From Cisco Devices Not Seen"

To view the discussion, visit: http://community.zenoss.org/message/73434#73434

--------------------------------------------------------------
Well, not specifically... Remember that all these things after ingest are just Events in Zenoss. So it depends on what the event (if it's created) gets set to - that depends on mappings and transforms. Traps tend to specify a severity that gets mapped into the Zenoss Event severitys somewhat sanely. But if it's sent as, say, "debug", it may not show up in the default view -  check the dropdown under severity and see what's checked.

--
James Pulver
ZCA Member
CLASSE Computer Group
Cornell University
--------------------------------------------------------------

Reply to this message by replying to this email -or- go to the discussion on Zenoss Community
[http://community.zenoss.org/message/73434#73434]

Start a new discussion in zenoss-users at Zenoss Community
[http://community.zenoss.org/choose-container!input.jspa?contentType=1&containerType=14&container=2003]

[Shane Ketterman]

Shane Ketterman [http://community.zenoss.org/people/shaneketterman] created the discussion

"Re: Traps From Cisco Devices Not Seen"

To view the discussion, visit: http://community.zenoss.org/message/73436#73436

--------------------------------------------------------------
ahhh ok...I'll see if that's where they went and start troubleshooting from there because I suspect that they did show up at some point and they haven't been mapped or transformed for that matter.
--------------------------------------------------------------

Reply to this message by replying to this email -or- go to the discussion on Zenoss Community
[http://community.zenoss.org/message/73436#73436]

Start a new discussion in zenoss-users at Zenoss Community
[http://community.zenoss.org/choose-container!input.jspa?contentType=1&containerType=14&container=2003]