[opennms-discuss] Event Config-How to parse SNMP trap variable OID for severity?

[Daniel.Hellquist]

Hi,
I need to integrate a tricky trap (much dynamic data in variable OIDs) that
gives also the severity dynamically, as the last digit in one of the
variable OIDs (not to confuse with the trap OID). And of course I want
OpenNMS to show the severity that came with the trap. And of course there is
only one trap OID. :)

[Seibold, Michael]

Hi Daniel,

search the archive for brocade traps - we have a similar problem and got some hints to solve it using the translator, but didn't finish the work up to know. If you find a better way than described there please let us know.

- Michael

CeBIT 2013 - Besuchen Sie uns: Halle 9, Stand G20/1

-----Ursprüngliche Nachricht-----
Von: Daniel.Hellquist [mailto:***@gmail.com]
Gesendet: Freitag, 1. Februar 2013 02:16
An: opennms-***@lists.sourceforge.net
Betreff: [opennms-discuss] Event Config-How to parse SNMP trap variable OIDfor severity?

Hi,
I need to integrate a tricky trap (much dynamic data in variable OIDs) that gives also the severity dynamically, as the last digit in one of the variable OIDs (not to confuse with the trap OID). And of course I want OpenNMS to show the severity that came with the trap. And of course there is only one trap OID. :)

[Markus Neumann]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Post by Seibold, Michael
Hi Daniel,
search the archive for brocade traps - we have a similar problem and got some hints to solve it using the translator, but didn't finish the work up to know. If you find a better way than described there please let us know.
- Michael
CeBIT 2013 - Besuchen Sie uns: Halle 9, Stand G20/1
-----Ursprüngliche Nachricht-----
Gesendet: Freitag, 1. Februar 2013 02:16
Betreff: [opennms-discuss] Event Config-How to parse SNMP trap variable OIDfor severity?
Hi,
I need to integrate a tricky trap (much dynamic data in variable OIDs) that gives also the severity dynamically, as the last digit in one of the variable OIDs (not to confuse with the trap OID). And of course I want OpenNMS to show the severity that came with the trap. And of course there is only one trap OID. :)

[Alejandro Galue]

Hello Daniel,

I believe that the following information might help:

http://www.opennms.org/wiki/Trap_Configuration_How-To#Filtering_on_varbinds_.28OpenNMS_1.10_and_beyond.29

The idea is to create several event definitions based on the value of %parm[name-#4.-1]% using a varbind filter.

Hope that helps.

Alejandro.

Post by Daniel.Hellquist
Hi,
I need to integrate a tricky trap (much dynamic data in variable OIDs) that
gives also the severity dynamically, as the last digit in one of the
variable OIDs (not to confuse with the trap OID). And of course I want
OpenNMS to show the severity that came with the trap. And of course there is
only one trap OID. :)
varbind 5
OID : ituAlarmProbableCause.<MODULE NAME>.<ERROR CODE>.<SEVERITY>
Value: INTEGER (Probable Cause)
OpenNMS: 1.11.4-SNAPSHOT
It works fine to pick the number, decode it and show it in eg logmsg. I use
%parm[name-#4.-1]% and
<varbindsdecode> for that.
My problem is that I can't mask on %parm[name-#4.-1]% (or have found other
way) which could have fixed it by defining multiple events as described in
many places.
Help on this would be very appreciated (also if not possible or if I have to
use script or the like)!
Kindest regards /Daniel.

[Daniel.Hellquist]

Hi guys,
Thanks a lot for the prompt attention you gave my first post!
I'm searching archives and will probably have to go for the event translator
somehow (I have only started that config) since I still don't see how I can
use last digit 4 in variable OID below for severity easily in the normal
trap configuration. I assume the <severity></severity> tag only accept fixed
values. I guess a combo of event translator and several event definitions
will do the trick.

[jonas.belfrage]

Hi Alejandro!

I'm trying to solve this problem together with Daniel.

Just to try and recap a little; The severity is coming encoded into the OID
of varbind number 4, like this:

#4: 1.3.6.1....4.5.999.3 = "Some text"

Where the .3 is the Severity.

Post by Alejandro Galue
http://www.opennms.org/wiki/Trap_Configuration_How-To#Filtering_on_varbinds_.28OpenNMS_1.10_and_beyond.29
The idea is to create several event definitions based on the value of
%parm[name-#4.-1]% using a varbind filter.

So, we've tried this, without any luck...

The %parm[name-#4.-1]% should equal 3 in the example above, I assume.

So there would be two options, either to use a <varbind>-mask block, like
this:

<varbind>
<vbnumber>%parm[name-#4.-1]%</vbnumber>
<vbvalue>3</vbvalue>
</varbind>

OR

<varbind>
<vbnumber>4</vbnumber>
<vbvalue>%parm[name-#4.-1]% == 3</vbvalue>
</varbind>

OR

...?
Could we use the <menames>, but what mename?

I understand the concept of several blocks, each with its own severity, but
I cannot get proper masking on varbind OID.

Please help! Any assistance i greatly appreciated!

Thanks and kind regards,
Jonas



--
View this message in context: http://opennms.530661.n2.nabble.com/Event-Config-How-to-parse-SNMP-trap-variable-OID-for-severity-tp7582324p7583087.html
Sent from the OpenNMS - discuss mailing list archive at Nabble.com.

[Alejandro Galue]

Hello,

Unfortunately, you cannot use the varbind feature that way.

vbnumber, must be the number of the parameter. It cannot be something else. For example, if the trap is sending 5 parameters, and you want to track the third one, the vbnumber must be 3.

The vbvalue can be a literal or a regular expression if you add "~" at the beginning and will be applied only on the value of the parameter (not the name or the OID).

Makes sense?

Something like "%parm[name-#4.-1]%" is for extracting information from the OID in order to use it on the LogMsg and/or the Description of the event in question.

Alejandro.

Post by jonas.belfrage
Hi Alejandro!
I'm trying to solve this problem together with Daniel.
Just to try and recap a little; The severity is coming encoded into the OID
#4: 1.3.6.1....4.5.999.3 = "Some text"
Where the .3 is the Severity.

Post by Alejandro Galue
http://www.opennms.org/wiki/Trap_Configuration_How-To#Filtering_on_varbinds_.28OpenNMS_1.10_and_beyond.29
The idea is to create several event definitions based on the value of
%parm[name-#4.-1]% using a varbind filter.

So, we've tried this, without any luck...
The %parm[name-#4.-1]% should equal 3 in the example above, I assume.
So there would be two options, either to use a <varbind>-mask block, like
<varbind>
<vbnumber>%parm[name-#4.-1]%</vbnumber>
<vbvalue>3</vbvalue>
</varbind>
OR
<varbind>
<vbnumber>4</vbnumber>
<vbvalue>%parm[name-#4.-1]% == 3</vbvalue>
</varbind>
OR
...?
Could we use the <menames>, but what mename?
I understand the concept of several blocks, each with its own severity, but
I cannot get proper masking on varbind OID.
Please help! Any assistance i greatly appreciated!
Thanks and kind regards,
Jonas

[Daniel.Hellquist]

Hi,
Thanks Alejandro!
I tried the translator feature a lot but it never processed the varbind OID,
only the value.

We ended up patching the OpenNMS and now it is possible to mask on varbind
OID as we need to for this tricky trap (see description in this thread). I
have one alarm definition per severity as you suggested and it works
perfectly. We wrote a patch instruction file that we'd be happy to feedback
to the project but I don't really know how to do that (at
http://issues.opennms.org?).

If someone would like to check the code also that'd be appreciated (maybe
there are dependencies or the like that we've missed).

We were thinking about making the <severity> field more dynamic but our
patch is more generic and hopefully therefore more useful.

We kept the requirement (as we understand the code) to have the <vbvalue>
tag so that's why it says ~.* in this case.
event xml:
<mask>
<varbind>
<vbnumber>5</vbnumber>
<vbvalue>~.*</vbvalue>
<vboid>~^.1.3.6.1.4.1.193.110.2.667.1.1.1.1.3..*4$</vboid>
</varbind>
</mask>

For new readers of this post: Patching (alteration of java code) is needed
for the above configuration to work.

Thanks a lot for your support guys!
Kindest regards /Daniel.



--
View this message in context: http://opennms.530661.n2.nabble.com/Event-Config-How-to-parse-SNMP-trap-variable-OID-for-severity-tp7582324p7583144.html
Sent from the OpenNMS - discuss mailing list archive at Nabble.com.

[Alejandro Galue]

Hello Daniel,

This sounds really good and useful.

I recommend you to create an enhancement issue on Jira (issues.opennms.org), select a "Event/Trapd Configuration" for the component, put the version of OpenNMS you've used for the patch, attach the patch, and put a brief description about the problem and how the solution works.

Also, we usually request to our contributes to check and sign the following:
http://www.opennms.org/wiki/OCA

We need it to establish shared copyright.

Alejandro.

Post by Daniel.Hellquist
Hi,
Thanks Alejandro!
I tried the translator feature a lot but it never processed the varbind OID,
only the value.
We ended up patching the OpenNMS and now it is possible to mask on varbind
OID as we need to for this tricky trap (see description in this thread). I
have one alarm definition per severity as you suggested and it works
perfectly. We wrote a patch instruction file that we'd be happy to feedback
to the project but I don't really know how to do that (at
http://issues.opennms.org?).
If someone would like to check the code also that'd be appreciated (maybe
there are dependencies or the like that we've missed).
We were thinking about making the <severity> field more dynamic but our
patch is more generic and hopefully therefore more useful.
We kept the requirement (as we understand the code) to have the <vbvalue>
tag so that's why it says ~.* in this case.
<mask>
<varbind>
<vbnumber>5</vbnumber>
<vbvalue>~.*</vbvalue>
<vboid>~^.1.3.6.1.4.1.193.110.2.667.1.1.1.1.3..*4$</vboid>
</varbind>
</mask>
For new readers of this post: Patching (alteration of java code) is needed
for the above configuration to work.
Thanks a lot for your support guys!
Kindest regards /Daniel.