DX NetOps

How to check traps are sent from the agent and received on the spectrum ?

Does spectrum has any record to note the trap and we can check it ?

Hello Peng,

Traps are nothing but the events . We have poll based and trap based events .

Are you planning to look at any traps that are reaching Spectrum which are not mapped? If yes the raw traps are logged on the vnm model if the end device is not discovered in Spectrum.

Incase the trap is not mapped and the end device is discovered in Spectrum, raw trap is visible on this model.

Look for event codes 10801 and 10802.

Incase you want to have a look at the backend code bases trap events logon to event configuration editor -> enable all the columns in navigation panel -> one of the column is trap based. For trap based event this is check marked.

If you are looking for any specific trap to see if it reached spectrum, i suggest using wireshark with the filter udp.port==162 on the Spectroserver

Hope this helps.

Dear Kothapalli:

         The Spectrum polling my user network devices. The user told me that it has one device's interface down. It should send the trap to Spectrum and Spectrum send the SMS. But it didn't . The user provide me the log of this device and this log recording "interface down event".

So I want to check any record of spectrum to prove that it did receive trap or not.

Peng,

You should look through events on the device in Oneclick. I hope you are expecting bad link alarm in Console.

If there was a Link Down trap sent, in addition to checking the events you will also want to check the port level attributes

AlarmOnLinkDownTrap

Attribute ID: 0x11fc2

Determines how CA Spectrum handles a Link Down trap on this particular port.

GeneratePortStatusAlarms

Attribute ID: 0x12a54

Indicates if a port status alarm should be generated on this port.

Make sure that AlarmOnLinkDownTrap is set to 1 (Check) and that GeneratePortStatusAlarms is set to Yes so that it will generate a Bad Link alarm

   when the LinkDown trap is processed.

-Greg

Peng,

Adding to greg's comment, make sure the below attributes are set this way to monitor a port/link in Spectrum

1. Pollportstatus to yes

2. ok to poll  --> yes

3. Assert link down alarm --> yes

4. Alarm on link down trap --> check status

5. GeneratePortStatusAlarms ---> Yes

Make sure the attributes on the port mentioned are set this way.

Dear all,

find the VNM-Models / Component Details / Information tab -> Subview "Trap Management" - here you can see the "counters". This may help to see increase inbound counters.

In more detail, a debugging is possible as described per:  Tech Tip: Debugging trap processing in a Spectrum Distributed SpectroSERVER environment with Trap Director enabled

In general - once the SpectroSERVER receives a "TRAP" the AlertManager processes this data. Once the the TRAP is parsed and the "Alert" is processed, the mapping for the Alert (see AlertMap file) into an Event (with event variables) takes place / becomes valid. This is the first time you see info in the CA Spectrum by the created event. There is only a specific for event for an unknown Trap - or a Trap received for unknown device. But in case the TRAP is known and the device model is available, then the first "view" is the event under the device (or sub-components/models).

May we can ask back: Is there a specific interest to check for inbound TRAP? Do you expect an inbound TRAP is not correctly processed - or is never processed?

Here the discussed procedure is still valid:

- use a sniffer to verify inbound TRAP at SpectroSERVEs IP-stack is seen/received

- enable the AlertManager debugging to find out if the TRAP is processed

- verify in a distributed Spectrum installation if the TRAP is cross-landscape propagated to another landscape / SpectroSERVER

- find then the device model with the event / or in case of unknown Trap / or Trap received for unkown Device - find the events under the VNM model.

Cheers, Joerg

Each device model has an attribute '0x12a80' which will tell you the number of traps received since the last reboot! If this is 0 then it means you are not receiving any traps. If this number is > 0 then you at some point received traps.

If you want more detail I would first run tcpdump or wireshark and see if traps are been sent from the device itself. You can specify a filter to only show traffic from the device IP to the Spectrum Landscape receiving traps on port 162. If you see a trap being received on the Spectrum host - 99.9% of the time Spectrum will process it and the trapsReceived attribute ('0x12a80') will increment.

I would also check to see if the interfaces are set to react to traps or not (see CA Spectrum - Multiple Port Alarms).