I.4 Definition files for SNMP trap conversion
- Organization of this subsection
(1) Action definition file for converting SNMP traps (imevtgw.conf)
- Format
nnm_url_base http://host-name:port-number /OvCgi/jovw.exe?MapName=default severity SNMP-trap-severity to JP1-event-severity snmp-filter source host-name1 host-name2 host-name3... end-filter var_expand 0 | 1 var_option $variable... imevt_server event-server-name imevt_regkind 0 | 1
- Storage destination directory
-
- In Windows:
-
installation-folder\conf\evtgw\imevtgw.conf
- In UNIX:
-
/etc/opt/jp1base/conf/evtgw/imevtgw.conf
- Description
-
The action definition file for SNMP trap conversion specifies the following items: the URL of NNM, the severity mapping between SNMP traps and JP1 events, and the actions to be performed when converting SNMP traps.
- Application of settings
-
When the SNMP trap converter is started, the settings take effect.
- Definition statement
-
-
Separate the parameters using spaces or tab characters.
-
A hash mark (#) at the start of a line indicates a comment.
-
- Definition details
-
- nnm_url_base
-
In JP1/IM-View, to launch NNM from the Event Details window, specify the URL of NNM in the following format:
http://host-name:port-number /OvCgi/jovw.exe?MapName=default
This parameter specifies the name of the host on which the action definition file for SNMP trap conversion (imevtgw.conf) is set. You do not need to specify a port number if you specified a Windows host in host-name. If you specify a UNIX host, you must also specify the appropriate port number. Write 8880 if you are using NNM 6.2 (NNM 07-01) or an earlier version. Write 3443 if you are using NNM 6.4 (NNM 07-10) or a later version. Note that the port number might differ, depending on the port number set in NNM. Check the NNM port number setting.
- severity
-
Associate the severity level of the SNMP trap with the severity level of the resulting JP1 event. You can specify any of the following values for the SNMP trap severity:
-
normal
-
warning
-
minor
-
major
-
critical
-
unknown
unknown indicates that there is no data identifying the SNMP trap severity, or the data does not match normal, warning, minor, major, or critical.
You can specify any of the following values for the JP1 event severity:
-
Information
-
Notice
-
Warning
-
Error
-
Emergency
-
Critical
-
Alert
-
Debug
By default (or if no severity parameter is specified), the severity levels are mapped as shown below.
SNMP trap severity
JP1 event display after conversion (severity level)
normal
Information
warning
Warning
minor
Error
major
Critical
critical
Alert
-
- snmp-filter
-
source host-name1 host-name2 host-name3...
- end-filter
-
Specify the names of SNMP agent hosts from which SNMP traps are to be converted into JP1 events. Specify the sources (host names) shown in the NNM alarms browser. Event server names are case sensitive.
For SNMP traps issued by the specified hosts, only SNMP traps that satisfy the conditions specified in the SNMP trap conversion filter file (snmpfilter.conf) are converted into JP1 events. The condition will be satisfied when a match is found with any one of the specified host names.
Note the following points when specifying the source condition statement.
-
The source condition statement must be enclosed within snmp-filter and end-filter.
-
Separate the source and host-name specification using spaces or tab characters.
-
The length of each line must not exceed 1,023 bytes. Host names will be deleted from the 1,024th byte and on.
-
Specify only one source condition statement in one snmp-filter. If it is impossible to include all the target host names in a source attribute condition statement, use an additional snmp-filter statement to specify an additional source condition statement.
When this parameter is unspecified, all SNMP traps that match the conditions specified in the filter file for converting SNMP traps (snmpfilter.conf) will be converted into JP1 events.
-
- var_expand 0|1
-
Specify whether to expand $ variables ($r, $ar, $c, $s, $N, $$, $C, $aA, and $T) contained in the messages acquired from the trapd.conf file to present the information contained in the SNMP traps.
When you specify 0, the following 18 $ variables will be expanded: $#, $number, $-number, $+number, $>number, $>-number, $>+number, $x, $X, $@, $O, $o, $G, $S, $e, $E, $A, and $*.
When you specify 1, in addition to $#, $number, $-number, $+number, $>number, $>-number, $>+number, $x, $X, $@, $O, $o, $G, $S, $e, $E, $A, $*, .$r, $ar, $c, $s, $N, $$, $C, $aA, and $T, 27 $ variables in total will be expanded.
If you omit this parameter, 0 is assumed.
- var_option $variable...
-
If a message obtained from trapd.conf contains a $ variable specified with this parameter, the same information is expanded as displayed by NNM. You can specify two $ variables: $E and $e.
If this parameter is omitted, or if no information is specified for a $ variable, the $ variable option for the SNMP trap converter is used to expand information. In this case, the information expanded differs from that displayed by NNM.
- imevt_server event-server-name
-
Specify the name of the event server to register converted JP1 events on a logical host when using a cluster system. Only an event server running on the local host can be specified. The event server name you specify in this parameter must be set in the remote-server parameter of the event server settings file (conf). For JP1/Base version 09-00 or later, if the imevt_regkind parameter is set to 0, you must also set the remote-server parameter. For details on the event server settings file (conf), see Event server settings file in 16. Definition Files.
The local host is the default location for the destination for registering JP1 events.
- imevt_regkind 0|1
-
This parameter specifies the registration trigger for JP1 events on the event server specified with the imevt_server parameter. If 0 is specified, the registration trigger is assumed to be 3#. If 1 is specified, the registration trigger is assumed to be 1#.
If no imevt_server parameter is specified, you do not need to set this parameter.
If this parameter is omitted, the registration trigger is assumed to 1.
#: JP1 event registration trigger
1: Event issued by the local event server to the local event server
3: Event issued by the remote event server to the local event server
- Notes
-
In earlier versions of the SNMP trap converter, if the imevt_server parameter is specified and the remote-server parameter in the event server settings file (conf) is set to a value other than the default, the event server name set in the imevt_server parameter must be specified in the remote-server parameter. In such a case, if any of the following actions is performed, the SNMP trap converter changes the JP1 event registered reason from 3 to 1:
-
Perform an overwrite upgrade to version 9.
-
Migrate the definition file for the previous version to version 9.
-
Because the above actions cause the registration trigger to change, the system might be affected if any of the following is performed:
-
The B.REASON attribute is set in the forwarding settings file (forward).
-
A B.REASON attribute is set with the -f option of the jevexport command in the filter file.
-
A B.REASON attribute is specified as the third argument (lpszFilter) for the JevGetOpen function that obtains a JP1 event.
-
The JevGetRegistFactor function (that obtains a JP1 event) is used to obtain the registration trigger.
To prevent the old value of registration trigger from changing, the imevt_regkind parameter needs to be set to 0. However, if the parameter is set to 0, JP1 event registration might cause an error. If an error occurs, the SNMP event to be registered is lost.
For JP1/Base version 09-00 or later, the remote-server parameter only needs to be set if the imevt_regkind parameter is set to 0.
-
- Definition examples
-
To create an SNMP action definition file, this example assumes the following:
-
NNM URL: Local host (HostA)
-
Port number: 8080
-
The following is added to the default mapping of severity levels between SNMP traps and JP1 events:
-
A SNMP trap with an unknown severity level is mapped to a JP1 event with an Information severity level.
-
SNMP agent host names: hostA, hostB, hostC, and 10.208.aa.bbb
-
$ variable expansion parameter: $ variables ($r, $ar, $c, $s, $N, $$, $C, $aA, and $T) are expanded as information contained in the SNMP traps when converting JP1 events.
-
$ variables option parameters: If a $E or $e is included, the same information as displayed by NNM will be expanded.
# NNM URL nnm_url_base http://HostA:8080/OvCgi/jovw.exe?MapName=default # JP1EVENT SEVERITY severity normal to Information severity warning to Warning severity minor to Error severity major to Critical severity critical to Alert severity unknown to Information # SNMP AGENT HOST NAMES snmp-filter source hostA hostB hostC 10.208.aa.bbb end-filter # $ VARIABLES EXPANSION PARAMETERS var_expand 1 # $ VARIABLES OPTION PARAMETERS var_option $E $e
-
(2) SNMP trap conversion filter file (snmpfilter.conf)
- Format
[+
]enterprise-name.event-name [+
]enterprise-name.* !enterprise-name.event-name
- Storage destination directory
-
- In Windows:
-
installation-folder\conf\evtgw\snmpfilter.conf
- In UNIX:
-
/etc/opt/jp1base/conf/evtgw/snmpfilter.conf
- Description
-
The SNMP trap conversion filter file specifies whether SNMP traps are to be converted into JP1 events. Make sure that the enterprise name and event name you define in the filter file for converting SNMP traps (snmpfilter.conf) match those defined in the trapd.conf file of NNM. The enterprise name and event name are case sensitive. Note that the settings entered in this file differ according to the language environment in which NNM is running.
- Application of settings
-
When you perform one of the following operations, the settings take effect:
-
Start the SNMP trap converter.
-
Start the NNM alarm browser (xnmevents).
-
Change a setting in the NNM event settings dialog box, and then click the Save button.
-
Execute the NNM-supplied xnmevents -event command.
-
Execute the NNM-supplied xnmtrap -event command.
-
- Definition statement
-
-
A hash mark (#) at the start of a line indicates a comment.
-
The content of the SNMP trap conversion filter file (snmpfilter.conf) must not exceed 900 bytes, as shown in the expression below.
((a1+1)+(a2+1)+(a3+1)+(a4+1)...(an#+1))+34 < 900 bytes
#: Length of the object ID for a SNMP trap defined in the filter file (snmpfilter.conf). For example, if an object ID is .1.2.3.4.5, an is 10 bytes long.
When you define generic traps in the filter file (snmpfilter.conf), use the following expression: (result-of-the-above-expression) + (number-of-general-traps x 2) < 900
-
- Definition details
-
- +
-
Specify this option if you want to convert variable binding attributes of SNMP traps into program-specific information of the extended attributes for JP1 events. Insert one or more spaces or tab characters between + and the enterprise name. Do not include both + and ! in the same line. If so, the line will become invalid.
- Notes on converting variable binding attributes into JP1 events
-
-
The maximum size of the value of a variable binding attribute that can be converted is 1,023 bytes. The 1,024th and subsequent bytes are not converted if specified.
-
The maximum size of a JP1 event is 10,000 bytes. If converting variable binding attributes into JP1 event-specific attributes results in the JP1 event size exceeding 10,000 bytes, some variable binding attributes will be left unconverted.
-
The maximum number of variable binding attributes that can be converted into JP1 event-specific attributes is 28.
-
- enterprise-name
-
Specify OID_ALIAS for the SNMP trap to be converted.
- event-name
-
Specify the event name for the SNMP trap you want to convert.
- Enterprise and event name examples
-
The enterprise and event names are described below.
The enterprise names are specified as follows in the trapd.conf file.
Figure I‒3: Example of specifying an enterprise name defined in trapd.conf The event names are specified as follows in the trapd.conf file. Here, OV_Network_Warning is the event name.
Figure I‒4: Example of specifying an event name defined in trapd.conf - *
-
Specify an asterisk to exclude all SNMP traps with the specified enterprise name from being converted into JP1 events.
- !
-
Specify an exclamation mark to exclude the specified SNMP trap (among those specified in the form [+
]enterprise-name.* or [+
]enterprise-name.event-name) from being converted into a JP1 event. This specification is invalid when both [+
]enterprise-name.* and [+
]enterprise-name.event-name are omitted.
- Notes
-
-
When converting SNMP traps into JP1 events, the SNMP trap converter compares the SNMP traps in the order in which they were defined in the filter file for converting SNMP traps (snmpfilter.conf). In this filter file, define SNMP traps in the order of priority for conversion into JP1 events.
-
You cannot specify a period in enterprise name or event name in the filter file for converting SNMP traps (snmpfilter.conf). If a period is included in the enterprise name or event name of any of the SNMP traps to be converted, change that name in NNM to a name that does not contain a period.
-
- Definition examples
-
An SNMP trap that satisfies the following conditions is converted into a JP1 event:
-
The enterprise name is OpenView, snmpTraps, or sso.
-
The enterprise name is OpenView, and the event name is OV_Network_Critical.
If an SNMP trap satisfies the first condition, but its enterprise name is snmpTraps, and its event name is SNMP_Authen_Failure, the SNMP trap is not converted.
OpenView.* snmpTraps.* sso.* OpenView.OV_Network_Critical !snmpTraps.SNMP_Authen_Failure
-