Hitachi

JP1 Version 12 JP1/Base User's Guide


I.4 Definition files for SNMP trap conversion

Organization of this subsection

(1) Action definition file for converting SNMP traps (imevtgw.conf)

Format
nnm_url_base  http://host-name:port-number /OvCgi/jovw.exe?MapName=default
severity SNMP-trap-severity to JP1-event-severity
snmp-filter 
source  host-name1 host-name2 host-name3...
end-filter 
var_expand    0 | 1
var_option $variable...
imevt_server event-server-name
Storage destination directory

/etc/opt/jp1base/conf/evtgw/imevtgw.conf

Description

The action definition file for SNMP trap conversion specifies the following items: the URL of NNM, the severity mapping between SNMP traps and JP1 events, and the actions to be performed when converting SNMP traps.

Application of settings

When the SNMP trap converter is started, the settings take effect.

Definition statement
  • Separate the parameters using spaces or tab characters.

  • A hash mark (#) at the start of a line indicates a comment.

Definition details
nnm_url_base

In JP1/IM-View, to launch NNM from the Event Details window, specify the URL of NNM in the following format:

http://host-name:port-number /OvCgi/jovw.exe?MapName=default

This parameter specifies the name of the host on which the action definition file for SNMP trap conversion (imevtgw.conf) is set. You must also specify the appropriate port number. Write 8880 if you are using NNM 6.2 (NNM 07-01) or an earlier version. Write 3443 if you are using NNM 6.4 (NNM 07-10) or a later version. Note that the port number might differ, depending on the port number set in NNM. Check the NNM port number setting.

severity

Associate the severity level of the SNMP trap with the severity level of the resulting JP1 event. You can specify any of the following values for the SNMP trap severity:

  • normal

  • warning

  • minor

  • major

  • critical

  • unknown

unknown indicates that there is no data identifying the SNMP trap severity, or the data does not match normal, warning, minor, major, or critical.

You can specify any of the following values for the JP1 event severity:

  • Information

  • Notice

  • Warning

  • Error

  • Emergency

  • Critical

  • Alert

  • Debug

By default (or if no severity parameter is specified), the severity levels are mapped as shown below.

SNMP trap severity

JP1 event display after conversion (severity level)

normal

Information

warning

Warning

minor

Error

major

Critical

critical

Alert

snmp-filter

source host-name1 host-name2 host-name3...

end-filter

Specify the names of SNMP agent hosts from which SNMP traps are to be converted into JP1 events. Specify the sources (host names) shown in the NNM alarms browser. Event server names are case sensitive.

For SNMP traps issued by the specified hosts, only SNMP traps that satisfy the conditions specified in the SNMP trap conversion filter file (snmpfilter.conf) are converted into JP1 events. The condition will be satisfied when a match is found with any one of the specified host names.

Note the following points when specifying the source condition statement.

  • The source condition statement must be enclosed within snmp-filter and end-filter.

  • Separate the source and host-name specification using spaces or tab characters.

  • The length of each line must not exceed 1,023 bytes. Host names will be deleted from the 1,024th byte and on.

  • Specify only one source condition statement in one snmp-filter. If it is impossible to include all the target host names in a source attribute condition statement, use an additional snmp-filter statement to specify an additional source condition statement.

When this parameter is unspecified, all SNMP traps that match the conditions specified in the filter file for converting SNMP traps (snmpfilter.conf) will be converted into JP1 events.

var_expand 0|1

Specify whether to expand $ variables ($r, $ar, $c, $s, $N, $$, $C, $aA, and $T) contained in the messages acquired from the trapd.conf file to present the information contained in the SNMP traps.

When you specify 0, the following 18 $ variables will be expanded: $#, $number, $-number, $+number, $>number, $>-number, $>+number, $x, $X, $@, $O, $o, $G, $S, $e, $E, $A, and $*.

When you specify 1, in addition to $#, $number, $-number, $+number, $>number, $>-number, $>+number, $x, $X, $@, $O, $o, $G, $S, $e, $E, $A, $*, .$r, $ar, $c, $s, $N, $$, $C, $aA, and $T, 27 $ variables in total will be expanded.

If you omit this parameter, 0 is assumed.

var_option $variable...

If a message obtained from trapd.conf contains a $ variable specified with this parameter, the same information is expanded as displayed by NNM. You can specify two $ variables: $E and $e.

If this parameter is omitted, or if no information is specified for a $ variable, the $ variable option for the SNMP trap converter is used to expand information. In this case, the information expanded differs from that displayed by NNM.

imevt_server event-server-name

Specify the name of the event server to register converted JP1 events on a logical host when using a cluster system. Only an event server running on the local host can be specified. The event server name you specify in this parameter must be set in the remote-server parameter of the event server settings file (conf). For details on the event server settings file (conf), see Event server settings file in 16. Definition Files.

The local host is the default location for the destination for registering JP1 events.

Notes

In JP1/Base 11-00 or later, specification of the imevt_regkind parameter is no longer needed. However, even if you do specify this parameter, JP1/Base operation is not adversely affected.

In earlier versions of the SNMP trap converter, if the imevt_server parameter is specified and the remote-server parameter in the event server settings file (conf) is set to a value other than the default, the event server name set in the imevt_server parameter must be specified in the remote-server parameter. In such a case, if any of the following actions is performed, the SNMP trap converter changes the JP1 event registered reason from 3 to 1:

  • Perform an overwrite upgrade to version 9.

  • Migrate the definition file for the previous version to version 9.

  • Because the above actions cause the registration trigger to change, the system might be affected if any of the following is performed:

  • The B.REASON attribute is set in the forwarding settings file (forward).

  • A B.REASON attribute is set with the -f option of the jevexport command in the filter file.

  • A B.REASON attribute is specified as the third argument (lpszFilter) for the JevGetOpen function that obtains a JP1 event.

  • The JevGetRegistFactor function (that obtains a JP1 event) is used to obtain the registration trigger.

Definition examples

To create an SNMP action definition file, this example assumes the following:

  • NNM URL: Local host (HostA)

  • Port number: 8080

  • The following is added to the default mapping of severity levels between SNMP traps and JP1 events:

  • A SNMP trap with an unknown severity level is mapped to a JP1 event with an Information severity level.

  • SNMP agent host names: hostA, hostB, hostC, and 10.208.aa.bbb

  • $ variable expansion parameter: $ variables ($r, $ar, $c, $s, $N, $$, $C, $aA, and $T) are expanded as information contained in the SNMP traps when converting JP1 events.

  • $ variables option parameters: If a $E or $e is included, the same information as displayed by NNM will be expanded.

# NNM URL
nnm_url_base    http://HostA:8080/OvCgi/jovw.exe?MapName=default
 
# JP1EVENT SEVERITY
severity normal  to Information
severity warning to Warning
severity minor   to Error
severity major   to Critical
severity critical to Alert
severity unknown to Information
 
# SNMP AGENT HOST NAMES
snmp-filter 
  source hostA hostB hostC 10.208.aa.bbb
end-filter 
 
# $ VARIABLES EXPANSION PARAMETERS
var_expand   1
 
# $ VARIABLES OPTION PARAMETERS
var_option  $E $e

(2) SNMP trap conversion filter file (snmpfilter.conf)

Format
[+[Figure]]enterprise-name.event-name
[+[Figure]]enterprise-name.*
!enterprise-name.event-name
Storage destination directory

/etc/opt/jp1base/conf/evtgw/snmpfilter.conf

Description

The SNMP trap conversion filter file specifies whether SNMP traps are to be converted into JP1 events. Make sure that the enterprise name and event name you define in the filter file for converting SNMP traps (snmpfilter.conf) match those defined in the trapd.conf file of NNM. The enterprise name and event name are case sensitive. Note that the settings entered in this file differ according to the language environment in which NNM is running.

Application of settings

When you perform one of the following operations, the settings take effect:

  • Start the SNMP trap converter.

  • Start the NNM alarm browser (xnmevents).

  • Change a setting in the NNM event settings dialog box, and then click the Save button.

  • Execute the NNM-supplied xnmevents -event command.

  • Execute the NNM-supplied xnmtrap -event command.

Definition statement
  • A hash mark (#) at the start of a line indicates a comment.

  • The content of the SNMP trap conversion filter file (snmpfilter.conf) must not exceed 900 bytes, as shown in the expression below.

    ((a1+1)+(a2+1)+(a3+1)+(a4+1)...(an#+1))+34 < 900 bytes

    #: Length of the object ID for a SNMP trap defined in the filter file (snmpfilter.conf). For example, if an object ID is .1.2.3.4.5, an is 10 bytes long.

    When you define generic traps in the filter file (snmpfilter.conf), use the following expression: (result-of-the-above-expression) + (number-of-general-traps x 2) < 900

    When the filter exceeds 900 bytes, if a large volume of SNMP traps occur intermittently and linkage with NNM is disconnected, any untrapped data, or data generated in the interval before the host is reconnected to NNM, will be lost.

    The following message is output to the integrated trace log when this problem occurs.

    KAVA2000-E IMEvtgw cannot receive SNMPTrap.

Definition details
+

Specify this option if you want to convert variable binding attributes of SNMP traps into program-specific information of the extended attributes for JP1 events. Insert one or more spaces or tab characters between + and the enterprise name. Do not include both + and ! in the same line. If so, the line will become invalid.

Notes on converting variable binding attributes into JP1 events
  • The maximum size of the value of a variable binding attribute that can be converted is 1,023 bytes. The 1,024th and subsequent bytes are not converted if specified.

  • The maximum size of a JP1 event is 10,000 bytes. If converting variable binding attributes into JP1 event-specific attributes results in the JP1 event size exceeding 10,000 bytes, some variable binding attributes will be left unconverted.

  • The maximum number of variable binding attributes that can be converted into JP1 event-specific attributes is 28.

enterprise-name

Specify OID_ALIAS for the SNMP trap to be converted.

event-name

Specify the event name for the SNMP trap you want to convert.

Enterprise and event name examples

The enterprise and event names are described below.

The enterprise names are specified as follows in the trapd.conf file.

Figure I‒3: Example of specifying an enterprise name defined in trapd.conf

[Figure]

The event names are specified as follows in the trapd.conf file. Here, OV_Network_Warning is the event name.

Figure I‒4: Example of specifying an event name defined in trapd.conf

[Figure]

*

Specify an asterisk to exclude all SNMP traps with the specified enterprise name from being converted into JP1 events.

!

Specify an exclamation mark to exclude the specified SNMP trap (among those specified in the form [+[Figure]]enterprise-name.* or [+[Figure]]enterprise-name.event-name) from being converted into a JP1 event. This specification is invalid when both [+[Figure]]enterprise-name.* and [+[Figure]]enterprise-name.event-name are omitted.

Notes
  • When converting SNMP traps into JP1 events, the SNMP trap converter compares the SNMP traps in the order in which they were defined in the filter file for converting SNMP traps (snmpfilter.conf). In this filter file, define SNMP traps in the order of priority for conversion into JP1 events.

  • You cannot specify a period in enterprise name or event name in the filter file for converting SNMP traps (snmpfilter.conf). If a period is included in the enterprise name or event name of any of the SNMP traps to be converted, change that name in NNM to a name that does not contain a period.

Definition examples

An SNMP trap that satisfies the following conditions is converted into a JP1 event:

  • The enterprise name is OpenView, snmpTraps, or sso.

  • The enterprise name is OpenView, and the event name is OV_Network_Critical.

If an SNMP trap satisfies the first condition, but its enterprise name is snmpTraps, and its event name is SNMP_Authen_Failure, the SNMP trap is not converted.

OpenView.*
snmpTraps.*
sso.*
 
OpenView.OV_Network_Critical
 
!snmpTraps.SNMP_Authen_Failure