For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

jglenton_43180's avatar
jglenton_43180
Icon for Nimbostratus rankNimbostratus
Nov 30, 2012

Set the priority of an SNMP Trap

Hi,

 

I've created a custom SNMP Trap alert in /config/user_alert.conf which works fine

 

Is there any way I can set the priority / severity level of these traps to increase it to the maximum so when it comes into our ticketing system that picks up traps, it comes though as a P1. At the moment they're coming in as a severity 2 and getting ignored because they are not deemed important enough.

 

I've seen a priority option in the alertd.conf file but this looks more related to lcd config problems.

 

Many thanks

 

James

 

management
monitoring

4 Replies

  • nitass's avatar
    nitass
    Icon for Employee rankEmployee
    Nov 30, 2012
    can you try these OIDs when configuring custom trap? 

    alert BIGIP_LOG_EMERG "^[0-9a-f]{8}:0: (.*)" {
        snmptrap OID=".1.3.6.1.4.1.3375.2.4.0.29"
}
alert BIGIP_LOG_ALERT "^[0-9a-f]{8}:1: (.*)" {
        snmptrap OID=".1.3.6.1.4.1.3375.2.4.0.30"
}
alert BIGIP_LOG_CRIT "^[0-9a-f]{8}:2: (.*)" {
        snmptrap OID=".1.3.6.1.4.1.3375.2.4.0.31"
}
alert BIGIP_LOG_ERR "^[0-9a-f]{8}:3: (.*)" {
        snmptrap OID=".1.3.6.1.4.1.3375.2.4.0.32"
}
alert BIGIP_LOG_WARNING "^[0-9a-f]{8}:4: (.*)" {
        snmptrap OID=".1.3.6.1.4.1.3375.2.4.0.33"
}
  • jglenton_43180's avatar
    jglenton_43180
    Icon for Nimbostratus rankNimbostratus
    Nov 30, 2012
    Thanks for getting back...

     

     

    Tried the first two oid's and it's still coming through as a severity 2

     

     

    [root@ltcgtm1:Active] tmp cat /config/user_alert.conf

     

    alert if_media_workaround "Initialization complete. The MCP is up and running" {

     

    exec command="/bin/bigpipe load"

     

    }

     

    alert JAMES_TEST_ALERT_1 "SNMP_TRAP: james_test_message_here" {

     

    exec command="/tmp/james_script"

     

    }

     

    alert JAMES_TEST_ALERT_2 "TEST message has gone into gtm log file okay 3" {

     

    snmptrap OID=".1.3.6.1.4.1.3375.2.4.0.30"

     

    }

     

    [root@ltcgtm1:Active] tmp

     

  • nitass's avatar
    nitass
    Icon for Employee rankEmployee
    Dec 01, 2012
    you did restart alertd after changing the oid, didn't you? 

    ----------------------------------
[root@ve10:Active] config  cat user_alert.conf
alert JAMES_TEST_ALERT_2 "TEST message has gone into gtm log file okay 3" {
  snmptrap OID=".1.3.6.1.4.1.3375.2.4.0.29"
}

 trap receiver

"time","IP","version","timestamp","snmpTrapOID","varbinds"
"Sat Dec 01 13:09:55 SGT 2012","172.28.19.80","2","4 seconds",".iso.org.dod.internet.private.enterprises.f5.bigipTrafficMgmt.bigipNotification.bigipNotifications.bigipLogEmerg","OID: .1.3.6.1.2.1.1.3.0. Value: 4 seconds; OID: .1.3.6.1.6.3.1.1.4.1.0. Value: bigipLogEmerg; OID: .iso.org.dod.internet.private.enterprises.f5.bigipTrafficMgmt.bigipNotification.bigipNotifyObjects.bigipNotifyObjMsg. Value: TEST message has gone into gtm log file okay 3; OID: .1.3.6.1.6.3.1.1.4.3.0. Value: bigipNotification; "

----------------------------------
[root@ve10:Active] config  cat user_alert.conf
alert JAMES_TEST_ALERT_2 "TEST message has gone into gtm log file okay 3" {
  snmptrap OID=".1.3.6.1.4.1.3375.2.4.0.30"
}

 trap receiver

"time","IP","version","timestamp","snmpTrapOID","varbinds"
"Sat Dec 01 13:11:08 SGT 2012","172.28.19.80","2","4 seconds",".iso.org.dod.internet.private.enterprises.f5.bigipTrafficMgmt.bigipNotification.bigipNotifications.bigipLogAlert","OID: .1.3.6.1.2.1.1.3.0. Value: 4 seconds; OID: .1.3.6.1.6.3.1.1.4.1.0. Value: bigipLogAlert; OID: .iso.org.dod.internet.private.enterprises.f5.bigipTrafficMgmt.bigipNotification.bigipNotifyObjects.bigipNotifyObjMsg. Value: TEST message has gone into gtm log file okay 3; OID: .1.3.6.1.6.3.1.1.4.3.0. Value: bigipNotification; "
  • jglenton_43180's avatar
    jglenton_43180
    Icon for Nimbostratus rankNimbostratus
    Dec 04, 2012
    Hi, just double checked and I had restarted alertd afterwards.

     

     

    Still getting my alerts coming into my ticketing tool with a medium priority