02-16-2015 06:36 AM
On the FOS 7.2 switches we have MAPS with active policy that have many rules with action SNMP. For the moment we don't want to receive any SNMP traps, therefore we have configured only RASlog action allowed on the switch level:
> mapsconfig --show Configured Notifications: RASLOG Mail Recipient: XXXXXXXXXXXXXXXXXXXXXX Paused members : =============== PORT : CIRCUIT : SFP :
Surprisingly, SNMP traps for MAPS events keep arriving at SNMP server.
Would anyone have any idea why this works in such way?
02-17-2015 02:03 AM
the answer is in the question.
Since you have configured MAPS for Raslog only, you need just to work with the command's "snmpconfig" and/or "snmptraps" and disable the rule.
05-05-2015 03:01 PM
the situation is actually more complex. In our environment we don't want to have MAPS SNMP traps not used at all. We only want to be able to use what the MAPS Admin Guide "promised", i.e. to be able to decide for which rule SNMP traps are sent and for which not. Also, to be able to disable MAPS SNMP traps for the whole switch (disable SNMP on global actions level) temporarily when needed .
I did some testing with CPU > 80 % rule.
1.) When the Raslog action was turned ON and SNMP action was turned ON on the rule level for CPU > 80%, then the incoming SNMP traps were of type: mapsTrapAM
logtime 2015-02-25 13:29:27
fetchtime 2015-02-25 13:29:23
eventtime Wed Feb 25 13:29:22 2015
category Status Events
message Trap to be send for MAPS threshold events. defCHASSISCPU_80 12 1 2 1 CPU,3,80.00 3 CHASSIS(CPU>=80.00) 19 17 Switch Resource
msglong Trap to be send for MAPS threshold events. defCHASSISCPU_80 12 1 2 1 CPU,3,80.00 3 CHASSIS(CPU>=80.00) 19 17 Switch Resource
msgcomment msgread 0
snmp_formatline Trap to be send for MAPS threshold events. defCHASSISCPU_80 12 1 2 1 CPU,3,80.00 3 CHASSIS(CPU>=80.00) 19 17 Switch Resource
2.) After the SNMP action was turned OFF (Raslog still ON) on the rule level for CPU > 80%, the incoming traps type changed to: swEventTrap
logtime 2015-05-04 22:23:19
fetchtime 2015-05-04 22:23:15
eventtime Mon May 4 22:23:14 2015
category Status Events
message A firmware event has been logged: Event Index 29: 2015/05/04-22:23:14 (severity level 3) - MAPS-1003 Chassis, Condition=CHASSIS(CPU>=80.00), Current Value:[CPU,90.00 %], RuleName=CHASSISCPU_USAGE_80, Dashboard Category=Switch Resource . SSN is #17
msglong A firmware event has been logged: Event Index 29: 2015/05/04-22:23:14 (severity level 3) - MAPS-1003 Chassis, Condition=CHASSIS(CPU>=80.00), Current Value:[CPU,90.00 %], RuleName=CHASSISCPU_USAGE_80, Dashboard Category=Switch Resource . SSN is #17
snmp_formatline A firmware event has been logged: Event Index 29: 2015/05/04-22:23:14 (severity level 3) - MAPS-1003 Chassis, Condition=CHASSIS(CPU>=80.00), Current Value:[CPU,90.00 %], RuleName=CHASSISCPU_USAGE_80, Dashboard Categ
As I understand, the mechanism of swEventTrap "ignores" that I don't want SNMP being sent for some MAPS rules and it makes SNMP traps from the entries that MAPS wrote to the Raslog.
Do you know if there's a way to exclude MAPS raslog messages from being converted to swEventTrap SNMP traps?
05-10-2015 05:57 PM - edited 05-10-2015 05:59 PM
MAPS merily makes use of SNMP and is not the driving force behind it. If you don;t have any MAPS rules enabled SNMP will still send out traps based on events ciriticality. You can set these with the "snmpconfig --set mibcapability" command.
To turn off MAPS traps you can use "snmpconfig --disable mibcapabiltity -mib_name BROCADE-MAPS-MIB"
Or if you want to go via the menu driven route use "snmpconfig --set mibcapability" and the command takes you thru the list of traps you may want to enable or disable.
Hope this helps.
PS. you can also adjust the swEventTrap severity level if you want to but I've found the default to be working well.
05-19-2015 11:33 AM
Thank you Erwin,
I would not like to turn off MAPS traps altogether.
I would just like to be able to decide (using mapsrule --config) for which rules there will be Raslog + SNMP actions, and for which only Raslog entry will be created.
Is this what I can achieve using "snmpconfig --disable mibcapabiltity -mib_name BROCADE-MAPS-MIB" ?
05-21-2015 06:16 PM
That last command removes all SNMP OID from the MIB trap database ie it will not send out any MAPS related SNMP trap.
Be aware that events themselves maybe trapped by snmp but unless they trigger a MAPS rule you will not see a MAPS trap.
06-18-2015 12:53 PM
We have a similar, if not the same, issue. We have MAPS enabled and have some rules that write to the RASLOG and send SNMP traps, while other rules are configured to only write to the RASLOG. However we have found that because in the SNMP config it has a severity level of 3 set, any warning messages sent to the RASLOG also have SNMP traps sent from swEvent.
What we would like is just to have SNMP traps from MAPS rules that are configured as such and not just for all entries written to teh RASLOG with a warning status or above.
So at present it is clear that due to the snmponfig setting we are getting traps for any raslog entry with a severity of warning or above, but it is not clear if I change the severity level in the snmpconfig to 0 or 1. will that also prevent any traps including from MAPS being sent if they have a warning severity.
There are also alerts from other areas not covered by MAPS, such as bottleneckmon that we dont want to lose.
Is anyone able to assist please?