The SNMP Trap QA Monitor operates differently than all other Monitors in ipMonitor. It does not poll resources on timed intervals. Instead, it listens for incoming SNMP Traps and performs tests on the data it receives.

ipMonitor assumes the role of an SNMP manager:

1. It listens for any incoming Traps sent by SNMP Agents. These provide networking information for servers, applications or devices on the network.
2. ipMonitor then parses each Trap's PDU (Protocol Data Unit) message it receives using the "Trap Filtering" settings for each SNMP Trap QA Monitor it has configured, in order to determine whether the Trap applies to it.
3. If the incoming Trap applies to a SNMP Trap QA Monitor, an Alert will be triggered.
4. The SNMP Trap QA Monitor may optionally be configured to examine the Variable Binding information within a Trap. For example, it may search for temperature information, remaining battery power, an application error condition, etc.
5. Any retrieved Variable Binding information can then be parsed by a Content Generator you have previously created and pushed to any Alert Type in ipMonitor that supports Information Alerts.

Integrating ipMonitor with third-party Network Management solutions:

• Many network servers, applications and devices include SNMP Agents to send out Traps. However, most do not send out Alerts. Using ipMonitor, these Agents can take advantage of ipMonitor's Alerting system to process Alerts.
• The SNMP Trap QA Monitor can also integrate with your other Network Management solutions that are SNMP-enabled. Incoming SNMP traps can be processed into Alerts for notification, integration and recovery purposes.

Top of page

SNMP Trap listening is disabled by default. This is done to ensure that ipMonitor properly co-exists with existing Network management software.

To enable the SNMP Trap Listener:

1. Launch the ipMonitor Configuration Program from the ipMonitor program group.
2. Select the Communications: Web Server Ports option.
3. Within the SNMP Trap Listener section, specify a listening IP Address and Port (UDP) for all SNMP Trap QA Monitors and ensure the Enabled checkbox is checked.

Any agent you configure to send Traps to ipMonitor must use this same IP Address and Port combination.

Note regarding Windows SNMP Trap Service:

If the Windows SNMP Trap Service is enabled on the ipMonitor host computer, it is very likely to conflict with ipMonitor's SNMP Trap Listener (depending on configuration parameters).

Normally, the Windows SNMP Trap Service is configured to listen on IP Address 0.0.0.0 Port 162 (in other words, it is configured to listen for all inbound Traps on Port 162). ipMonitor also uses the same default settings for its SNMP Trap Listener. Because only one SNMP Trap Listener can be bound to Port 162 at a time, a conflict occurs.

To solve this problem:

1. Disable the Windows SNMP Trap Service from the Windows Control Panel/Services interface. Normally, this won't present any problems unless you have installed ipMonitor on that same host machine as another SNMP solution that requires use of the Windows SNMP Trap Service.
2. Alternatively, modify ipMonitor's SNMP Port to an unused Port. Keep in mind that you will also need to modify the outbound Port for any SNMP Agents that will be sending Traps to ipMonitor.

Top of page

The Trap Filtering dialog box is used to filter incoming Trap PDU information sent to ipMonitor. SNMP Trap QA Monitors support a large bank of parameters for isolating which Agents and OIDs ipMonitor will accept for analysis.

Version
This is the SNMP version ipMonitor supports for the incoming SNMP Trap.

Community
The SNMP Community string acts like a password for SNMP. When ipMonitor receives a Trap from an Agent, it will include the SNMP Community string. If both ipMonitor and the Agent use this same Read-Only string, ipMonitor will continue its "Trap Filtering" and progress to the IP Range test.

SNMP default communities are:

• Private (Read-Write)
• Public (Read-Only)

Some SNMP Agents allow you to use non-default Community strings. This is typically done to improve the SNMP security model, often in conjunction with a non-standard SNMP port.

Allowed IP Address Range (start) & (end)
For security purposes, Traps can be accepted based on a range of IP addresses:

• For a range, enter the start and end of the range of IP addresses from which SNMP Traps will be accepted.
• For a single IP address, enter the same start and end IP address.

Filter using the source address from within the SNMP TRAP packet, not the IP Header
To increase the flexibility of the SNMP Trap QA Monitor IP address filtering, two variations are supported:

• If this option is checked, the SNMP Trap QA Monitor will use the IP address specified by the Agent in the incoming Trap packet to perform its Allowed IP Address Range validation.
• If this option is not checked, the SNMP Trap QA Monitor will use the IP address specified in the IP Header.

Generic Type
The incoming Generic Trap field must be one of the predefined SNMPv1 Trap types:

• Any indicates that any of the Trap types listed below will be accepted.
• coldStart(0) signifies that the sending protocol entity is reinitializing itself such that the agent's configuration or the protocol entity implementation may be altered.
• warmStart(1) signifies that the sending protocol entity is reinitializing itself such that neither the agent configuration nor the protocol entity implementation is altered.
• linkDown(2) signifies that the sending protocol entity recognizes a failure in one of the communication links represented in the agent's configuration.
• linkUp(3) signifies that the sending protocol entity recognizes that one of the communication links represented in the agent's configuration has come up.
• authentication-Failure(4) signifies that the sending protocol entity is the addressee of a protocol message that is not properly authenticated.
• egpNeighborLoss(5) signifies that an EGP neighbor for whom the sending protocol entity was an EGP peer has been marked down and the peer relationship no longer exists.
• enterprise-Specific(6) signifies that the sending protocol entity recognizes that some enterprise-specific event has occurred. The specific-trap field identifies the particular trap which occurred.

Refer to RFC 1157 for more information.

Enterprise OID
Enter the Object Identifier that identifies the network management subsystem that generated the SNMP Trap. The OID identifies the object's position in a global object registration tree.

To locate OIDs for your applications and equipment:

1. Use ipMonitor's database of precompiled MIBs that can be browsed or queried (located in the Tools drop-down menu). MIB Information is provided for common Windows and hardware applications.
2. To expand the default MIB database, use the Custom Database Builder available on the ipMonitor Support Portal to select MIBs from ipMonitor's MIB Repository and perform automated MIB compilations. You can then add the newly-created Custom MIB Database to your ipMonitor installation.

Note: The Custom Database Builder is only available to Licensed ipMonitor customers. For detailed instructions on compiling and importing a MIB database, refer to the tutorial entitled Add a Custom MIB Database to your ipMonitor Installation, located on the Support Portal.

3. Use ipMonitor's SNMP Assistant, available from the ipMonitor Support Portal, to scan and collect information from your SNMP-enabled network devices and applications. This "scan" process allows you to discover whether a specific device supports an object defined by a particular MIB, as well as the type of information it will return.
4. Contact your vendor directly to acquire MIBs for your various applications and equipment.

Get Info
Click the Get Info button to query ipMonitor's built-in SNMP database for details about the OID you enter. Type Information is ideal for determining what type analysis can be performed in the Analysis of Test Results section.

To OID
Click the To OID button to convert the readable label of the OID path into its standard numerical notation. For example, clicking the To OID button will convert sysUpTime.0 to 1.3.6.1.2.1.1.3.0

An Enterprise OID prefix can be specified by using an asterisk as a wildcard character. For example: 1.3.6.1.4.1.*

Anything below the asterisk is accepted. This allows you to configure a single SNMP Trap QA Monitor to accept Traps from multiple SNMP-enabled devices or applications.

Enterprise Specific Kind
The Enterprise Specific Kind field is used to isolate vendor specific problems.

If enterpriseSpecific is selected for the Generic Type field, ipMonitor allows you to optionally add one or more Specific Trap Kinds unique to the network management subsystem generating the Trap.

To add more Specific Kinds, click the Add... button, and then click the Or... button for any subsequent entries. This makes it possible to Alert based on more than one Specific Kind of Trap.

Top of page

If a Trap successfully progresses through the Trap Filtering process, analysis can be performed on test results to locate specific information within its Variable Bindings.

Examine the Variable Bindings
If Disabled, an Alert will be generated should the incoming Trap pass the test criteria defined by the Trap Filter settings. If you choose this option, you will be unable to locate specific parameters within the Trap's Variable Bindings for use with ipMonitor's Information Alerts.

If Enabled, you will be able to examine the Variable Bindings of the incoming Trap to locate specific information, and then include the information within an Information Alert.

Variable to Analyze (by OID)
Typically, Variable Bindings will contain a number of different OIDs. The Variable to Analyze field lets you select the specific OID(s) that you want to filter for information.

Two match types are supported:

• Prefix Match is used when you want to filter more than one Variable Binding (typically all). Enter up to a certain point in the Object ID, after which anything will be accepted.
• Exact Match is used to isolate a specific OID within the Variable Bindings.

The data type of the Variable Bindings controls how the SNMP Trap QA Monitor will analyze the Variable object. The SNMP Trap QA Monitor can perform two types of comparison:

• Text
• Numeric

Variable will (Numeric data type)
This option instructs the Monitor to operate on numeric values. Supported numeric tests include:

• < Less than
• > Greater than
• <= Less than or equal to
• >= Greater than or equal to
• == Equal to
• != Not equal to

The AND... button and the OR... button can be used to increase the flexibility of the test. For example, you may test to check that:

• The value is greater than 30,000
• AND less than 40,000
• OR not equal to 0

Variable will (Text data type)
This option instructs the Monitor to operate on a string value. Several comparison types are available, including Regular Expression and string matches:

• RegEx match - Enter a Regular Expression to match
• RegEx non-match - Enter a Regular Expression not to match
• Substring search - Search for a case sensitive substring
• == Equal to
• != Not equal to

Note: ipMonitor includes a RegEx Wizard to help create Regular Expressions.

Top of page

The SNMP Trap QA Monitor can be used with ipMonitor's Information Alerts to:

• Capture results from Variable Bindings
• Format that data for a specific purpose
• Push reformatted data to notification, integration and recovery Alerts

Information Alerts consist of two integral parts:

1. The Search Scenario discussed in the Analysis of Test Results section above.
2. The Content Generator shown above.

Refer to Content Generators for more information regarding formatting and supplemental Tokens.

Top of page

You can confirm your remote Agent is configured correctly by sending an SNMP Trap to ipMonitor. ipMonitor may be configured to record all SNMP Traps it receives in its snmptrap.log file.

Sample Trap from snmptrap.log:
The Trap shown below is an Enterprise Specific Temperature Trap produced by a Dell PowerEdge Server.

----8<--------------
Intact SNMP Trap Accepted: time(Tue Feb 24 19:07:39 2004)
src_ip (10.7.0.10)
version: 1
community: public
enterprise: 1.3.6.1.4.1.674.10892.1
agent-addr: 10.7.0.10
generic-trap: enterpriseSpecific (6)
specific-trap: 1053
time-stamp: 417089
Variable Bindings:
1.3.6.1.4.1.674.10892.1.5000.10.1.0: TYPE[4] TEXT
"INRANETSRV"
1.3.6.1.4.1.674.10892.1.5000.10.2.0: TYPE[6] TEXT
"1.3.6.1.4.1.674.10892.1.700.20.1.2.1.2"
1.3.6.1.4.1.674.10892.1.5000.10.3.1: TYPE[4] TEXT
"Temperature sensor detected a warning value \nSensor location: Ambient \nChassis location:Main System Chassis\nPrevious state was: OK (Normal) \nTemperature sensor value (in Degrees Celsius): 42.000"
1.3.6.1.4.1.674.10892.1.5000.10.4.0: TYPE [2] NUMERIC 4
1.3.6.1.4.1.674.10892.1.5000.10.5.0: TYPE [2] NUMERIC 3
1.3.6.1.4.1.674.10892.1.5000.10.6.0: TYPE [4] TEXT ""
----8<--------------

Monitor Configuration Settings:
In this example, the Examine the Variable Bindings option has been enabled. Note the Regular Expression designed to filter the Sensor location, Chassis location and Degrees Celsius.

Examine the Variable Bindings
       ENABLED
Variable to analyze (by OID)
       Exact match:1.3.6.1.4.1.674.10892.1.5000.10.3.0
       type: text

Variable will RegEx match
(Sensor location: .*?)\\n(Chassis location: .*?)\\n.*Degrees Celsius\)\: (.*?)

Content Generator Value
Shown here is the Temperature Content Generator value.

Content Generators:

• Format output for ipMonitor's Information Alerts.
• Are configured by selecting the Alerts menu item.
• Are selected in the Notification Control section of a Monitor's settings (SNMP Trap QA Monitor, in this example).
• Are enabled in Alerts by selecting the Send Information Notifications checkbox.

Name:	SNMP Trap Capture (Temperature)
Value:	%capture[1]%
	%capture[2]%
Temperature =	%capture[3]% degrees Celsius

Information Alert Results
The output of the Temperature Content Generator was designed to be sent by email.

Sensor location:	Ambient
Chassis location:	Main System Chassis
Temperature =	degrees Celsius

Top of page

When the Monitor is in an Up state, test results are reported as shown in the example below:

listening

listening - The Monitor is listening for incoming SNMP Traps.

Note: To view the Last Result reported by the Monitor, access ipMonitor's Real Time and Historical Reports interface. Select Real Time Status Reports, and then choose the NOC View or Details View option.

Top of page

Since the SNMP Trap QA Monitor is a non-polling event-based Monitor, it does not track uptime, downtime or response times. Therefore, Timing Parameters do not apply to the SNMP Trap QA Monitor.

For information on settings common to all Monitor types, such as Identification, Notification Control and Recovery Parameters, refer to General Monitor Settings.