Classifying SNMP Traps

To classify an SNMP trap event:
  1. From the Event Console, select the unknown event or events.
  2. Click the Reclassify an event icon. The Classify Events dialog appears.
  3. Select /App, and then click Submit.

    To edit this classification:

    1. From the Navigation area, select Events > Event Classes.
    2. Ensure Mapping Instances appears.
    3. Select the event map you created.
    4. In the left panel, select Edit from the Action icon.

      The edit page appears. This page contains rules used to map the event to the /App category. This rule, since it matches the trap by a specific OID, is all that is needed.

      In the Transform area, you can enter code to modify the summary. For example, if you want to set the summary string to "Spam Filter Detects Virus," then you can enter:

      evt.summary = "Spam Filter Detects Virus"

      A trap has a header with some standard information, followed by a sequence of attribute/values.

      You have indicated you want the value for the OID "." as the summary. If you had the MIB loaded, you could do this:

      evt.summary = evt.spamFilterDetectsVirus

      However, the OID and the data is still in there. Instead, use the slightly more cryptic:

      evt.summary = getattr(evt, ".", "Unexpected missing OID")

      The "device" object for the event has been made available, as well:

      evt.summary = getattr(evt, ".", "Unexpected missing OID") \ + " from device " + device.getId()

      Resource Manager uses MIBs to translate SNMP traps that contain raw OID values. Loading a MIB into the system allows it to translate numeric OIDs such as . into descriptive phrases like “sysLocation”. It also makes it easier to manipulate the events in an event mapping.

      Figure 103. SNMP TRAP Transform ../images/snmptrapandtransform.png

      Following is a small demonstration MIB.

      ucdavis FROM UCD-SNMP-MIB 
      demonotifs OBJECT IDENTIFIER 
      ::= { ucdavis 991 } 
      demo-notif NOTIFICATION-TYPE 
      OBJECTS { sysLocation } 
      STATUS current 
      DESCRIPTION "Just a test notification" 
      ::= { demonotifs 17 }