SNMP forwarding issue

Solved1.12K viewsSNMP forwarding
2
0 Comments

Hi,
we are currently facing an issue in which DataMiner is not forwarding information to our north bound interface, this is how we currently have it set:

However, when we do a wireshark capture, filtering the upd port,  there is no packets going to that IP:

The expectation would be to see some packets going to that IP using port 1210 like in this image:

Do you have any suggestions about where to start looking to troubleshoot this issue?

***update***
After running Leander's recommendation to find the issue:
I can see the alarm created, but its not being forwarded:

And my filter matches the condition of the alarm:

***Update****
This is the whole alarm filter:

Thanks!
Carlos

Marieke Goethals [SLC] [DevOps Catalyst] Selected answer as best 19th July 2023

1 Answer

4
1.95K 4 Comments

In order to further troubleshoot, I would recommend to first check the SNMP Agents logs, which indicates if DataMiner is successfully sending out the SNMP v3 traps.

Specific information is only displayed as debug logs, so you will need to adjust the log settings of the DataMiner process to Development logging . It is advised to set the level back to the default log level once you have finished your investigation.

You can check the log file on the DataMiner Agent on which the element resides that is raising the alarms that match your SNMP forwarding filter criteria.

As shown in following screenshot, a log line is created for each successful SNMP v1/v2/v3 trap that is sent by DataMiner.

Secondly, also ensure also that the filter that you have defined does match alarms that need to be forwarded. I typically also add this specific alarm filter in an additional alarm tab of the alarm console, just to see which alarms it contains. That is a simple confidence check to ensure that your filter has been correctly composed.

** Update

As indicated in the comments, please find below an example of an alarm that meets the filter conditions. The 'Adding alarm to SNMP Manager(s)' indicates a matching filter criteria.

Marieke Goethals [SLC] [DevOps Catalyst] Selected answer as best 19th July 2023
Carlos Trejo commented

Hi Leander,

Thank you very much for your prompt response. I have set the log level to developer to try to see what’s going on and I can see the alarm I want being generated, however I can’t see it being forwarded to the IP destination I have set.

Also, I have checked my filter, and it is set to match the regular expression of the information event that has been created. So I’m not sure what else needs to be checked.

I have edited the original post with the outputs of the log after changing it to developer and showing my filter.
Leander Druwel [SLC] [DevOps Advocate] commented

Did you try adding the exact same filter also in an additional tab page of the alarm console, just to have a certainty that the information events do actually match the conditions?

If the alarm meets the SNMP filter criteria, an additional log line should be displayed, indicating that this alarm is added to the SNMP Managers (example update in previous answer). It confirms that this specific alarm will be forwarded. As I don’t seem to find that line into your post, I would tend to believe it is somewhere related to the filter condition.

Is it maybe an option to simplify the filter criteria (or duplicate the manager), and test if traps are being sent out with a simple filter condition?
Miguel Obregon [SLC] [DevOps Catalyst] commented

Hi Carlos,
I checked your filter and I noticed that you are using ‘Matches regular expression’. Can you change this option to ‘Matches wildcard expression’?
And can you add a wildcard at the beginning/end of your value (e.g. *Heartbeat Netcool*)
Carlos Trejo commented

Thank you very much Leander and Miguel,

I have followed the suggestion to simplify the filter to see if it forwards simple conditions. The whole alarm filter is based on 2 major conditions ( image updated in the initial post). So after doing some testing, I can get the messages forwarded to the NBI whenever I removed one of the conditions after the “And”.

So summarizing this, DataMiner forwards the messages to the northbound interface when:

a) Alarm filter Is DMA1 And Is Netcool Alarms.
b) Alarm filter Is DMA1 And Is Netcool Heartbeat.

So having those individually set work with no issue, the problem comes when Netcool Alarms and Netcool Heartbeat are under the same “And(” Which shouldn’t be an issue, because we are using an “Is” and an “Or”.

This exact alarm filter is working in other DMAs we have.

Any ideas as to where to check?

Thanks,

Carlos