[Xymon] Phantom trap alerts?

[David Baldwin]

Betsy,
> On Tue, Mar 12, 2013 at 5:44 PM, Jeremy Laidman
> <jlaidman at rebel-it.com.au> wrote:
>> On 12 March 2013 21:54, Betsy Schwartz <betsy.schwartz at gmail.com> wrote:
>>> We have one class of device (exadata storage cels)  , and one single
>>> server out of hundreds, for which we occasionally get bogus trap
>>> alerts.
>>
>> Are you talking of SNMP traps?
> Yes, we don't use them at all, and then out of the blue we'll get a purple:
>
> clear Thu Feb 16 10:31:22 2012
> Unknown trap (.1.3.6.1.4.1.111.16.2.0.1)
SNMP traps are event-based notifications. If you follow the recipe
http://cerebro.victoriacollege.edu/hobbit-trap.html for setting up trap
notifications using snmptt/sec/etc part of the config requires have a
poller that checks for expiring (soon to go purple) trap status messages
and sends a clear "no traps" message to prevent that.
> We've only gotten them for one particular linux host, plus several
> Exadata cels.  The above OID is from an exadata cell and does appear
> to be from an Oracle Exadata mib . But why would the xymon server,
> only occasionally, get one of these when SNMP is not enabled? I'm not
> running devmon, not sure what other ways there are to have Xymon pick
> up an snmp alert?
It absolutely requires some test to generate these. Check the IP address
of the originating server that sent the trap status message, then check
what tests are running from there. Might also be worth checking Ghost
Clients to see if there are more of these that you don't know about.

devmon does not do SNMP traps in any way. It is SNMP polling only.

David.

-- 
David Baldwin - Senior Systems Administrator (Datacentres + Networks)
Information and Communication Technology Services
Australian Sports Commission          http://ausport.gov.au
Tel 02 62147830 Fax 02 62141830       PO Box 176 Belconnen ACT 2616
david.baldwin at ausport.gov.au          Leverrier Street Bruce ACT 2617


-------------------------------------------------------------------------------------
Keep up to date with what's happening in Australian sport visit http://www.ausport.gov.au

This message is intended for the addressee named and may contain confidential and privileged information. If you are not the intended recipient please note that any form of distribution, copying or use of this communication or the information in it is strictly prohibited and may be unlawful. If you receive this message in error, please delete it and notify the sender.
-------------------------------------------------------------------------------------