How to generate readable alerts based on SNMP traps in MOM 2005


image This article describes how to configure a Microsoft Operations Manager 2005 Management Server or a MOM 2005 Agent to generate a readable alert when an SNMP trap is received. This allows you to monitor SNMP-enabled devices and applications by configuring them to send traps to MOM.  The article does not cover sending SNMP traps from MOM 2005 to a third-party ticketing system as an alert response.

There is MOM 2000 documentation that describes how to generate a MOF file from a MIB using smi2smir.exe. These documents describe compiling the MOF and using the SNMP WMI Provider to translate received traps into alerts. This process is unreliable and unnecessary. The smi2smir.exe is a Windows 2000 utility that is no longer supported. Also, the utility doesn’t work with most newer MIB files because the standard has been updated since the development of smi2smir.exe.

This article contains a VBScript that will parse a trap received by the SNMP WMI Provider. You can use the script as a response in a MOM 2005 rule. The script will generate an event with a numbered list of every parameter in the trap.

Once you know the event parameters, you can modify the rule to generate an alert with the desired parameters in the Alert Source, Alert Description and Custom Fields.

To use the script, install the SNMP Service and WMI SNMP Provider on the management server or agent that will act as the trap catcher. To do this on Windows Server 2003, open Add or Remove Programs, click Add/Remove Windows Components and select the Simple Network Management Protocol and WMI SNMP Provider components from the Management and Monitoring Tools category. To do this on Windows Server 2008, open Server Manager, click Add Features and select SNMP Service and SNMP WMI Provider in the Add Features Wizard.

The next step is to configure the service to receive traps from the SNMP device(s). To do this, open the Services snap-in, double-click the SNMP Service, click the Security tab and add the community name and IP address of each monitored SNMP device under "Accepted community names" and "Accept SNMP packets from these hosts", respectively.

After you install and configure the service, create an event rule to run the VBScript response when an SNMP trap is received.

When you create the rule, select the rule type that says "Alert on or Respond to Event (Event)". For "Provider name", select SNMP Trap Catcher. Do not make any changes on the Criteria, Schedule, Alert and Alert Suppression tabs. On the Responses tab, click Add and then click "Launch a script". For "Script name", click New. Enter a name for the script, such as SNMP Trap Response. Click Next and paste the contents of the below script:

Option Explicit
Const EVENT_TYPE_INFORMATION = 4
Dim oTrap, oEvent, sComputer, sDomain, i, sDescription  
Set oTrap = ScriptContext.Event
Set oEvent = ScriptContext.CreateEvent()
sComputer = ScriptContext.TargetNetbiosComputer
sDomain = ScriptContext.TargetNetbiosDomain 
For i = 1 to oTrap.EventParameterCount
  sDescription = sDescription & Chr(13) & "Parameter " & i & ":  " & oTrap.EventParameter(i)
Next 
With oEvent
  .EventSource = "SNMP Trap Catcher"
  .EventNumber = 1349
  .EventType = EVENT_TYPE_INFORMATION
  .LoggingComputer = sComputer
  .LoggingDomain = sDomain
  .Message = sDescription
End With 
ScriptContext.Submit(oEvent) 
Set oEvent = Nothing
Set oTrap = Nothing

Create a computer group that contains only the trap catcher and associate the computer group with the rule group where you created the rule.

You can use trapgen.exe to generate test traps, if necessary. The following Web site has download links and a user guide:

http://www.ncomtech.com/trapgen.html

When you send a trap to the trap catcher, the script will submit a MOM event. You will see the event in the Events view of the MOM 2005 Operator Console. The Source will be "SNMP Trap Catcher" and the Event Number will be 1349. The Description will contain a numbered list of the event parameters. View the list to determine which event parameters you are interested in.

Once you know the event parameters, double-click the rule to modify it. On the Responses tab, select the script response and click Remove. On the Alert tab, enable the "Generate alert" option. Delete $Source Name$ and $Description$ from the "Alert source" and Description boxes. Click the arrow buttons to add the desired fields and parameters from the event.

On the Alert Suppression tab, enable the boxes for Alert Description and Alert Source, if desired. This way, traps with unique values will generate new alerts instead of updating the repeat count.

Be aware that alerts generated this way will only return the first 25 parameters of the SNMP WMI event. If you need Parameter 26 or above to be in the alert, you have to use a script to generate the alert. In this case, disable the "Generate alert" option in the rule and use a script response that submits an alert with the desired event parameters. Here is an example script:

Option Explicit
Dim oEvent, oAlert, sDescription
Set oEvent = ScriptContext.Event
sDescription = "The interesting value from the trap is: " & oEvent.EventParameter(26)
Set oAlert = ScriptContext.CreateAlert()
oAlert.Name = "SNMP Trap Received"
oAlert.Description = sDescription
oAlert.AlertLevel = 50
oAlert.Owner = "[unassigned]"
oAlert.ResolutionState = 0
ScriptContext.Submit(oAlert)
Set oEvent = Nothing
Set oAlert = Nothing

Michael Sadoff | Senior Support Escalation Engineer

clip_image001 clip_image002

Bookmark and Share

Comments (2)

  1. John Puskar says:

    Is there a way to do this with OpsMgr 2012 R2?

  2. show box says:

    Thanks for the great info. I really loved this. I would like to apprentice at the same time as you amend your web site, how could i subscribe for a blog site?
    For more info on showbox please refer below sites:
    http://showboxandroids.com/showbox-apk/
    http://showboxappandroid.com/
    Latest version of Showbox App download for all android smart phones and tablets.
    http://movieboxappdownloads.com/ – It’s just 2 MB file you can easily get it on your android device without much trouble. Showbox app was well designed application for android to watch movies and TV shows, Cartoons and many more such things on your smartphone.
    For showbox on iOS (iPhone/iPad), please read below articles:
    http://showboxappk.com/showbox-for-ipad-download/
    http://showboxappk.com/showbox-for-iphone/
    Showbox for PC articles:
    http://showboxandroids.com/showbox-for-pc/
    http://showboxappandroid.com/showbox-for-pc-download/
    http://showboxforpcs.com/
    There are countless for PC clients as it is essentially easy to understand, simple to introduce, gives continuous administration, effectively reasonable. it is accessible at completely free of expense i.e., there will be no establishment charges and after establishment
    it doesn’t charge cash for watching films and recordings.
    http://www.showboxforipad.org/showbox-apk/ Not simply watching, it likewise offers alternative to download recordings and motion pictures. The accompanying are the strides that are to be taken after to introduce Showbox application on Android. The above
    all else thing to be done is, go to the Security Settings on your Android telephone, Scroll down and tap on ‘Obscure sources’.
    http://www.showboxforipad.org/
    http://movieboxappdownloads.com/moviebox-apk-android/
    http://movieboxappdownloads.com/download-moviebox-pc/
    Movie Box, an esteemed movies application in which you can find stacks of programs and films. The guide is given here to download Movie Box app to Android and to Apple iOS 9.0.2, iOS 8.4/8.3 and also for the lower versions without Jailbreak.
    http://showboxforiphone.org/
    Please do login to Showbox application with the help of Ymail. You can login in Ymail from here –
    http://ymaillogintips.com/
    Sign Up & Do registration for latest movies on Showbox application