1. BMC Patrol Integration with HP OMi SNMP Traps

Transcription

1 1. BMC Patrol Integration with HP OMi SNMP Traps Use the Patrol agents to monitor servers and send SNMP Traps to HP Operations Agent. SNMP Traps intercepted by HP Operations Agent will be converted into events and will be forwarded to HP OMi for Event Correlation and Incident Creation Configuring SNMP Interceptor Policies SNMP interceptor policies enable you to monitor devices that send SNMP notifications (for example, printers, routers, computers with unsupported operating systems) to the HPE Operations Agent. SNMP interceptor policies enable you to filter SNMP notifications through rules. Each rule consists of a condition definition, and optionally an event definition. When an SNMP notification matches your conditions, you can create an event Receiving SNMP Notifications SNMP interceptor policies enable you to filter SNMP notifications that other devices send to a node that runs HPE Operations Agent. HPE Operations Agent has a built-in SNMP interceptor daemon or service (called opctrapi), which accepts SNMP notifications on port 162 by default. Therefore, in many cases, you can configure your SNMP devices to send notifications to port 162 on the node that runs HPE Operations Agent. If port 162 is already in use by another process (for example the Microsoft SNMP Trap service or the Linux snmptrapd daemon), opctrapi cannot start. In this case, you can reconfigure opctrapi to use a different port by setting the SNMP_TRAP_PORT agent configuration variable (in the eaagt namespace). You must also configure your SNMP devices to send notifications to the same port. Alternatively, for nodes that run a Windows operating system, you can configure opctrapi to subscribe to the Microsoft SNMP Trap service. However, this configuration provides only SNMPv1 traps. To configure opctrapi to subscribe to the Microsoft SNMP Trap service, complete the following steps: a) Open a command prompt, and then type: ovconfchg -ns eaagt -set SNMP_SESSION_MODE WIN_SNMP b) Restart the SNMP interceptor: ovc -restart opctrapi For more information about the available SNMP configuration variables and how to set them, see the Operations Agent Reference Guide Create an SNMP Interceptor Policy 1. In the SNMP Policy Editor, in the Properties page, type a Name for the policy. Optional. Provide a description of the policy (Description), select the instrumentation that will be deployed with the policy onto the host system where the agent is running (Instrumentation), and select the operating systems with which the policy is compatible (OS Types). 2. Optional. In the Defaults page, set default attributes for all events that a policy sends. The event defaults only affect new rules. You can override the defaults for individual rules.

2 3. In the Rules page, define one or more policy rules In the Policy Rules list, click the button, and then click one of the following options: a) Event on matched rule: Use this option if you want to send an event to OMi when the conditions are met. b) Suppress on matched rule: Use this option if you want to stop processing the policy when the conditions that you specify are met. c) Suppress on unmatched rule: Use this option if you want to stop processing the policy when the conditions that you specify are not met Click the Rule Description and type a brief description of the rule. 4. In Rule Content, use the Condition tab to define values that you want to evaluate against SNMP notifications that arrive at the agent. The attributes that are available in the Condition tab correspond to the attributes that an SNMP notification may contain. You can enter pattern matching expressions and policy parameters in the text boxes. For example, to match generic linkdown traps from , set the following attributes: Node: SNMPv1 notation (selected) Generic ID: linkdown 5. in the Condition Variable Bindings tab, select the variable bindings you want the policy to evaluate, and write one or more match patterns for each binding. You can use pattern-matching rules and policy parameters when matching variable bindings. For example, in many SNMP notifications, $2 contains the hostname of the sender. To match events only from systems in the domain example.com, do the following: Click the button. In Variable, type 2. In Pattern, type <*>.example.com. 6. Click Save and Close to save the policy template and exit the wizard Configuring the SNMP Trap Interceptor By default, the SNMP trap interceptor can collect SNMP traps originating from remote management stations or SNMP-enabled devices, and then can generate appropriate events based on the configuration. You can modify the default behaviour of the SNMP trap interceptor by configuring the following properties: SNMP_TRAP_PORT: The default port is 162. You can modify this value to any available port on the HPE Operations Agent node. SNMP_TRAP_FORWARD_DEST_LIST: Use this property to set the address of the remote management station where you want to forward all the available SNMP traps. You can specify multiple system names (with port details) separated by commas SNMP_TRAP_FORWARD_ENABLE: By default, this property is set to FALSE. By setting this property to TRUE, you can enable the SNMP trap interceptor to forward the SNMP traps available on the HPE Operations Agent node to remote machines or management stations.

3 SNMP_TRAP_FORWARD_COMMUNITY: Use this property to specify the community string of the source machines of the incoming traps and the target machine where you want to forward the SNMP traps. The community strings of the source machines must match with the community strings of the target machines. SNMP_TRAP_FORWARD_FILTER: Use this property to filter the available SNMP traps by their OIDs and forward only the select traps to the remote machine. The filtering mechanism takes effect with the wildcard (*) character. For example, if you set this property to *.*.*, the SNMP trap interceptor will forward all the SNMP traps with the OIDs that begin with By default, all the available traps are forwarded when you enable the SNMP trap interceptor to forward traps. To modify the default behaviour of the SNMP trap interceptor, follow these steps: 1. Log on to the node with the necessary privileges. 2. In the command prompt, run the following commands: To modify the port number, run the following command: ovconfchg -ns eaagt -set SNMP_TRAP_PORT <port_number> You must specify an integer value for <port_number>. Make sure the specified <port_number> is available for use. To enable the SNMP trap interceptor to forward SNMP traps to remote machines, run the following command: ovconfchg -ns eaagt -set SNMP_TRAP_FORWARD_ENABLE TRUE If you enable the SNMP trap interceptor to forward SNMP traps to a remote machine, run the following command to specify the details of the target machine: ovconfchg -ns eaagt -set SNMP_TRAP_FORWARD_DEST_LIST "<machinename> :< port>" <machinename> is the fully-qualified domain name of the machine where you want to forward the SNMP traps and <port> is the HTTPS port of the machine. If you want to specify multiple targets, separate the machine details with commas. If you want to forward only selected SNMP traps available on the node to the remote machine, run the following command: ovconfchg -ns eaagt -set SNMP_TRAP_FORWARD_FILTER "<OID Filter>" Is an OID with the wildcard characters. The SNMP trap interceptor filters the traps that match the specified OID (with the wildcard characters) from the available traps, and then forwards them to the target machine Sending SNMP traps based on PATROL Events To use the Agent to send SNMP traps based on PATROL events, you must enable them in the agent configuration Destination of SNMP PEM-based traps The recipient list of SNMP traps is set in the Agent configuration. The /snmp/piv1m_list variable contains a comma separated list of host names and/or IP addresses, which represent SNMP trap destinations. The

4 PATROL SNMP subagent uses this variable with the /snmp/trapmibtable variable to bypass the PATROL SNMP Master Agent and send traps directly to SNMP Managers stored in this variable. The /snmp/piv1m_list configuration variable specifies which SNMP managers receive traps from the PATROL Agent. Minimum maximum and An entry for a manager consists of host name, port number, and read community name. Items in an entry are separated by a forward slash (/). Entries must be separated with a comma. host/port/r_community_string "" (empty string = no managers) Table 1 Destination of SNMP PEM-based traps /snmp/trapmibtable uses this list to send traps directly to SNMP Managers listed in this variable The port number must correspond to the /snmp/trap_port Filter Events Based on Patrol Attributes We can filter events based on the following Patrol Attributes 1. Filter events based on PATROL event description 2. Filter traps based on PATROL Event class 3. Filter traps based on PATROL event ID 4. Filter traps based on PATROL Event severity level 5. Filter traps based on PATROL event status 6. Filter traps based on PATROL event type 1.4. Set SNMP trap format The PATROL Agent can send SNMP trap information in two different formats. To select a format, set the variable of the desired format to yes and set the variable of the other format to no. Format The /AgentSetup/pemIssueV31traps configuration variable determines whether PATROL uses version 3.1 formats to send SNMP traps. Table 2 Set SNMP trap format Boolean, yes or no Yes

5 1.5. SNMP support based on PATROL Event Manager The /AgentSetup/pemSnmpSupport configuration variable determines whether PATROL Events trigger SNMP events. Table 3 SNMP support based on PATROL Event Manager Boolean, yes or no Yes 1.6. Specify a time period to send traps based on PATROL Events To send traps based on PATROL Events during a particular time period, you can set the /AgentSetup/pemPFSnmpStartTime and /AgentSetup/pemPFSnmpEndTime configuration variables. Start time The /AgentSetup/pemPFSnmpStartTime configuration variable specifies the start of the monitoring period. MMddhhmm [yy] MM month dd day hh hour mm minutes yy years (optional) "" (all the time) AgentSetup/pemPFSnmpEndTime specifies the end of the monitoring period Table 4 Time period to send traps - Start Time End time The /AgentSetup/pemPFSnmpEndTime configuration variable specifies the end of the monitoring period. MMddhhmm [yy] MM month dd day hh hour mm minutes yy years (optional) "" (all the time)

6 AgentSetup/pemPFSnmpStartTime specifies the start of the monitoring period Table 5 Time period to send traps - End Time 1.7. Specify the node name where the trap originated The /AgentSetup/pemPFSnmpNode configuration variable specifies the name of the node where the event occurred. Presently, this variable does not have any effect because all events originate from the Agent's node. It is reserved for future use. Table 6 Specify the node name where the trap originated Text string, node name "" (any node)