How to trouble shoot if a trap is being received in Spectrum

Products

• CA Spectrum
• DX NetOps

Issue/Introduction

How to trouble shoot if a trap is being received in Spectrum and if so, what data it contains and the event it raises.

Environment

DX NetOps Spectrum all releases

Cause

If a device is sending traps to the SpectroSERVER and the user is not seeing them in OneClick, you can send a debug action to the SpectroSERVER to toggle runtime tracing of alerts.

Incoming alerts can either be traced by IP address, a matching trap OID prefix or even all alerts without any filtering.  Whenever an alert is received, the SpectroSERVER will also print details about how the alert is handled and print messages to the file:

$SPECROOT/SS/VNM.OUT

If an event is generated for the alert, the event code and model handle will be printed as well.

Resolution

First, login to the VNM shell on the SpectroSERVER command line (CLI - bash -login in Windows):

cd $SPECROOT/vnmsh

Then run;

./connect

Then, to add an alert trace item, send the following action to the VNM model: 0x10245

Example, via CLI: ./update action=0x10245 mh=<VNM_Model_Handle>

The action to stop the trace is: 0x10246

So, to stop: ./update action=0x10246 mh=<VNM_Model_Handle>

Both actions will take up to two optional parameters, where you can specify the IP and/or trap OID to trace. The trace types are identified by the attribute ID, with ID '0' signifying an OID trace (trap OID must start with the debug OID to be traced), and ID '1' specifying an IP address (all traps having that IP will be traced). Both options can be used together, which will then trace a specific OID (or a set starting with the debug OID) for a specific device. More general options (e.g. trace all traps from IP X) will supersede less general ones (trace only trap A from IP X).

Examples: To turn on all debug you would use:

./update action=0x10245 mh=<VNM_Model_Handle>

To turn on debug for alert 1.3.6.1.4.10.1.1:

./update action=0x10245 mh=<VNM_Model_Handle> index=0,attr=0,type=0x12,val=1.3.6.1.4.10.1.1

To turn off debug for IP xx.xx.xx.x:

./update action=0x10246 mh=<VNM_Model_Handle> index=0,attr=1,type=0x13,val=xx.xx.xx.x

To turn on debug only for alert OID 1.3.6.1.4.11.1 and IP 1.2.3.4:

./update action=0x10245 mh=<VNM_Model_Handle> index=0,attr=0,type=0x12,val=1.3.6.1.4.11.1 index=1,attr=1,type=0x13,val=1.2.3.4

Then to turn off debug for alert OID 1.3.6.1.4.11.1 and IP 1.2.3.4:

./update action=0x10246 mh=<VNM_Model_Handle> index=0,attr=0,type=0x12,val=1.3.6.1.4.11.1 index=1,attr=1,type=0x13,val=1.2.3.4

Additional Information

If this debug does not show the trap that is being sent from the device, we would recommend that you start a sniffer trace on the SpectroSERVER and reproduce the issue. Once complete, please feel free to open a CA Support Ticket and we would be glad to review the packet data.