AIQUM and SNMP traps

[jessango]

Hello.

We have configured the use of SNMP traps from an AIQUM instance. 

Is it possible to know when an SNMP trap is generated (for which events)? Is it possible to validate/check in any log file the SNMP traps generated and sent to the trap destination host?
We are trying to send the logs to Splunk but we're having issues, we're almost sure that there is no firewall in the middle blocking connectivity, but we do not get any trap coming from the AIQUM server in Splunk.

Do you know how to generate a test SNMP trap from the AIQUM server?

Any feedback would be appreciated. 

Regards. 

[dawnr]

UM does not have a dedicated log for email and snmp. You can check in the ocie log folder for server.log, and in the ocum log folder for ocumserver.log, you may see failures there if it is not successful.

Otherwise, you can configure an alert with an option to send a snmp trap as well, and test the alert.

Or collect a packet trace if you expect an alert to be triggered that would send a trap.

If this is not an OVA deployment of UM, you could also install an snmp tool and test SNMP from UM to the traphost.

Sending UM OID ocumAlertTest from a RHEL server with net-snmp-utils installed:
[root@dawnr-um ~]# snmptrap -c public -v2c 10.216.25.47 trapoid .1.3.6.1.4.1.789.5.1.0.11111

Received:

For the OVA and Linux deployments, you can try using 'nc' with the UDP switch.
How to check connectivity to SNMP destinations in Active IQ Unified Manager

Log locations:

What are the notable log files and their respective locations for Active IQ Unified Manager?

[dawnr · Accepted solution]

I wrote a new KB for this as well:
How to test sending SNMP Traps from ActiveIQ Unified Manager to a Trap Host