Oncommand5 -> Openview - SNMP traps changed by DFM?

[aoral]

Hi colleagues,

the customer has the following environment:

Filer (N-Series) being monitored by DFM (Oncommand 5).

DFM is configured to send traps to the Openview server

Filer ---> SNMP TRAPS --> DFM --> SNMP TRAPS --> Openview

The traps received by Openview dont match with the Filer MIB.

Seems like DFM is changing the "general ID" of the MIB -

The "GENERAL ID" is changed from "6" to "3".

---------------------------------------------------------------------------------------------------------

Here an example for "volume full", this is the original filer MIB:

DESCRIPTION          volumeFull

OID:                         .1.3.6.1.4.1.789

GENERAL ID         6

Spec. ID:               82

This is what Openview receives:

lNO TRAPD.CONF FMT FOR .1.3.6.1.4.1.789.3.0.10013 ARGS(19):
[1] private.enterprises.netapp.netappDataFabricManager.1.0 (OctetString): 1-50-014454
[2] private.enterprises.netapp.netappDataFabricManager.11.1.9.29295 (OctetString): 2858132019022
[3] private.enterprises.netapp.netappDataFabricManager.11.1.1.29295 (Integer): 29295
[4] private.enterprises.netapp.netappDataFabricManager.11.1.5.29295 (OctetString): Volume Full
[5] private.enterprises.netapp.netappDataFabricManager.11.1.3.29295 (Integer): 4
[6] private.enterprises.netapp.netappDataFabricManager.11.1.4.29295 (Integer): 1347283951
[7] private.enterprises.netapp.netappDataFabricManager.11.1.6.29295 (OctetString): Error event on HOST:/v_test (Volume Full)
[8] private.enterprises.netapp.netappDataFabricManager.11.1.7.29295 (OctetString): The volume is 99.27% full (using 159 MB of 160 MB).\nThere is 150 GB of aggregate free space to expand the volume and 448 GB of spare disk space available for expanding the aggregate.

 
----------------------------

Any help would be appreciated.

Thanks,

Arda

[aoral · Accepted solution]

found the answer in the DFM FAQs:

https://library.netapp.com/ecmdocs/ECMM1278640/html/faq/index.shtml#_7.12

7.12 How can I configure HP Openview to see traps sent by the DataFabric Manager server?  [top]

You can find a trap configuration file for HP Openview called dfm.conf, and MIB of all the DataFabric Manager server traps called dfm.mib in misc directory of DataFabric Manager installation. Assuming that you have already loaded netapp.mib into HP Openview, you can load the "dfm.mib" and then load the traps using HPOV command "xnmevents -load dfm.conf".

Refer to HP Openview documentation for more information on loading mibs and traps. You can customize "dfm.conf" before loading to change the format of the display message for the traps. The severity values for all the traps are set to match with default event severities in "dfm.conf".

[niels]

Actually that's because DFM does not forward the initial trap from the controller but generates its own SNMP trap.

regards, Niels

[adaikkap]

DFM can also forward trap from controller if you have set dfm server as the traphost in your controllers. And send those traps to HPOV using alarms created for traps.

Regards

adai

[niels]

Actually that's not "forwarding". DFM will generate e new trap that has nothing to do with the initial trap sent by ONTAP.

It does not reflect the severity the initial trap was sent with and the "source" of the trap will be the DFM server, not the storage controller.

regards, Niels