7

SNMP, MIBs, traps, and alerts

• Working with SNMP and alerts
• SNMP agent
• Default and user-defined alerts

Working with SNMP and alerts

Alerts push system information to administrators by sending messages to a user-defined destination IP address or through email. Alerts can let administrators know the status of the machines so that the administrator does not have to monitor all the systems on the machine. Alerts can also be configured to automatically start scripts or executables based on system events so that the administrator does not have to.

Default alerts work with an SNMP agent (snmpd). The GLOBAL-SITE Controller ships with a customized simple network management protocol (SNMP) agent and management information base (MIB). The MIB contains the GLOBAL-SITE Controller's default alerts. The SNMP agent listens for events and triggers alerts when a preconfigured event occurs.

User-defined alerts that can be manually triggered or can be triggered using a Perl script.

This chapter describes the configuration tasks with which you can configure the GLOBAL-SITE Controller SNMP agent and how to customize default and user-defined alerts.

Warning: You must have prior knowledge and experience with SNMP to understand some of the concepts and terminology in this chapter.

You configure the SNMP agent and alerts through the ITCMconsole or through the Configuration utility.

If you are unfamiliar with the ITCMconsole, please see Chapter 6, ITCMconsole Command Line Interface for more information on the ITCMconsole and a complete listing of SNMP and alert commands and subcommands.

Note: You can find all the commands and subcommands for SNMP and alerts in chapter 6, ITCMconsole Command Line Interface .

SNMP agent

By default, the GLOBAL-SITE Controller runs the SNMP agent (snmpd). You can enable and disable, start and stop the agent, and set the SNMP trap values from the ITCMconsole (see Using the ITCMconsole, on page 6-1 ). You can also set traps values from the configuration utility (see To configure snmpd from the Configuration utility, on page 7-2 ). If you are going to use default alerts, you must add values to the SNMP trap:

• community
  In this case, public
• dest
  The destination IP address that the snmpd sends the trap to when it triggers
• port
  The port that the default alert uses to communicate with the destination IP address

To configure snmpd

The following commands configure the trap values. At the ITCMconsole prompt, type:

service snmpd trap community public
service snmpd trap dest <ip address>
service snmpd trap port <port>

To configure snmpd from the Configuration utility

1. From the navigation pane, on the System tab, click Configure SNMP.
   The SNMP Configuration screen opens.
2. Fill in the information for Client Access, System Information, or Trap Configuration sections as necessary.
3. Click the Update button to save the new configuration.
   
   

   See the online help for this page for details.

   Note: If you run the GLOBAL-SITE option on the EDGE-FX Cache, changes you make to traps are written to the same snmpd.conf file that the cache uses, and the reverse is also true.

MIBs

The GLOBAL-SITE Controller uses several open source MIBs as well as the GLOBAL-SITE MIB, which is a product-specific MIB, to get pertinent data from your GLOBAL-SITE Controller. You can find a text file of the MIB on the Documentation section of the documentation CD, or from the GLOBAL-SITE MIB link on the GLOBAL-SITE Controller main web-based user interface page.

Default and user-defined alerts

There are two kinds of alerts on the GLOBAL-SITE Controller: default alerts and user-defined alerts. Since the snmpd runs by default on your GLOBAL-SITE Controller, the default alerts are already enabled. User-defined alerts are alerts you create to meet your needs. To see all alerts, from the ITCMconsole prompt, type:

show alert all

Figure 7.1 is a sample of the output you receive when you type show alert all from the ITCMconsole prompt.

Using global settings

The alert system was designed with global settings to make modifying default alerts and creating and modifying user-defined alerts faster and easier. For more information on global settings for alerts, please see Changing global settings, on page 6-9 of this guide.

Figure 7.1 Default alerts

 /*Alerts:*/    
      COMMON.trapDiskDriveFailure    
           /*OID*/ ".1.3.6.1.4.1.3375.1.5.110.2.1"    
           /*DESCRIPTION*/ "A disk drive has failed."    
      COMMON.trapFreeVirtualMem    
           /*OID*/ ".1.3.6.1.4.1.3375.1.5.110.2.2"    
           /*DESCRIPTION*/ "There is not enough memory to complete an operation."    
      COMMON.trapExcessiveCpuUsage    
           /*OID*/ ".1.3.6.1.4.1.3375.1.5.110.2.3"    
           /*DESCRIPTION*/ "The CPU usage exceeds its threshold."    
      GLOBALSITE.globalsiteTrapDataDiskFull    
           /*OID*/ ".1.3.6.1.4.1.3375.1.4.110.2.1"    
           /*DESCRIPTION*/ "The data disk is full."    
      GLOBALSITE.globalsiteTrapConfigurationDiskFull    
           /*OID*/ ".1.3.6.1.4.1.3375.1.4.110.2.2"    
           /*DESCRIPTION*/ "The configuration disk is full."    
      GLOBALSITE.globalsiteTrapPublicationSucceeded    
           /*OID*/ ".1.3.6.1.4.1.3375.1.4.110.2.3"    
           /*DESCRIPTION*/ "Publication succeeded."    
      GLOBALSITE.globalsiteTrapPublicationFailed    
           /*OID*/ ".1.3.6.1.4.1.3375.1.4.110.2.4"    
           /*DESCRIPTION*/ "Publication failed."    
      GLOBALSITE.globalsiteTrapPublicationCheckedForNew    
           /*OID*/ ".1.3.6.1.4.1.3375.1.4.110.2.5"    
           /*DESCRIPTION*/ "There is no new version of this publication."   

Default alerts

Default alerts consist of a name and a description. Some default alerts also have an OID (object identifier). Default alerts that have an OID are part of the GLOBAL-SITE MIB and are triggered by events. There are eight default alerts that the following events trigger:

• Disk drive failure
• Insufficient memory to complete an operation
• CPU usage exceeding its threshold
• Full data disk
• Full configuration disk
• Successful publication
• Failed publication
• No new version of a publication

Modifying default alerts

You can add actions to or delete user-defined actions from default alerts, but you cannot delete default alerts, change the name of the default alert, or change the OID. Actions can be either named_action, email, or exec. For example, upon successful publication of a site, the snmpd sends the GLOBALSITE.globalsiteTrapPublicationSucceeded default alert "Publication succeeded" to the destination IP address. You can modify the default alert and add an action to send email to additional people informing them of the successful publication, as well.

To modify a default alert

To modify an alert, you first need to know the name of that alert. Default alert names are fairly long and must be typed accurately. You can also find the names of the default alerts in the GLOBAL-SITE MIB. (You can access this from the GLOBAL-SITE Controller home page or from the Documentation section of the product splash screen.)

Tip: If you are accessing the GLOBAL-SITE Controller from an SSH application, and this application allows you to copy and paste, we recommend you do so.

1. To get the name of the default alert from the ITCMconsole, type:
   
   

   show alert all

2. If possible, copy the name of the default alert you want to modify.
3. From the ITCMconsole, type:
   
   

   alert modify add_action

4. At the prompt for Alert name, paste or type the name of the default alert.
5. Choose which action to add.

• A named_action is an user-defined action that you created previously. (Please see named_action, on page 6-6 for information on creating a named action.) At the prompt, type the name of the named action.
• An email action allows you to send an email (please see email, on page 6-5 for more information). At the prompt, type email.
  
  

  · An exec action allows you to run scripts or executables at the time the alert is sent (please see exec, on page 6-5 ). At the prompt, type exec.

Creating user-defined alerts

From the ITCMconsole, you can create your own user-defined alerts using the alert commands.

The show alert all command displays both default alerts and user-defined alerts. If you modify an alert, you need its name which you get with the show command.

To create or modify a user-defined alert

1. From the ITCMconsole, type:
   
   

   alert add

2. At the prompt for Alert name, type a name for the alert.
3. Choose which action to add.

• A named_action is an user-defined action that you created previously. (Please see exec, on page 6-5 for information on creating a named action.) At the prompt, type the name of the named action you created.
• An email action allows you to send an email. At the prompt, type email (see email, on page 6-5 for more information). The steps that follow ask you for the to address, from address, body text, and if you want to add an attachment, the attachment name.
  
  

  · An exec action allows you to run scripts or executables at the time the alert is sent (see exec, on page 6-5 for more information). At the prompt, type exec. The step that follows asks you for a command to execute when the alert is raised and for a description of the alert.

Triggering user-defined alerts

The alert raise <alert name> <args> command triggers alerts. If you type the command at the ITCMconsole command prompt, the alert triggers right away. You can also put the alert raise command in a bash or a Perl script and have it run that way.