SNMP traps and MIB file management

The IMS has the capability to listen for SNMP traps and map in MIB file data; when an SNMP trap is received, attempts to map OIDs to MIB names and enumerate raw values to named values will be made before storing the SNMP trap in the Device Log.

Some prerequisites for all this to work are:

  • IMS instance has SNMP trap listener provisioned (with SNMPv2c/SNMPv3 configurations as necessary)
  • IMS instance has FileBrowser deployed for MIB file management
    • Your FileBrowser instance should be available at (your IMS instance web address)/filebrowser or (your IMS instance web address):4201/filebrowser]
  • IMS instance has the MIB files required to map in the OIDs and enumerated values

If you're unsure of the above, please get in touch with us and we'll take a look.

Configuring an IP device for SNMP traps

To configure an IP device for SNMP traps, first the device itself must be physically configured to report SNMP traps to your IMS instance (in accordance with the IMS SNMP trap listener configuration, e.g. SNMPv2c or SNMPv3 with specific authentication and privacy settings).

By default, the port to report traps to is UDP port 162 (so you'll need to ensure such a firewall flow is permitted from your IP device to the IMS instance).

Once the above is taken care of, all that remains is to integrate the IP device against the SNMP trap listener; the steps are as follows:

  • Locate the IP device either in the Manage Tab or through the Assets Center Panel
  • Edit the IP device
  • Change to the Integrations tab
  • Enable the “SNMP trap receiver instance” integration
    • Without this, traps will be received for this IP device (but thrown away)

And in picture form, taking the Assets Center Panel path:

Viewing received SNMP traps

To view the SNMP traps, change to the Device Log tab and filter by an IP device you know to be reporting traps (or a MIB data term); for example:

Here is an explanation of the data within the row:

  • IP device
    • The IP device that was mapped (using the source address of the SNMP trap)
  • Timestamp
    • The time the trap was received (SNMP traps don't include an absolute device timestamp)
  • Log level
    • Always “trap”
  • Service name
    • Always “snmp”
  • Log file name
    • The base OID of the SNMP trap
  • Log text
    • The contents of the SNMP trapped, mapped against the MIB (if possible)

To expand on “Log text”; the makeup of an SNMP trap is always as follows:

  • RFC1213-MIB.sysUpTime (system uptime in hundredths of a second)
  • Base OID of the SNMP trap
  • (one or more OID-value pairs- this is the content of the SNMP trap)
    • OID (within the base OID)
    • Value for SNMP OID

So, if we look at the “Log text” from the top row in the screenshot, it splits out into:

  • RFC1213-MIB.sysUpTime=252291464 (29 days, 4:48:34.640000);
  • SNMPv2-MIB.snmpTrapOID=.1.3.6.1.4.1.9.9.41.2.0.1;
  • (five OID-value pairs)
    • CISCO-SYSLOG-MIB.clogHistFacility=SW_MATM;
    • CISCO-SYSLOG-MIB.clogHistSeverity=warning;
    • CISCO-SYSLOG-MIB.clogHistMsgName=MACFLAP_NOTIF;
    • CISCO-SYSLOG-MIB.clogHistMsgText=Host 4049.0f1c.0991 in vlan 9 is flapping between port Gi1/0/22 and port Gi1/0/20;
    • CISCO-SYSLOG-MIB.clogHistTimestamp=252291464

Triggering on SNMP traps

Triggering on SNMP traps is the same as trigger on Syslog data (as it's just triggering on “Log text”); see the Device Log for an explanation.

MIB file management

To manage MIB files, as above, navigate to (your IMS instance web address)/filebrowser or (your IMS instance web address):4201/filebrowser].

The default credentials are:

Username: admin
Password: admin

Once there, simply upload (or remove) MIB files. MIB files can be organised into folders if desired.

The IMS has a MIB manager service as part of the backend that is configured to re-read the MIB folder every 30 seconds.

An example of the FileBrowser user interface is as follows: