SNMP traps

#Configure the switch

All commands are entered in global config mode (configure terminal) unless marked "interface mode".

configure terminal
snmp-server host 192.0.2.50 securityname public-example
snmp-server traps
end

The per-port commands are refused while the global trap switch is off.

#SNMPv3

Create the user first. Then add a receiver with that user as securityname, and set the version to v3.

configure terminal
snmp-server user nms-example ro auth-alogrithm sha auth-password Example1234 priv-alogrithm aes priv-password Example5678
snmp-server host 192.0.2.50 securityname nms-example
snmp-server traps version v3
end

The full syntax is:

snmp-server user <username> {ro|rw} [auth-alogrithm {md5|sha} auth-password <password> [priv-alogrithm {des|aes} priv-password <password>]] [encry]

• Keyword spelling. The keywords are spelled auth-alogrithm and priv-alogrithm.
• Passwords. 9-15 characters, using letters and digits only.
• Security level. This follows from what you configure: authPriv with both passwords, authNoPriv with only an auth password, noAuthNoPriv with neither.
• Engine ID. v3 traps are sent with the switch's local engine ID. Use it in the receiver's createUser -e.
• Port. v3 traps always go to UDP 162, whatever snmp-server trapport is set to.

#Check

#Wire format

The switch builds each trap as an SNMPv1 trap. For v2c and v3 receivers it converts the trap using the standard RFC 3584 rules:

For example, the down-speed trap (specific 89) arrives at a v2c receiver as snmpTrapOID.0 = 1.3.6.1.4.1.29763.8.1.911.0.89.

#Varbinds

Port number N counts ports in the switch's front-panel order, starting at 1. For example, on a GL-24xEP, 1-24 are Ethernet0/1-Ethernet0/24 and 25-26 are the fiber ports.

#Trap reference

Every enterprise trap uses generic-trap 6 (enterpriseSpecific) and enterprise 1.3.6.1.4.1.29763.8.1.911. MIB names are from RL-GHN-COAX-MIB.

#Switch

alarminfor text formats. The switch fills in %s with the client IP, user, or port, and %d with a number:

A web login trap is sent the first time a client IP opens a session. A web logout trap can arrive up to about two minutes after the user logs out or the session times out.

#Ports

At v2c/v3 receivers these arrive as snmpTrapOID.0 = 1.3.6.1.6.3.1.1.5.3 (linkDown), .4 (linkUp), and .1 (coldStart). The link traps carry only ifIndex.N. They don't carry ifAdminStatus or ifOperStatus.

#G.hn endpoints

Each of these carries the varbinds ifIndex.N (the G.hn port), mac and name (the endpoint), and an empty location.

Specific traps 66 and 67 are enterprise traps. They are not the standard linkUp/linkDown traps, although the MIB uses the same names. Match them on the full OID, 1.3.6.1.4.1.29763.8.1.911.0.66 and .0.67.

#PoE

Each of these carries the varbinds alarminfor, ifIndex.N, and ifDescr.

#RMON threshold traps

An RMON alarm whose rising or falling event has type trap or log-trap sends a trap when it crosses its threshold. These traps use a non-standard v1 layout:

For example, a rising alarm on ifInOctets of port 3 has enterprise 1.3.6.1.2.1.2.2.1.10 and specific-trap 3. At v2c/v3 receivers these arrive with snmpTrapOID.0 = 1.3.6.1.6.3.1.1.5.65 (rising) or 1.3.6.1.6.3.1.1.5.66 (falling), followed by snmpTrapEnterprise.0 set to the variable's OID prefix.

configure terminal
rmon
event index 1 type log-trap community public-example description in-octets owner noc
alarm index 1 port <port> variable 0 sample-type delta startup rising rising 60000 1 falling 1000 1 interval 60 owner noc
end

variable ? lists the variables you can sample. For example, 0 is InOctets, 4 is InErrorPks, and 16 is RMONCRCAlignPks. Thresholds are 1-65535. The interval is 1-65535 s.

#Thresholds

• Value order. For temperature and CPU, the normal value must be lower than the alarm value. For memory, which is free memory, it must be higher.
• Reset to defaults. no alarm switch {cpu|memory|temperature} restores the defaults.
• Show. show alarm shows the switch thresholds.
• G.hn. The alarm ghn commands work only on switches with G.hn ports.

#Down-speed alarm

The down-speed alarm (specific 89) is set per RJ45 port, in interface mode:

interface ethernet <port>
speed auto-max 2500

The alarm is checked each time the link comes up. It has no clear event. no speed restores the port's default speed setting.

#MIB files

Load RL-GHN-COAX-MIB to decode every trap and varbind on this page. It imports only the standard RFC1155-SMI, RFC-1212, RFC1213-MIB and RFC-1215 modules, which ship with net-snmp.

RL-GHN-COAX-MIB and RL-GHN-MIB define the same traps. If you load both, the receiver may show either module's name for a trap.

Also defined in the MIB, but not sent by the switch: rliTemperature-Alarm (61), rliPower-Alarm (62), rliFan-Alarm (63), rliRisingThreshold-Alarm (64), and rliFallingThreshold-Alarm (65). RMON traps use the format above.

#Receiver example (net-snmp)

/etc/snmp/snmptrapd.conf:

# v1 / v2c: accept and log traps with this community
authCommunity log,execute public-example

# v3: user and engine ID must match the switch
createUser -e 0x80007443 nms-example SHA Example1234 AES Example5678
authUser log,execute nms-example

# Optional: run a script for the down-speed alarm
traphandle 1.3.6.1.4.1.29763.8.1.911.0.89 /usr/local/bin/rlos-downspeed.sh

Copy the MIB into the MIB path and start the receiver:

sudo cp RL-GHN-COAX-MIB.mib /usr/share/snmp/mibs/
sudo snmptrapd -f -Lo -m +RL-GHN-COAX-MIB

Example output for a v2c down-speed trap:

DISMAN-EVENT-MIB::sysUpTimeInstance = Timeticks: (123456) 0:20:34.56
SNMPv2-MIB::snmpTrapOID.0 = OID: RL-GHN-COAX-MIB::rliSwitchPortDownSpeed
RL-GHN-COAX-MIB::alarminfor.0 = STRING:  Ethernet0/5's speed is 1000M, it support max speed is 2500M!
RL-GHN-COAX-MIB::mac.0 = STRING: 00-13-ba-0c-68-57
RL-GHN-COAX-MIB::name.0 = STRING: access-sw-01
RL-GHN-COAX-MIB::location.0 = STRING: MDF rack 2
SNMP-COMMUNITY-MIB::snmpTrapAddress.0 = IpAddress: 192.0.2.20
SNMPv2-MIB::snmpTrapEnterprise.0 = OID: RL-GHN-COAX-MIB::rliTrapIDs

To test the path end to end, run snmp-server traps on the switch. Then unplug and reconnect a cable on a port with traps on, and watch for linkDown and linkUp.