topic Re: Configure Traps for OSPF Neighbor Change on a XOS Switch in ExtremeSwitching (EXOS/Switch Engine)

Configure Traps for OSPF Neighbor Change on a XOS Switch

Alexander_Bauer — Mon, 17 Dec 2018 23:29:18 GMT

Hello,

how can i configure a trap for an ospf neighbor change?
Mib-View is added:
#configure snmpv3 add mib-view "All" subtree 1.0/00 type included

Other traps were reached by Netsight.

Thanks,
Alex

Re: Configure Traps for OSPF Neighbor Change on a XOS Switch

Necheporenko__N — Tue, 18 Dec 2018 16:23:08 GMT

Hello Alexander,

You may use UPM+Log event for this, like in the article with example below

https://gtacknowledge.extremenetworks.com/articles/How_To/How-to-send-an-SNMP-trap-based-on-a-log-message/?q=upm+trap&l=en_US&fs=Search&pn=1

Best Regards,
Nikolay

Re: Configure Traps for OSPF Neighbor Change on a XOS Switch

Alexander_Bauer — Tue, 18 Dec 2018 17:57:45 GMT

Hi Nikolay,
thanks for your answer.

We have configured the upm profile and log event according to the gtac articel.

Do we have to additionaly adjust the snmp configuration for the trap to be send to the netsight? (We already configured the switch to send "normal" snmp traps to the netsight)

Thanks,

Alex

Re: Configure Traps for OSPF Neighbor Change on a XOS Switch

Necheporenko__N — Tue, 18 Dec 2018 18:36:39 GMT

Hello Alex,

No additional adjustment is required.

Best Regards,
Nikolay

Re: Configure Traps for OSPF Neighbor Change on a XOS Switch

Keith9 — Mon, 07 Jan 2019 23:21:10 GMT

Hi, what is the message for OSPF adjacency / neighbor change? In the article you linked you show the message is: "detect-sflow-change"

Is there a table of various messages one can trap on? I'm not in a position to break links to create a log to see what it says. I'm on a production network. I would just like to be alerted if there is a change which could indicate a particular WAN link went down.

Re: Configure Traps for OSPF Neighbor Change on a XOS Switch

Necheporenko__N — Wed, 09 Jan 2019 01:48:14 GMT

Hello Keith,

You may configure: configure log filter CUSTOM_FILTER add event "ospf.neighbor.ChgState"

Best Regards,
Nikolay

Re: Configure Traps for OSPF Neighbor Change on a XOS Switch

Keith9 — Wed, 09 Jan 2019 03:14:16 GMT

I must already have it configured:
configure log filter DefaultFilter add events "ospf.neighbor.ChgState"
ERROR: Filter item you are trying to add is redundant, item not added.

sh configuration | i DefaultFilter
configure log target syslog 10.1.0.110:514 vr VR-Default local0 filter DefaultFilter severity Debug-Data

10.1.0.110 is netsight.

So in Netsight under Alarm Configuration I went to add > Selected Trap Alarm and then I added the following
OSPF Authentication Failure - ospfIfAuthFailure
OSPF Conflicting Packet - ospfIfConfigError
OSPF Interface State Change - ospfIfStateChange
OSPF Neighbor State Change - ospfNbrStateChange

All are set to send me an email. Now I wait for an actual event (or trigger one after hours) and see if I am alerted. Maybe some of those are redundant... but I'll have to see what is triggered and then maybe I can fine tune.

Re: Configure Traps for OSPF Neighbor Change on a XOS Switch

Keith9 — Wed, 09 Jan 2019 23:53:17 GMT

I have this configured in netsight to email me, but after hours yesterday I intentianally broke a link to generate a log to see if I would be alerted. The log generated on the X690 switch as seen in the sh log command, but in Netsight in the warning, info, error or critical sections that are notated and accessed from the lower right of the screen did not show anything excpet for common port up and port down messages for various things. Plus I was not emailed.

Here's some examples of what I cut and paste from the sh log command during my testing.

1/08/2019 17:27:53.18 Slot-1: Changing the state of neighbor rtid 192.168.255.4 ipa 192.168.100.2 to state = FULL due to Loading done.
01/08/2019 17:27:53.18 Slot-1: Changing the state of neighbor rtid 192.168.255.4 ipa 192.168.100.2 to state = LOADING due to exchange done event.
01/08/2019 17:27:53.13 Slot-1: Changing the state of neighbor rtid 192.168.255.4 ipa 192.168.100.2 to state = EXCHANGE due to negotiation done event.
01/08/2019 17:27:52.18 Slot-1: Changing the state of neighbor rtid 192.168.255.4 ipa 192.168.100.2 to state = EX_START due to AdjOK event.
01/08/2019 17:27:52.18 Slot-1: Changing the state of neighbor rtid 192.168.255.3 ipa 192.168.100.1 to state = DOWN due to inactivity timer expiry.
01/08/2019 17:27:52.18 Slot-1: Changing the state of neighbor rtid 192.168.255.3 ipa 192.168.102.1 to state = DOWN due to inactivity timer expiry.

And then coming back online:
01/08/2019 17:32:42.41 Slot-1: Changing the state of neighbor rtid 192.168.255.3 ipa 192.168.102.1 to state = 2WAY due to two way event.
01/08/2019 17:32:42.33 Slot-1: Changing the state of neighbor rtid 192.168.255.3 ipa 192.168.100.1 to state = 2WAY due to two way event.
01/08/2019 17:32:32.58 Slot-1: Changing the state of neighbor rtid 192.168.255.3 ipa 192.168.102.1 to state = INIT due to hello received.
01/08/2019 17:32:32.58 Slot-1: Changing the state of neighbor rtid 192.168.255.3 ipa 0.0.0.0 to state = DOWN due to new neighbor.
01/08/2019 17:32:32.58 Slot-1: Changing the state of neighbor rtid 192.168.255.3 ipa 192.168.100.1 to state = INIT due to hello received.
01/08/2019 17:32:32.58 Slot-1: Changing the state of neighbor rtid 192.168.255.3 ipa 0.0.0.0 to state = DOWN due to new neighbor.

Re: Configure Traps for OSPF Neighbor Change on a XOS Switch

PeterK — Thu, 10 Jan 2019 15:59:48 GMT

Hi Keith,
were do you have checked for that messages in netsight? Only on Traps or even on Syslog?
show log & Netsight Syslog (not Traps) should have same entries, then severity level an so is configured same for logging sylog-server and local

Re: Configure Traps for OSPF Neighbor Change on a XOS Switch

Keith9 — Thu, 10 Jan 2019 22:20:23 GMT

I'm attaching two screen shots to visualize in netsight what I'm looking at. In the lower right corner there are colored blocks by severity. I would expect the OSPF messages to end up in here like other messages do.

I would also expect the events to email me as a test due to the alarm configuration. I know that when we first migrated to X690's in the core, our consultant helped setup so if a power supply or fan goes, we do get alerted. That works as we tested pulling a fan or power supply briefly to check the logs and alerts.

This is on the switch side and the netsight server is in fact 10.1.0.110.

enable cli-config-logging
configure syslog add 10.1.0.110:514 vr VR-Default local0
configure log target syslog 10.1.0.110:514 vr VR-Default local0 from 10.1.0.251
enable log target syslog 10.1.0.110:514 vr VR-Default local0
configure log target syslog 10.1.0.110:514 vr VR-Default local0 filter DefaultFilter severity Debug-Data
configure log target syslog 10.1.0.110:514 vr VR-Default local0 match Any
configure log target syslog 10.1.0.110:514 vr VR-Default local0 format timestamp seconds date Mmm-dd event-name none process-slot priority tag-id tag-name

One thing I chedked in sh configuration | i snmp, I see this line:
enable snmp traps configuration save

So I'm wondering what other traps there are. I did enable snmp traps ? and I see ospf is an option so I pick that and the options are all or trap-map. So I'm going to test this:
enable snmp traps ospf all

I don't know if that is the "missing link" that I need to complete this configuration but I hope its just that simple. I do not know how the hardware alerts are getting through because there is no enable snmp traps for hardware. Also we do get port up/down messages and I do not see enable snmp traps port-up-down in our config at all.

All assistance is greatly appreciated!

Re: Configure Traps for OSPF Neighbor Change on a XOS Switch

Keith9 — Fri, 11 Jan 2019 20:29:22 GMT

It worked!
The command:
Enable snmp traps ospf all
on the switch paired with the netsight alarms configuration in my last posts screen shots did work. Around 1:12 am last night there was a small interruption in one of our WAN providers, which does happen from time to time in those AM overnight maintenance windows. I received 4 emails from Netsight stating ospf neighbor state change along with the IP endpoints, all of which are on that provider. Now I remoted in and traceroutes look normal so it must have been a quick maintenance item done by the ISP.