Conference azur::mcc

3811.0. "OCCURS rule falsely fires -w- SNMP trap" by CSOADM::ROTH (I'm getting closer to my home...) Mon Sep 28 1992 13:33

DECmcc SBB V1.2
VMS V5.5
Local namespace

Have been adding rules to catch SNMP traps from Cisco & Vitalink boxes using
the 'occurs' format.

These rules work fine:

        Expression = (OCCURS(SNMP <node> linkDown))
        Expression = (OCCURS(SNMP <node> linkUp))

This rule is broken:

        Expression = (OCCURS(SNMP <node> coldStart))

The problem is that the above rule fires when a mere 'enterpriseSpecific'
trap is received from the Cisco box. I know that the Cisco is not sending
out a coldStart trap at all.

With the rule DISabled, watching in the notification window, I see just a
single 'enterpriseSpecific' notification.

With the rule ENAbled, watching in the notification window, I see a
'enterpriseSpecific' notification followed by a 'rule fired' notification.

Here is the text of the offending rule:

!
disable Domain LOCAL_NS:.ovtol rule oecn-noeca_REBOOT
delete Domain LOCAL_NS:.ovtol rule oecn-noeca_REBOOT
Create Domain LOCAL_NS:.ovtol rule oecn-noeca_REBOOT -
  Expression   = (OCCURS (SNMP oecn-noeca coldStart)), -
  Severity     = Critical, -
  Category     = "SNMP_REBOOT", -
  Description  = "A Vitalink or Cisco box has rebooted", -
  Alarm Fired Procedure        = _DKA700:[MCC.ALERT]alarm_parse.COM, -
  Alarm Exception Procedure    = _DKA700:[MCC]MCC_ALARMS_LOG_EXCEPTION.COM, -
  Alarm Fired Parameters       = "_DKA700:[MCC]MCC_ALARMS_LOG_EXCEPTION.LOG", -
  Batch Queue                  = "ALARMS$BATCH"
!

Any ideas?
Either I have a bug or MCC does.

Thanks-

Lee

	Lee,

		This is a known bug in the SNMP AM. Look at note #3778.

	Rahul.

Thanks... I was looking through the notes and must have missed that one.

Lee