Correctly Configuring SNMP Trap Rules

Introduction

The Halcyon Enterprise Console SNMP Trap receiver, when purchased can be used to centralise alerts from SNMP capable devices to your “single pane of glass” Halcyon Enterprise Console.

However, there are difficulties is setting this up as whilst SNMP has standards, the components of the SNMP trap vary from manufacturer to manufacturer.

This guide is intended to show you the correct process to set up and tailor SNMP trap alerting on your Enterprise Console.

The steps are as follows:

1. Obtain the MIB for the device you wish to receive SNMP traps from.
2. Add the device to Halcyon Device Manager and refresh.
3. Load the MIB into the Trap receiver directory and refresh.
4. Configure your device to send SNMP traps to the Enterprise Console.
5. Initiate a test to capture a “raw” SNMP trap from the device.
6. Configure a Server Options Rule to catch the SNMP traps from the device and format them appropriately.

Obtain the MIB for the device from which you want to receive SNMP traps

You should download the MIB for the device from the manufacturers website. A MIB (Management Information Base) is a file that contains the construct of the data that can be sent by the SNMP capable device. The SNMP trap manager needs this to be able to interpret the data sent from the device.

Load the MIB into the Trap receiver directory and refresh.

Take the MIB file and place it in the Mibs directory on the Enterprise Console Server.

The default is: C:\Program Files (x86)\Halcyon\Trap Receiver\Mibs

This may be different if you have chosen to install to a different drive or directory.

Once you have done this you should stop and restart the Halcyon Trap Receiver Service running on the Enterprise Console Server:

Next, check that the MIB has loaded correctly by checking the Trap Receiver Log file.

The default directory is: C:\Program Files (x86)\Halcyon\Trap Receiver\Logs

The file is called TrapReceiver.hlf

You can open this with the Halcyon logfile viewer, which is located at:

C:\Program Files (x86)\Halcyon\Log Viewer\LogViewer.exe

This will open the file correctly with the most recent entry at the top. You can also open it using Notepad (The most recent entry will be at the bottom). Search through the file (or use the FIND button) for the text “Loading Mibs”

Then search forwards in time to check that your specific MIB has been loaded and that the MIB load is complete with the “Mibs Loaded” message – look out for any Errors.

Add the device to Halcyon Device Manager and refresh.

Using Halcyon Device Manager, add in the device to a SNMP group.

Create a device group

Before adding a device, you should create a device group for it to go in.

Device groups are just logical ways of grouping devices, you can create groups by OS type, Geographic location, Prod, Test, etc. For SNMP devices, you should create an SNMP devices group:

Start > Programs > Halcyon > Device Manager > Device Groups > Add

The minimum information needed is the Name of the group and a description.

Click OK to create the group.

Add the device to the group

Right-click on the device group you wish to use and select Add Device.

1. Give the device a Name.
2. Give the device a Description.
3. Device type can be either “Server” or “Unknown” if you cannot find it in the list – it does not matter as this is not used by the SNMP trap manager.
4. Provide a DNS hostname or an IP Address.
5. Click SNMP to move to the SNMP configuration.

1. Check the “SNMP Capable” box to turn this on and click “OK” to create the device.

Note: If your site SNMP configuration is different, then you should adjust the SNMP settings appropriately.

Load the new device into the Enterprise Console

Open the Enterprise Console on the Server and select

1. “Tools” Tab
2. “Reload devices”

You will now see that the device has been added to the console.

This is done manually to prevent partially configured devices being inadvertently added through Device Manager.

Configure your device to send SNMP traps to the Enterprise Console

Each SNMP device will have its own management interface, usually a web-based browser interface.

You should find the appropriate management page and add the Halcyon Enterprise Console as the SNMP Manager or SNMP trap Target.

You should configure what alerts are to be sent (Informational, Warning, Critical, etc) to the Enterprise Console.

Often there is a “TEST” button, which you can use to send a test SNMP trap.

Ensure that the SNMP device has a route on the network to the Halcyon Enterprise Console and that SNMP traffic is allowed through port 161. Consult with your Network/Firewall team to ensure this is open otherwise SNMP traps will not get through.

Initiate a test to capture a “raw” SNMP trap from the device

You should now initiate a test to the Enterprise Console so you can see the raw data sent by the SNMP trap in the MIB format.

Here we can see our test

1. The device name matches
2. The source is “Trap Receiver”
3. This is the RAW alert text

Double click the alert to pop out the entire alert information

1. Look down the left-hand side of the alert information and find the “PDU” (Protocol Data Unit) section – this will be under the “Details” Section.
2. Now look in the central section for text that is human-readable and what you want to appear in the alert text.
3. Make a note of the EXACT spelling of the PDU, in this case: “halEsAlertText”

Configure a Server Options Rule to catch the SNMP traps from the device and format them appropriately

Open Halcyon Enterprise Server Options

1. Click Rules.
2. Click Add Rule.

1. Set the sequence number, this should be lower than the “Catch all” which should be the last rule in the list. Server Rules are processed in numerical sequence, halting when it finds an exact match.
2. Add a suitable description for the SNMP device you wish to trap.

1. Click “Alert Message”.
2. Use the PDU name obtained earlier and prefix it with an “&” in the Alert Message Box. You can add tailor the message to include other alert variables or text of your own.

IMPORTANT NOTE: If the PDU name has a “.” in it =, like the example below, you must enclose the PDU name in quotes as per this example:

1. Click “Criteria”.
2. Click “Add Criteria”.

Ensure the selections on this screen match the picture below and

1. For the “Source Type”, select “Trap Receiver” – this means ONLY SNMP Traps from the device will be captured by this rule.
2. Click “Device Selection”.

1. Click on the “Device Group” drop-down and select the SNMP devices group create earlier.
2. Select the device for this rule from the list.
3. Click “Add Device”

The device is now in the Selected devices list

1. Click OK to continue.

1. Click Actions.
2. Click Add action

1. Click OK to take the default (Log only) action

Finally, click OK to save the rule and then,

1. Click Apply to put the rule into play.

Now, send the test again and providing all is set up correctly you will see a human-readable message on the console.