This document provides a sample configuration for remote monitoring (RMON) alarm and event settings using SNMP commands.
There are no specific requirements for this document.
To follow the procedures in this document, your device needs to support the RMON-MIB. You can check this at Cisco IOS MIB Tools (registered customers only) .
The information in this document was created from the devices in a specific lab environment. All of the devices used in this document started with a cleared (default) configuration. If your network is live, make sure that you understand the potential impact of any command.
For more information on document conventions, refer to Cisco Technical Tips Conventions.
The purpose of remote monitoring (RMON) alarm and event is to monitor a certain MIB object on the device, and warn the system administrator if one of those values is going out of the defined range.
The alarm monitors a specific object in the MIB and triggers an event when the condition (falling or rising threshold) is reached.
The event is the trap or log generated when the alarm triggers it. An example of a rising and falling threshold is:
n=value monitored by the alarm. The falling threshold is "5" and the rising threshold is "15"
The alarm triggers an event when one of the two values is reached.
Value | Trap | Comment |
n1=16 | rising | reached the rising value : 15 |
n2=4 | falling | reached the falling value : 5 |
n3=6 | none | between 5 and 15 |
n4=6 | rising | reached the rising value : 15 |
n5=13 | none | good condition |
n6=20 | none | above 15 but did not go under 5 since the last event |
n7=4 | falling | reached the falling value : 5 |
n8=20 | none | under 5 but did not go above 15 since the last event |
n9=16 | rising | reached the rising value : 15 |
You can configure RMON alarm and event on routers using the command line interface (CLI) (refer to Configuring RMON Alarm and Event Settings from the Command Line Interface), and on routers and switches using Simple Network Management Protocol (SNMP) commands. The parameters to modify are part of the RMON-MIB.
Use this command to create an event:
# snmpset -c <read_write_community> <device_name> .1.3.6.1.2.1.16.9.1.1.x.y <variable type> <value>
First choose the event ID (variable y).
Follow this procedure to create an event. For each step, there is a description of the step, the name of the MIB object to modify, the object ID (OID), the <variable type>, and the <value> from the generic command.
Erase an eventual old event that would have used ID="y" (make sure you first check that you don't need it anymore. Otherwise, use another ID).
* eventStatus / .1.3.6.1.2.1.16.9.1.1.7.y * variable type=integer * value=4
Note: Use the same command to erase the event when needed.
Enter event creation mode:
eventStatus / .1.3.6.1.2.1.16.9.1.1.7.y * variable type=integer * value v=2
Specify the event description:
* eventDescription / .1.3.6.1.2.1.16.9.1.1.2.y * variable type=string (for Net-snmp) or octetsting (for Openview) * value = a description of the event
Specify the type of event you want:
* eventType / .1.3.6.1.2.1.16.9.1.1.3.y * variable type=integer * value = "1" => none "2" => log "3" => snmp-trap "4" => log-and-trap
Specify the community string for the trap:
* eventCommunity / .1.3.6.1.2.1.16.9.1.1.4.y * variable type=string (for Net-snmp) or octetsting (for Openview) * value="<trap_community_string>"
Specify the owner of the event:
* eventOwner / .1.3.6.1.2.1.16.9.1.1.6.y * variable type=string (for Net-snmp) or octetsting (for Openview) * value="<event_owner>"
Activate the event:
* eventStatus / .1.3.6.1.2.1.16.9.1.1.7.y * variable type=integer * value=1
Use this command to create an alarm:
# snmpset -c .1.3.6.1.2.1.16.3.1.1.x.y <read_write_community> <device_name> <variable type> <value>
Erase an eventual old alarm that would have used ID=y (first check if you don't need it anymore. Otherwise, use another ID):
* alarmStatus / .1.3.6.1.2.1.16.3.1.1.12.y * variable type=integer * value=4
Enter alarm creation mode:
* alarmStatus / .1.3.6.1.2.1.16.3.1.1.12.y * variable type=integer * value=2
Set the interval (in seconds) over which the data is sampled and compared with the rising and falling thresholds:
* alarmInterval / .1.3.6.1.2.1.16.3.1.1.2.y * variable type=integer * value=<n_seconds>
Specify the OID that you want to monitor:
* alarmVariable / .1.3.6.1.2.1.16.3.1.1.3.y * variable type=objid (for Net-snmp) or objectidentifier (for Openview) * value=<oid_to_check>
Define the type of sample you want:
* alarmSampleType / .1.3.6.1.2.1.16.3.1.1.4.y * variable type=integer * value=<rising_threshold> "1" => absoluteValue "2" => deltaValue
Specify what triggers an alarm:
* alarmStartupAlarm / .1.3.6.1.2.1.16.3.1.1.6.y * variable type=integer * value= "1" => risingAlarm "2" => fallingAlarm "3" => risingOrFallingAlarm
Define the rising threshold:
* alarmRisingThreshold / .1.3.6.1.2.1.16.3.1.1.7.y * variable type=integer * value=<rising_threshold>
Define the falling threshold:
* alarmFallingThreshold / .1.3.6.1.2.1.16.3.1.1.8.y * variable type=integer * value=<falling_threshold>
Specify the event ID you want to trigger when the rising threshold is crossed:
* alarmRisingEventIndex / .1.3.6.1.2.1.16.3.1.1.9.y * variable type=integer * value=<event_ID>
Specify the event ID when the falling threshold is crossed:
* alarmFallingEventIndex / .1.3.6.1.2.1.16.3.1.1.9.y * variable type=integer * value=<event_ID>
Specify the owner of the alarm:
* alarmOwner / .1.3.6.1.2.1.16.3.1.1.11.y * variable type=string (for Net-snmp) or octetsting (for Openview) * value=<owner>
Activate the alarm:
* alarmStatus / .1.3.6.1.2.1.16.3.1.1.12.y * variable type=integer * value=1
In this example, safari is used to send a trap when the number of bytes going into interface 12 during the last two minutes is above 140000000 or below 10.
Safari is Cisco IOS 2500 Software (C2500-JS-L), Version 12.1(9), RELEASE SOFTWARE (fc1).
This example was also tried successfully on WS-C6506 Software, Version NmpSW: 6.1(1b).
Note: In the Catalyst, there is no CLI command to check the configuration, but it can be done with the snmpwalk command on the server.
On the router and the switch, this configuration survives a reload.
safari# show rmon events Event table is empty # snmpset -c private safari .1.3.6.1.2.1.16.9.1.1.7.123 integer 4 16.9.1.1.7.123 = 4 # snmpset -c private safari .1.3.6.1.2.1.16.9.1.1.7.123 integer 2 16.9.1.1.7.123 = 2 safari#show rmon events Event 123 is under creation, owned by Description is Event firing causes nothing, last fired 00:00:00 # snmpset -c private safari .1.3.6.1.2.1.16.9.1.1.2.123 string "test_event" 16.9.1.1.2.123 = "test_event" # snmpset -c private safari .1.3.6.1.2.1.16.9.1.1.3.123 integer 4 16.9.1.1.3.123 = 4 # snmpset -c private safari .1.3.6.1.2.1.16.9.1.1.4.123 string "public" 16.9.1.1.4.123 = "public" # snmpset -c private safari .1.3.6.1.2.1.16.9.1.1.6.123 string "event_owner" 16.9.1.1.6.123 = "event_owner" # snmpset -c private safari .1.3.6.1.2.1.16.9.1.1.7.123 integer 1 16.9.1.1.7.123 = 1 safari# show rmon events Event 123 is active, owned by event_owner Description is test_event Event firing causes log and trap to community public, last fired 00:00:00 safari# show rmon alarm Alarm table is empty # snmpset -c private safari .1.3.6.1.2.1.16.3.1.1.12.321 integer 2 16.3.1.1.12.321 = 2 safari# show rmon alarm Alarm 321 is under creation, owned by Monitors ccitt.0 every 10 second(s) Taking absolute samples, last value was 0 Rising threshold is 0, assigned to event 0 Falling threshold is 0, assigned to event 0 On startup enable rising or falling alarm # snmpset -c private safari .1.3.6.1.2.1.16.3.1.1.2.321 integer 120 16.3.1.1.2.321 = 120 # snmpset -c private safari .1.3.6.1.2.1.16.3.1.1.3.321 objid .1.3.6.1.2.1.2.2.1.10.12 16.3.1.1.3.321 = OID: interfaces.ifTable.ifEntry.ifInOctets.12 # snmpset -c private safari .1.3.6.1.2.1.16.3.1.1.4.321 integer 2 16.3.1.1.4.321 = 2 # snmpset -c private safari .1.3.6.1.2.1.16.3.1.1.6.321 integer 3 16.3.1.1.6.321 = 3 # snmpset -c private safari .1.3.6.1.2.1.16.3.1.1.7.321 integer 140000000 16.3.1.1.7.321 = 140000000 # snmpset -c private safari .1.3.6.1.2.1.16.3.1.1.8.321 integer 10 16.3.1.1.8.321 = 10 # snmpset -c private safari .1.3.6.1.2.1.16.3.1.1.9.321 integer 123 16.3.1.1.9.321 = 123 # snmpset -c private safari .1.3.6.1.2.1.16.3.1.1.10.321 integer 123 16.3.1.1.10.321 = 123 # snmpset -c private safari .1.3.6.1.2.1.16.3.1.1.11.321 string "alarm_owner" 16.3.1.1.11.321 = "alarm_owner" # snmpset -c private safari .1.3.6.1.2.1.16.3.1.1.12.321 integer 1 16.3.1.1.12.321 = 1 safari# show rmon alarm Alarm 321 is active, owned by alarm_owner Monitors ifEntry.10.1 every 120 second(s) Taking delta samples, last value was 130244 Rising threshold is 140000000, assigned to event 123 Falling threshold is 10, assigned to event 123 On startup enable rising or falling alarm
There is currently no verification procedure available for this configuration.
There is currently no specific troubleshooting information available for this configuration.