Table Of Contents
Monitoring Notifications
SNMP Notification Overview
Enabling Notifications
Cisco SNMP Notifications
Environmental or Functional Notifications
Cisco Line Card Notifications
Flash Card Notifications
Interface Notifications
MPLS Service Notifications
Routing Protocol Notifications
Chassis Notifications
RTT Monitor Notifications
Environmental Notifications
Frame Relay Notification
PFE Notifications
Service Selection Gateway Notification
Protocol Notifications
Monitoring Notifications
This chapter describes the Cisco 10000 Series router notifications supported by the MIB enhancements feature introduced in Cisco IOS Release 12.2xxxx. SNMP uses notifications to report events on a managed device. The notifications are traps or informs for different events. The router also supports other notifications not listed.
This chapter contains the following sections:
•
SNMP Notification Overview
•Cisco SNMP Notifications
SNMP Notification Overview
An SNMP agent can notify the manager when important system events occur, such as the following:
•An interface or card starts or stops running
•Temperature thresholds are crossed
•Authentication failures occur
When an agent detects an alarm condition, the agent:
•Logs information about the time, type, and severity of the condition
•Generates a notification message, which it then sends to a designated IP host
SNMP notifications are sent as either:
•Traps—Unreliable messages, which do not require receipt acknowledgement from the SNMP manager.
•Informs—Reliable messages, which are stored in memory until the SNMP manager issues a response. Informs use more system resources than traps.
To use SNMP notifications on your system, you must specify trap recipients. These recipients indicate where Network Registrar notifications are directed. By default, all notifications are enabled, but no trap recipients are defined. Until you define the recipients, no notifications are sent.
Many commands use the word traps in the command syntax. Unless there is an option in the command to select either traps or informs, the keyword traps refers to either traps, informs, or both. Use the snmp-server host command to specify whether to send SNMP notifications as traps or informs. The types of traps can be specified in both commands.
Note Most notification types are disabled by default. However, some notification types cannot be controlled with the snmp command. For example, some notification types are always enabled and other types are enabled by a different command. The linkUpDown notifications are controlled by the snmp trap link-status command. If you enter this command with no notification-type keywords, the default is to enable all notification types controlled by this command.
Specify the trap types if you don't want all traps to be sent. Then use multiple snmp-server enable traps commands, one for each of the trap types that you used in the snmp host command. The Event Table must have an entry that specifies the action that is to be performed.
For detailed information about notifications and a list of notification types, go to the following URLs:
•http://www.cisco.com/univercd/cc/td/doc/product/software/ios113ed/113t/113t_1/
•http://www.cisco.com/warp/public/477/SNMP/SNMPTrapsInImages.html
•http://www.cisco.com/univercd/cc/td/doc/product/software/ios122/122cgcr/ffun_c/fcfprt3/fcf014.htm
Enabling Notifications
You can enable MIB notifications using either of the following procedures:
Command line interface (CLI)—Specify the recipient of the trap message and specify the types of traps sent. This command also specifies which types of informs are enabled.
•For detailed procedures, go to:
–http://www.cisco.com/warp/public/477/SNMP/SNMPTrapsInImages.html
–http://www.cisco.com/univercd/cc/td/doc/product/software/ios113ed/113t/113t_1/snmpinfm.htm
•Performing an SNMP SET operation using the setany command— To enable or disable MIB notifications, perform an SNMP SET operation on the a specific object.
–To enable the notifications set the object to true(1)
–To disable the notifications, set the object to false(2)
Note If you issue the snmp-server enable traps command without a notification-type argument, the router generates traps for all types of events, which might not be desirable. Some MIBs require the user to set additional objects to enable some notifications.
Cisco SNMP Notifications
This section contains tables that describe a MIB event, why the event occurred, and a recommendation as to how to handle the event. Each table lists the following information:
•Text string—The event display
•Brief description—What the event indicates
•Probable cause—What might have caused the notification
•Recommended action—Recommendation as to what should be done when the particular notification occurs
Note In the following tables, where no action required is documented, there might be instances where an application, such as trouble ticketing occurs. For detailed information, go to the following URL:
http://www.cisco.com/univercd/cc/td/doc/product/rtrmgmt/info_ctr/3_0/install/overview.htm
Environmental or Functional Notifications
Table 4-1 lists notifications generated for events that might indicate the failure of the Cisco 10000 Series router or conditions that might affect the router's functionality.
Table 4-1 Environmental and Functional Notifications
Event
|
Description
|
Probable Cause
|
Recommended Action
|
cefcModuleStatusChange
|
Indicates that the status of a module has changed.
|
Module has unknown state
|
Enter the show module command to view error message details. For Syslog messages associated with this event, consult Messages and Recovery Procedures.
|
| |
|
A line card is provisioned for a slot but it is not present in the slot.
|
Insert a configured line card in the specific slot.
|
| |
|
Module is operational
|
No action is required.
|
| |
|
Module has failed due to some condition
|
Enter the show module command to view error message details. For Syslog messages associated with this event, consult Messages and Recovery Procedures.
|
cefcPowerStatusChange
|
Indicates that the power status of a field replaceable unit has changed.
|
FRU is powered off because of an unknown problem.
|
Enter the show power command to check the actual power usage.For Syslog messages associated with this event, consult Messages and Recovery Procedures
|
| |
|
FRU is powered on
|
No action is required.
|
| |
|
FRU is administratively off
|
No action is required.
|
| |
|
FRU is powered off because available system power is insufficient
|
Enter the show power command to check the actual power usage.
|
cefcFRUInserted
|
Indicates that a FRU was inserted.
|
A new field replaceable unit such as line cards, fan, port, power supply, or redundant power supply was added.
|
No action is required.
|
cefcFRURemoved
|
Indicates that a FRU was removed.
|
A field replaceable unit such as line cards, fan, ports, power supply, or redundant power supply was removed.
|
Replace the field replaceable unit.
|
chassisAlarmOn
|
Indicates that a FRU status has changed. The chassisTempAlarm, chassisMinorAlarm, or chassisMajorAlarm object in this MIB has changed to the on (2) state.
|
The chassis temperature is too high, a minor or major alarm has been detected.
|
Inspect the indicated component closely to determine why it is operating out of the normal operating temperature range and whether it will eventually exceed the allowed operating temperature range.
|
| |
|
A redundant power supply has been powered off.
|
Replace the field replaceable unit.
|
| |
Router's cooling fan could be close to failure.
|
One or more fans in the system fan tray have failed. Although this is a minor alarm, system components could overheat and be shut down.
|
Replace the fan as soon as possible or the system might shut itself down or fail to operate properly.
|
chassisAlarmOff
|
Indicates that a FRU status has changed. The chassisTempAlarm, chassisMinorAlarm, or chassisMajorAlarm object in this MIB has changed to the off (1) state.
|
A redundant power supply has been powered on.
|
No action required.
|
ccCopyCompletion
|
Indicates that a configuration copy operation completed.
|
The router finished copying a configuration file to or from another location.
|
|
ciscoConfigManEvent
|
Indicates that a router configuration changed.
|
|
|
dsx1LineStatusChange
dsx3LineStatusChange
|
The dsx1LineStatus is a bit map that contains loopback state and failure state information.
|
When a failure is detected, the corresponding dsx1LineStatus bit should change to reflect the failure. For example, when a Receiving LOS failure is detected, the corresponding bit (bit 64) should be set to indicate the failure and as a result the dsx1LineStatus changes.
|
When the dsx1LineStatus reports failures, the recommended action is correction of the conditions causing the error.
|
Cisco Line Card Notifications
These notifications indicate the failure of a line card or error conditions on the card that might affect the functionality of all interfaces and connected customers.
Table 4-2 lists ENTITY-MIB notifications generated by Cisco 10000 Series router line cards.
Table 4-2 Cisco 10000 Series Router Card Notifications
Event
|
Description
|
Probable Cause
|
Recommended Action
|
entConfigChange
|
An entry for the line card is removed from the entPhysicalTable (which causes the value of entLastchangeTime to change).
|
A line card was removed.
|
Replace the field replaceable unit.
|
| |
An entry for the line card is added to the entPhysicalTable (which causes the value of entLastchangeTime to change).
|
A line card was inserted.
|
No action required.
|
cefcModuleOperStatus
|
Indicates that the line card operational state changed. A management application uses this trap to update the status of a module that it is managing.
|
A line card is provisioned for a slot but it is not present in the slot.
|
Add a module.
|
entSensorThresholdNotification
|
Indicates that the sensor value crossed the threshold. This variable reports the most recent measurement seen by the sensor and This variable indicates the value of the threshold.
|
The sensor value in a module crossed the threshold listed in entSensorThresholdTable, This notification is generated once each time the sensor value crosses the threshold.
|
Remove the configuration that bypasses the module shutdown due to sensor thresholds being exceeded. Shut down the module after removing the configuration. It exceeded major sensor thresholds.
Note The command that shuts down the module in the event of a major sensor alarm has been overridden, so the specified module will not be shut down. The command used to override the shutdown is no environment-monitor shutdown.
|
| |
|
The local CPU was unable to access the temperature sensor on the module. The module will attempt to recover by resetting itself.
|
Copy the error message exactly as it appears on the console or in the system log, contact your Cisco technical support representative, and provide the representative with the gathered information.
|
ceAssertAlarm
|
The agent generates this trap when a physical entity asserts an alarm.
|
This alarm is sent for the following reasons:
•Fan failure, fan tray missing.
•Power entry module failure.
•Core or inlet temperature crosses a threshold, such as core critical temperature limit was reached.
•Sent when the alarm "Card Stopped Responding OIR" occurs.
•Path alarm indication signal occurs.
•Path remote failure indication occurs.
•Path loss of a pointer.
•Line alarm indication signal.
•Line remote failure indication.
•Section loss of signal failure.
•Threshold cross alarm.
•Out of frame failure.
•Signal failure
•Far end clock is out of range.
|
Check the entPhysicalDescr type and take the corresponding action; because there are many types of asserted alarms.
|
ceClearAlarm
|
The agent generates this trap when a physical entity clears a previously asserted alarm.
|
•The agent generates this trap when a physical entity clears a previously asserted alarm.
•Sent when a line card is installed or removed in a line card slot and the alarm "Active Card Removed OIR" is cleared.
|
No action required.
|
Flash Card Notifications
Table 4-3 lists CISCO-FLASH-MIB notifications generated by Cisco 10000 Series router flash cards. These notifications indicate the failure of a flash card or error conditions on the card that might affect the functionality of all interfaces and connected custom
Table 4-3 Flash Card Notifications
Event
|
Description
|
Probable Cause
|
Recommended Action
|
ciscoFlashDeviceChangeTrap
|
Indicates a removable flash device was inserted into the router.
|
Status change occurred.
|
To determine which flash card was inserted, check the ciscoFlashDeviceTable.
|
| |
Indicates a removable flash device is removed from the router.
|
Status change occurred.
|
To determine which flash card was inserted, check the ciscoFlashDeviceTable.
|
ciscoFlashCopyCompletionTrap
|
Indicates that a flash copy operation finished.
|
|
|
ciscoFlashPartitioningCompletionTrap
|
Indicates that a flash partitioning operation finished.
|
|
|
ciscoFlashMiscOpCompletionTrap
|
Indicates that a miscellaneous flash card operation finished such as ??????
|
|
|
Interface Notifications
Table 4-4 lists notifications generated by the router for link-related (interface) events.
Table 4-4 Interface Notifications
Event
|
Description
|
Probable Cause
|
Recommended Action
|
linkDown
|
Indicates that a link is about to enter the Down state, which means it can not transmit or receive traffic. The ifOperStatus object shows the link's previous state. Value is down(2).
|
An internal software error might have occurred.
|
To see if link traps are enabled or disabled on an interface, check ifLinkUpDownTrapEnable (IF-MIB) for the interface. To enable link traps, set ifLinkUpDownTrapEnable to enabled(1).
Enable the IETF (RFC 2233) format of link traps by issuing the CLI command snmp-server trap link ietf.
|
linkUp
|
Indicates that a link's status is no longer down. The value of ifOperStatus indicates the link's new state. Value is up(1).
|
The port manager reactivated a port in the link-down state during a switchover.
|
No action is required.
|
MPLS Service Notifications
Table 4-5 lists service notifications generated by the router to indicate conditions for services.
Table 4-5 MPLS-Service Notifications
Event
|
Description
|
Probable Cause
|
Recommended Action
|
mplsTunnelUp
|
Indicates that a mplsTunnelOperStatus object for a configured tunnel is about to transition from the Down state to any state except NotPresent.
|
A configured tunnel transitioned from the Down state to any state except NotPresent.
May be caused by an administrative or operational status check of the tunnel.
|
No action is required.
|
mplsTunnelDown
|
Indicates that the mplsTunnelOperStatus object for a configured MPLS traffic engineering tunnel is about to transition to the up(1) or the down(2) respectively.
|
A configured tunnel is transitioning to the down state.
May be caused by an administrative or operational status check of the tunnel.
|
|
mplsTunnelRerouted
|
Indicates that the signalling path for an MPLS traffic engineering tunnel changed.
|
A tunnel was rerouted or reoptimized.
|
If you use the actual path, then write the new path to mplsTunnelRerouted after the notification is issued.
|
VpnThreshCleared
|
This notifies the network administrator that the number of routes has changed.
|
The number of routes in a VRF have fallen below the thresholds.
|
|
Routing Protocol Notifications
Table 4-6 lists BGP4-MIB notifications which are Border Gateway Protocol (BGP) state changes generated by the Cisco 10000 Series router to indicate error conditions for routing protocols and services.
Table 4-6 Routing Protocol Notifications
Event
|
Description
|
Probable Cause
|
Recommended Action
|
bgpEstablished
|
The BGP FSM enters the ESTABLISHED state. It becomes active on the router.
|
The BGP routing protocol changed status.
|
No action is required.
|
bgpBackwardTransition
|
Indicates that the BGP protocol transitions from a higher-level state to a lower-level state. The prefix count for an address family on a BGP session exceeded the configured threshold value.
|
The BGP routing protocol changed status.
|
This threshold value is configured using the CLI command, neighbor <nbr_addr> <max_prefixes> [ theshold] [warning-only]
|
Chassis Notifications
Table 4-7 lists CISCO-STACK-MIB notifications generated by the router to indicate that a chassis module has become active or stopped responding. These notifications are supported by the Cisco 10000 series router.
Table 4-7 Chassis Notifications
Event
|
Description
|
Probable Cause
|
Recommended Action
|
moduleDown
|
The status of a module changes from the OK state to another state.
|
The agent entity has detected that the moduleStatus object in this MIB has transitioned to the ok (2) state for one of its modules. The generation of this trap can be controlled by the sysEnableModuleTraps object in this MIB.
|
Enter the show module command and check the status.
|
moduleUp
|
The status of a module changes to the OK state.
|
The agent entity has detected that the moduleStatus object in this MIB has transitioned out of the ok (2) state for one of its modules. The generation of this trap can be controlled by the sysEnableModuleTraps object in this MIB.
|
No action required.
|
RTT Monitor Notifications
Table 4-8 lists CISCO-RTTMON-MIB notifications that can occur during round-trip time (RTT) monitoring.
Table 4-8 RTT Monitor Notifications
Event
|
Description
|
Probable Cause
|
Recommended Action
|
rttMonConnectionChangeNotification
|
Sent when the value of rttMonCtrlOperConnectionLostOccurred changes.
|
Occurs when the connection to a target has either failed to be established or was lost and then re-established.
|
Check for the connectivity to the target. There could be link problems to the target through different hops.
|
rttMonTimeoutNotification
|
A timeout occurred or was cleared.
|
An RTT probe occurred and the system sends the notice when the value of rttMonCtrlOperTimeoutOccurred changes.
|
Check for the end-to-end connectivity if rttMonCtrlOperTimeoutOccurred if the notification returns true.
No action is required if rttMonCtrlOperTimeoutOccurred is false.
|
rttMonThresholdNotification
|
Threshold violation occurred.
|
An RTT probe occurred or a previous violation has subsided in a subsequent RTT operation.
|
Check for the end-to-end connectivity if rttMonCtrlOperOverThresholdOccurred in the notification is true otherwise no action required.
|
Environmental Notifications
Table 4-9 lists CISCO-ENVMON-MIB notifications generated for events that might indicate the failure of the Cisco 10000 Series router or conditions that might affect the router's functionality.
Table 4-9 Environmental Notifications
Event
|
Description
|
Probable Cause
|
Recommended Action
|
ciscoEnvMonShutdownNotification
|
A ciscoEnvMonShutdown
Notification is sent if the environmental monitor detects a testpoint reaching a critical state and is about to initiate a shutdown. This notification contains no objects so that it may be encoded and sent in the shortest amount of time possible. Management applications should not rely on receiving such a notification as it may not be sent before the shutdown completes.
|
A test point nears a critical state and the router is about to shut down (for example, if auto-shutdown is enabled and the chassis core or inlet temperature reaches critical state and remains there for more than 2 minutes).
The system has a configuration to shut down a module if its operating temperature exceeds a temperature threshold. This configuration has been bypassed, and a module will still operate in an over-temperature condition. Operating at an over-temperature condition can damage the hardware.
|
Do not override the sensor alarms that act on an over-temperature condition. Enter the environment-monitor shutdown temperature command to bring the system back to standard temperature detection.
|
ciscoEnvMonFanNotification
|
|
One or more fans in the system fan tray have failed. Although this is a minor alarm, system components could overheat and be shut down.
|
Replace the system fan tray.
|
ciscoEnvMonRedundantSupplyNotification
|
Sent if the redundant power supply (if available) fails.
|
An environmental condition, an over-temperature condition, or inconsistent voltage to the module occurred. Since such a notification is usually generated before the shutdown state is reached, it can convey more data and has a better chance of being sent than does the ciscoEnvMonShutdownNotification.
|
Ensure that the system power supplies are optimally redundant. Use power supplies with identical output ratings or reduce system power consumption.
|
ciscoEnvMonTempStatusChangeNotif
|
The core or inlet temperature is outside its normal range, when ciscoEnvMonState is at the Warning or Critical state.
Since such a Notification is usually generated before the shutdown state is reached, it can convey more data and has a better chance of being sent than does the ciscoEnvMonShutdownNotification.
|
During previous reloads, this module experienced a timeout while accessing the temperature sensor. All further access to the temperature sensor will be disabled. This condition indicates a possible problem with the temperature sensor.
|
Copy the error message exactly as it appears on the console or in the system log, contact your Cisco technical support representative, and provide the representative with the gathered information.
|
|
|
|
Frame Relay Notification
Table 4-8 lists notifications that can occur during router frame relay events.
Table 4-10 Frame Relay Notifications
Event
|
Description
|
Probable Cause
|
Recommended Action
|
frDLCISStatusChange
|
Indicates that a virtual circuit has changed.
|
Sent when a Frame Relay virtual circuit changes status. For example, when a circuit is created or destroyed or its status changes between active and inactive.
|
|
PFE Notifications
Table 4-8 lists notifications that can occur during PFE (packet forwarding engine) events.
Table 4-11 PFE Notifications
Event
|
Description
|
Probable Cause
|
Recommended Action
|
cePfeThldEvent
|
Indicates that the PFE utilization or efficiency status changed.
|
Sent when PFE utilization or efficiency reaches or exceeds a threshold. For example, if the current PFE utilization (cePfePerfCurrentUtilization) reaches or exceeds the threshold cePfePerfConfigThldUtilization, SNMP generates a thldUtilizationEvent.
cePfeHistType indicates the type of event that occurred. See the MIB object HistEventType for details about event types.
|
Enable this notification through the CLI or by setting cePfeHistNotifiesEnable to notify(3) or logAndNotify(4).
|
cePfeHistRestartEvent
|
Indicates that the PFE processor status changed.
|
The PFE processor was restarted.
|
No action required.
|
Service Selection Gateway Notification
Table 4-12 lists notifications that can occur during service selection gateway (SSG) events.
Table 4-12 Service Selection Gateway Notifications
Event
|
Description
|
Probable Cause
|
Recommended Action
|
| |
Indicates that SSG status has changed.
|
Sent when SSG detects that a RADIUS client has rebooted. (SSG uses RADIUS servers to authenticate subscribers.)
|
|
Protocol Notifications
Table 4-13 lists notifications that can occur during protocol events.
Table 4-13 Protocol Notifications
Event
|
Description
|
Probable Cause
|
Recommended Action
|
frDLCISStatusChange
|
Indicates that the casState object status has changed.
|
Sent when the casState object changes state. The value of casState indicates if the router should send requests to the authentication, authorization, and accounting (AAA) server:
•up(1)—Send requests to the server.
•dead(2)—Do not send requests to the server. Send requests to the next available server instead.
The object casState does not necessarily indicate the current state of the server. This is because casState is always up(1) unless an AAA request fails. In that case, casState is set to dead(2) and then reset to up(1) to allow the router to send requests to the server after a failure.
The number of minutes casState remains dead(2) is specified by the command radius-server deadtime minutes. For example, if server deadtime is 5 minutes and an AAA request fails, a notification is generated with casState set to dead(2). Five minutes later, another notification is generated with casState set to up(1) even though the server may still be down.
|
|
oamLoopbackPingCompletionTrap
|
|
Sent when an OAM loopback test is completed.
|
|
cPppoeSystemSessionThresholdTrap
|
|
Sent when the number of active PPPoE sessions exceeds the value of cPppoeSystemThresholdSessions
|
|
cPppoeVcSessionThresholdTrap
|
|
Sent when the number of active PPPoE sessions on the VC exceeds the value of cPppoeVcThresholdSessions
|
|
