Trap Watcher

Guenter Matthaeus · Post by **Guenter Matthaeus** » Thu Aug 12, 2004 8:32 am

I want to check all Trap events on a machine. Setting is UDP Port 162
Setup Filter... is set for all options 2Any"
message contains OID> is unmarked.
Click on Start i get the message:
Listen error: Error 10013 in function Bind Permission denied

Could anybody help me

KS-Soft · Post by **KS-Soft** » Thu Aug 12, 2004 9:50 am

Looks like some other application already uses port 162 with exclusive access. Probably you already started some SNMP console...

Regards
Alex

Guenter Matthaeus · Post by **Guenter Matthaeus** » Thu Aug 12, 2004 11:54 pm

There is FSC Serverview running. Because we have a problem with Traps Authentication we want to see which other process/application is sending traps to our ServerView Server. Serverview is working corrct, so we get critical errors and so on. But a lot of machines are sending traps like
snmputil: Generic trap: 4 ("AUTHFAILURE") enterprise=1.3.6.1.4.1.311.1.1.3.1.2
from -> IPAdress
So the error pipe is filled and the critical errors are senden with delay of 15 to 30 minutes.
I'm not a network specialist and I thought with IP Tools I can look where are the traps from. On the the same machine where IP tools are running, Serverviev and Advanced Host Monitor are running.
Ideas welcom

KS-Soft · Post by **KS-Soft** » Fri Aug 13, 2004 12:23 pm

Try to start IP-Tools before ServerView. IP-Tools does not use port in exclusive mode, may be both applications will work...

Regards
Alex

Guenter Matthaeus · Post by **Guenter Matthaeus** » Mon Aug 16, 2004 4:22 am

The failure was a configuration problem of the snmp service. Because of security, I've configured the Snmp service only to take sbmp events from one special host. For this configuration you must also add "localhost" to the list of allowed servers.
But there is another problem now : After installing IP Tools. Hostmonitor sends notification mails and reports twice instead one time. We haven't made any changes in Hostmon, but for example our daily report, with all bad, unknown and disabled servers, every day at 06:00 is sended twice to the admins.
I've deinstalled IP Tools and rebooted the Server but the problem is still the same.
Our second Hostmon Server (redundancy with the same tests) is working as all the days before.

KS-Soft · Post by **KS-Soft** » Mon Aug 16, 2004 11:45 am

This problem cannot be related to IP-Tools. Looks like you have started 2 instances of HostMonitor. May be one instance runs as service another runs as application?

Our second Hostmon Server (redundancy with the same tests) is working as all the days before

So, you have 2 instances of HostMonitor? That's why you have 2 sets of alerts.

Regards
Alex

Guenter Matthaeus · Post by **Guenter Matthaeus** » Tue Aug 17, 2004 12:41 am

that was my first thought,
but looking with task manager threre is only one process hostmon running.
restarted the server, doesn't matter. this morning I've got 3 daily reports.
but from only our two servers

KS-Soft · Post by **KS-Soft** » Tue Aug 17, 2004 11:49 am

H'm...
How you configured HostMonitor to send daily reports? Using Scheduler and "on the schedule" actions? Or using action profile assigned to some test? What version of HostMonitor do you use?

Regards
Alex

Guenter Matthaeus · Post by **Guenter Matthaeus** » Wed Aug 18, 2004 12:20 am

Last question first
Yesterday I upgraded to version 4.60 but doesn't help.
I use action profile which generate reports for root and all folders and subfolders. Under options - schedule I have defintly one schedule>every day at 06:00 sending mail with attached report for all servers are bad, disabled or unknown.
I will look if I can find differences between our two servers in settings

KS-Soft · Post by **KS-Soft** » Wed Aug 18, 2004 11:13 am

I use action profile which generate reports for root and all folders and subfolders.

Probably I know where problem is. Do you use "Execute action profile when complete" on the Reports page in the Options dialog?
If yes, profile started by Scheduler AND actions executed after reports generated. To correct the problem unmark option on Reports page.

Regards
Alex

Guenter Matthaeus · Post by **Guenter Matthaeus** » Thu Aug 19, 2004 2:04 am

I take a look for the option, but it's unmarked.
Just for information, all events from the one server are reported twice

so for example if I stop and start a service on a server I get the down mail and the up mail twice from the buggy server

KS-Soft · Post by **KS-Soft** » Thu Aug 19, 2004 12:58 pm

Could you please send your settings for testing (support@ks-soft.net)? We need HML file with tests, all *.LST files and hostmon.ini file.

Regards
Alex

Guenter Matthaeus · Post by **Guenter Matthaeus** » Tue Aug 24, 2004 12:59 am

Because the problem seems to be very magic, and we can not find any failure in the configuration, we will deploy the HostMonitor Server new. I will take us less time than discovering the magic problem

Thanks a lot for supporting and keep on with Hostmon

KS-Soft · Post by **KS-Soft** » Tue Aug 24, 2004 12:04 pm

Have one idea... Do you receive all alerts twice? Or you just receiving more "good" alerts than "bad" alerts?

Regards
Alex

Guenter Matthaeus · Post by **Guenter Matthaeus** » Wed Aug 25, 2004 12:47 am

I've deployed the Server new, an at the moment I enjoy my first coffee.
Ok, without joke. I've got all alerts, reports twice. Good alerts and bad alerts.
I will not spend more time looking for a problem that is solved.
Alex thanks a lot for supporting and have a good time.
My next call will come

KS-Soft

Trap Watcher

Trap Watcher

Correct

definitly not

sorry Alex

Magic

No problem at the moment