Email Notifications for Alarms based on SNMP Traps
Ian MacDonald <IMacDonald <at> quartetservice.com>
2013-05-16 12:52:58 GMT
I am trying to setup OpenNMS to monitor VPN tunnels.
My goaI is to have email notifications from OpenNMS alarm, triggered by a VPN tunnel-down trap, when a VPN
tunnel-up trap (that clears alarm state) has not arrived within 5 minutes.
Normally we use ICMP packets NAT'd over the tunnel for monitoring notification purposes, but are
constrained to doing this monitoring only with traps in this particular scenario.
The hardware we are receiving traps from is a Fortinet 60B that has multiple IPSEC VPN tunnels configured to
connect to similarly configured Fortinet devices at remote locations.
So far, I have updated event definitions to properly identity the VPN traps (Slight modification to
existing OpenNMS Fortinet v3 Event xml to support the FortIOS v4 MIBs). I have included these below for
reference.
Currently we can receive traps with OpenNMS and generate email notifications for those traps indicating
Up/Down. The VPN Up and VPN Down trap notifications contain appropriate varbinds to identify the
particular tunnel by its remote tunnel endpoint.
Our goal is to use Alarms so that we can correlate the Down/Up traps for a specific location using the tunnel
endpoint pararmeter in the Alarm reduction label. We also want to suppress notifications for brief
tunnel flaps, or delay notification to see if the situation resolves itself.
Reading the following posts, I am able to generate events, and generate notifications for those events,
and I now even have Alarms setup that seem to reflect the events.
We can't seem to figure out how to trigger notifications from the alarms, as the emails still arrive based on
the event state, not the alarm state.
Specifically, I want an email when <alarm-data reduction-key="%parm[#3]%!%parm[#4]%!%nodeid%"> is
triggered, and would like to suppress/delay it when the clear-key is received.
http://www.opennms.org/wiki/Configuring_alarms
http://www.opennms.org/wiki/Creating_Threshold_Alarms
Below is my event.xml for the Traps we are generating alarms for:
<event>
<mask>
<maskelement>
<mename>id</mename>
<mevalue>.1.3.6.1.4.1.12356.101.2</mevalue>
</maskelement>
<maskelement>
<mename>generic</mename>
<mevalue>6</mevalue>
</maskelement>
<maskelement>
<mename>specific</mename>
<mevalue>301</mevalue>
</maskelement>
</mask>
<uei>uei.opennms.org/traps/fortinet/fnTrapVpnTunUp</uei>
<event-label>FORTIOS-400-MIB defined trap event: fnTrapVpnTunUp</event-label>
<descr>
<p>Indicates that the specified VPN tunnel has been brought up.</p><table>
<tr><td><b>
fnSysSerial</b></td><td>
%parm[#1]%;</td><td><p></p></td></tr>
<tr><td><b>
sysName</b></td><td>
%parm[#2]%;</td><td><p></p></td></tr>
<tr><td><b>
fnVpnTrapLocalGateway</b></td><td>
%parm[#3]%;</td><td><p></p></td></tr>
<tr><td><b>
fnVpnTrapRemoteGateway</b></td><td>
%parm[#4]%;</td><td><p></p></td></tr></table>
</descr>
<logmsg dest='logndisplay'><p>
fnTrapVpnTunUp trap received
fnSysSerial=%parm[#1]%
sysName=%parm[#2]%
fnVpnTrapLocalGateway=%parm[#3]%
fnVpnTrapRemoteGateway=%parm[#4]%</p>
</logmsg>
<severity>Cleared</severity>
<alarm-data reduction-key="%parm[#3]%:%parm[#4]%:%nodeid%"
clear-key="%parm[#3]%!%parm[#4]%!%nodeid%" alarm-type="2" auto-clean="false"/>
</event>
<event>
<mask>
<maskelement>
<mename>id</mename>
<mevalue>.1.3.6.1.4.1.12356.101.2</mevalue>
</maskelement>
<maskelement>
<mename>generic</mename>
<mevalue>6</mevalue>
</maskelement>
<maskelement>
<mename>specific</mename>
<mevalue>302</mevalue>
</maskelement>
</mask>
<uei>uei.opennms.org/traps/fortinet/fnTrapVpnTunDown</uei>
<event-label>FORTIOS-400-MIB defined trap event: fnTrapVpnTunDown</event-label>
<descr>
<p>The specified VPN tunnel has been brought down.</p><table>
<tr><td><b>
fnSysSerial</b></td><td>
%parm[#1]%;</td><td><p></p></td></tr>
<tr><td><b>
sysName</b></td><td>
%parm[#2]%;</td><td><p></p></td></tr>
<tr><td><b>
fnVpnTrapLocalGateway</b></td><td>
%parm[#3]%;</td><td><p></p></td></tr>
<tr><td><b>
fnVpnTrapRemoteGateway</b></td><td>
%parm[#4]%;</td><td><p></p></td></tr></table>
</descr>
<logmsg dest='logndisplay'><p>
fnTrapVpnTunDown trap received
fnSysSerial=%parm[#1]%
sysName=%parm[#2]%
fnVpnTrapLocalGateway=%parm[#3]%
fnVpnTrapRemoteGateway=%parm[#4]%</p>
</logmsg>
<severity>Major</severity>
<alarm-data reduction-key="%parm[#3]%!%parm[#4]%!%nodeid%" alarm-type="1" auto-clean="false"/>
</event>
------------------------------------------------------------------------------
AlienVault Unified Security Management (USM) platform delivers complete
security visibility with the essential security capabilities. Easily and
efficiently configure, manage, and operate all of your security controls
from a single console and one unified framework. Download a free trial.
http://p.sf.net/sfu/alienvault_d2d
_______________________________________________
Please read the OpenNMS Mailing List FAQ:
http://www.opennms.org/index.php/Mailing_List_FAQ
opennms-discuss mailing list
To *unsubscribe* or change your subscription options, see the bottom of this page:
https://lists.sourceforge.net/lists/listinfo/opennms-discuss
RSS Feed