Anyone creating SNMP traps?

[mikec]

We are in the process of migrating to CMOD 8.5 from another product.  I am trying to define daily housekeeping and monitoring processes.  One thing I want to do is monitor errors by periodically running a query on the log to look for errors.  Once an error is found, I want to create a trap to send to our enterprise monitoring tool which in turn will create a service desk ticket.  Otherwise, how are you tracking errors?

[demaya]

Hi,

we use the arslog (Link) exit with a custom script behind. We only monitor ERRORs and every 10 mins I send an email with an error summary. So maybe you can just send a trap out instead of sending an email... what platform (AIX, Win,...) are you on?

Cheers

[mikec]

we're gonna be running on AIX 7. 

[demaya]

we're gonna be running on AIX 7. 

We use AIX as well... so my script could fit you Let me know if you wanna see it

[Alessandro Perucchi]

Hello,

I agree with Mayach, /usr/lpp/ars/bin/arslog is the way to go. This is a simple ksh script which is called for each all log entries that CMOD is creating.

Meaning it must be quick otherwise you might end up slowing the whole process. So just take/do what you need.

You are allowed to change it to suit your taste, be sure to read the comments in this script and experiment, and if Mayac is giving you a sample, the better!

Cheers,
Alessandro

[demaya]

I always send my arslog.pl to background (in the original arslog):

Code: [Select]

arslog.pl "$1" "$2" "$3" "$4" "$5" "$6" "$7" "$8" &
exit 0

arslog.pl:

Code: [Select]

#!/usr/bin/perl -w

use strict;
use warnings;
#

# $1 - OnDemand Instance Name
# $2 - Time Stamp
# $3 - Log Identifier
# $4 - Userid
# $5 - Account
# $6 - Severity
####### 1 Alert
####### 2 Error
####### 3 Warning
####### 4 Information
####### 5 Debugging
# $7 - Message Number
# $8 - Message Text

my $scriptLogPath = "/archiv/scripts/arslog/log";
my ($odInstanceName, $odTimeStamp, $odLogIdentifier, $odUserID, $odAccount, $odSeverity, $odMessageNum, $odMessageText) = @ARGV;

if(($odSeverity == 1) or ($odSeverity == 2) or ($odSeverity == 3)) {
        open(FILE, ">$scriptLogPath/$odInstanceName.$odLogIdentifier");
        print FILE "$odTimeStamp\|$odUserID\|$odSeverity\|$odMessageNum\|$odMessageText";
        close(FILE);
}

And now every 10 minutes my "analyzelog.pl" analyzes the files in the log path and sends out mails if the errors/warnings/alerts are worthy to send out... in this script there's more intelligence. Like Alessandro mentioned I wanted to use as less as possible systemresources for the arslog-Userexit...

Cheers

[mikec]

Thanks!  This information is useful.
My thought is to bypass the exit and to execute the script externally.  I can schedule a batch process to run every x minutes through my job scheduler.  This way I can run a query and not worry about affecting processing time.  I actually have some code that I wrote for another project that sends a SNMP trap that I can modify.  I want to use a trap so my monitoring tools can automatically capture it and generate a service ticket.  I just have to code up an oid.  I was just curious how others were handling this.

[Alessandro Perucchi]

You cannot run arslog by yourself, it is launch automatically by CMOD each time he needs to log something.
So the way Mayach is the correct one.

The other way would be to get the info directory from the SL* tables in CMOD, but what's the point if you get already an entry for them via arslog?

Cheers,
Alessandro

[mikec]

This is why I asked.  I was concerned about resources, which is why I was thinking about running an external process. It sounds like arslog might be the better way to start out. Then if it starts to dog the system, I can always move to SL table query.  I expect we'll have a bunch of errors at first, but that should minimize as we become more familiar with the overall processes.

[demaya]

I expect we'll have a bunch of errors at first, but that should minimize as we become more familiar with the overall processes.

You're right... in my analyze script I implemented one more query on the msg-num of the error so I could filter out the garbage-errors/warnings(a user searched with 10 digits instead of 9 and stuff),...