Welcome to Aquilaweb

MVP David Allen's weblog advising on
System Center Operations Manager

SNMP Probe Based Monitors

Setting up a probe based SNMP monitor is quite simple; however, there does seem to be some confusion out there about what to use as the Parameter Name and how to call the value in the alert description. Hopefully this will clear things up but if you do still have questions after reading this blog entry please leave a comment or contact me using the link above.

Before setting up the monitor you need to discover your SNMP device(s).

Once your devices have been discovered you need to create your new SNMP probe based simple event monitor..





Then set the general properties for the monitor making sure your monitor target is set to SNMP Network Device..




Next, set the object identifier for your first expression. This will be the OID of the object you are querying; in this case the temperature value from an environmental probe is being monitored..





The next stage is to build your expression and this seems to be the part where most of the confusion is lying. To return the value of the OID you need to enter /DataItem/SnmpVarBinds/SnmpVarBind[1]/Value in the Parameter Name field. Then complete the expression by using the Operator and Value fields which are self explanatory..




Once completed, continue to follow the unit monitor wizard to build a second expression in the same way as the two previous steps above. Then comes mapping your monitor conditions to a health state - so, for example, put health state into Warning if the first event has been raised and put health state to healthy if the second event has been raised..




The last step is to configure the alert settings which are pretty straight forward until you decide that you would like the value of the OID query in the alert description. To return this value enter $Data/Context/SnmpVarBinds/SnmpVarBind[1]/Value$
along with any other static text you may want..




I hope this is short but descriptive enough to help anyone struggling with setting up an SNMP probe based monitor.

Happy Monitor Creating :-)

08 Apr, 2008 | David

Comments

Excellent walkthrough, makes it very clear.

Steve

Steve - 09 Apr, 2008 - 08:00:38
--------------------------


what happens if the value returned is 3 ? Apparently SCOM treats the value as text, so 3 will be greater than 22, and it will trigger the alert...
(at least, that's what I see in my setup... can someone confirm this ?)

c0d3r - 10 Apr, 2008 - 08:54:21
--------------------------


This is a current live monitor that is working fine, provided that the value returned is just the numeric value with no text the expression should work fine.

If you would like me to look over the setup of your monitor, please send the details through.

David - 10 Apr, 2008 - 09:33:00
--------------------------


I believe I'm seeing the non-numeric problem as well.

I have a monitor set up on our APC PDUs here to alert if one gets overloaded. I'm querying an OID that returns a GAUGE type that measures load in tenths of an amp, and the PDUs are rated for 16 amps.

So, what I do:

First probe: .1.3.6.1.4.1.318.1.1.12.2.3.1.1.2.1 (that's the load)
First expression: /DataItem/SnmpVarBinds/SnmpVarBind[1]/Value "Greater than or equal to" 160

Second probe: (same)
Second expression: /DataItem/SnmpVarBinds/SnmpVarBind[1]/Value "Less than" 160

Health critical on first event, healthy on second.

I have it set to fire an alert, with the alert including the current load value ($Data/Context/SnmpVarBinds/SnmpVarBind[1]/Value$)

...

When I turn this on, several of my PDUs immediately fire critial alerts. If I look at the alerts (or the context info for the state change) I see:

OID: (same as above), Syntax: Gauge 32, Value: 75

... I'm pretty sure 75 is less than 160, numerically...

J. Grizzard - 02 May, 2008 - 18:50:43
--------------------------


The reason for OpsMgr not matching correctly is that it expects string type data for monitors created by the wizard.

You can correct this by changing the data type to Integer or Double in the XML file. More details here:

http://rburri.wordpress.com...

R. Burri - 10 Jun, 2008 - 10:08:47
--------------------------


I've written over four dozen SNMP Unit Monitors for OpsMgr 2007 that check
for specific OID numbers using First Expression Filters and Second Expression
Filters in which the Parameter Names are of the format
"SnmpVarBinds/SnmpVarBind[1]/Value" and setting the value to some text that
the device sends back in the SNMP trap. These are all working fine.
However, I now have a device which sends back an SNMP trap that sets the
value of "Specific Trap" and I need to create an Expression Filter that looks
for a value in the SNMP Specific Trap part of the UDP packet. Does anyone
know what value I would specify in the Parameter Name of the Expression
filter to access the SNMP Specific Trap value?

vsefcik - 16 Jun, 2008 - 23:07:07
--------------------------


Hi,

I have been trying to create a SNMP probe-based unit monitor for the past few days without success. The information provided on this blog finally solved my problem. Thanks a lot.

Dany Laferriere - 24 Sep, 2008 - 18:01:24
--------------------------


Hi,

thank you very much for this great description, it helps alot.

I also tried to create custom monitors for a few days now and have also used some SCOM books but the information concerning SNMP devices was not satisfying at all.

With your help I will create some custom monitors the next days and I would be thankful if I could ask you when crossing problems.

Big thanks!
Berni

Berni - 04 Nov, 2008 - 13:46:50
--------------------------


Dear,developer!
I want to write some mp for my network devices, for example, switchs- Hp ProCurve.
Can you get some lessons or instructions (step-by-step) how to create mp or mp for Hp ProCurve switches!?
Thank you!
my e-mail: leu@list.ru
or
eleytan@pgsouz.ru

Eugene - 09 Apr, 2009 - 08:53:32
--------------------------


it just works fine. thanks for the procedure.

nagesh - 19 May, 2009 - 19:57:49
--------------------------


Thanks alot for this information, works fine with me.

one concern,

do you have a website that identify all SNMP objects and values used for network devices such as "Bandwidth" or "number of packet loss". how to figure out thise values ?

Regards,

Mohamad Damati - 01 Sep, 2009 - 21:35:07
--------------------------


Thank you for your article, but i still have a question. what's the "/DataItem/SnmpVarBinds/SnmpVarBind[1]/Value" stands for ? so why do you input the value "22"? i am really wonder that. Hope you can help me. Thanks a ton.

Nathan - 10 Mar, 2010 - 10:47:52
--------------------------


"/DataItem/SnmpVarBinds/SnmpVarBind[1]/Value" returns the value after probing the OID.

The reason I have a value of 22 is because I wanted an alert generated if the value returned was greater than 22.

Hope that helps.

David - 23 Mar, 2010 - 09:38:18
--------------------------

Leave comment