Product Documentation

Configuring the NetScaler to Generate SNMP Traps

Jun 01, 2015

You can configure the NetScaler appliance to generate asynchronous events, which are called traps. The traps are generated whenever there are abnormal conditions on the appliance. The traps are sent to a remote device called a trap listener. This helps administrators monitor the appliance and respond promptly to any issues.

The NetScaler appliance provides a set of condition entities called SNMP alarms. When the condition in any SNMP alarm is met, the appliance generates SNMP trap messages that are sent to the configured trap listeners. For example, when the LOGIN-FAILURE alarm is enabled, a trap message is generated and sent to the trap listener whenever there is a login failure on the appliance.

To configure the NetScaler appliance to generate traps, you need to enable and configure alarms. Then, you specify trap listeners to which the appliance will send the generated trap messages.

Enabling an SNMP Alarm

The NetScaler appliance generates traps only for SNMP alarms that are enabled. Some alarms are enabled by default, but you can disable them.

When you enable an SNMP alarm, the appliance generates corresponding trap messages when some events occur. Some alarms are enabled by default.

To enable an SNMP alarm by using the command line interface

At the command prompt, type the following commands to set the parameters and verify the configuration:

  • enable snmp alarm <trapName>
  • show snmp alarm <trapName>

To enable an SNMP alarm by using the configuration utility

  1. Navigate to System > SNMP > Alarms, and select the alarm.
  2. Click Actions and select Enable.

Configuring Alarms

The NetScaler appliance provides a set of condition entities called SNMP alarms. When the condition set for an SNMP alarm is met, the appliance generates SNMP traps messages that are sent to the configured trap listeners. For example, when the LOGIN-FAILURE alarm is enabled, a trap message is generated and sent to the trap listener whenever there is a login failure on the appliance.

You can assign an SNMP alarm with a severity level. When you do this, the corresponding trap messages are assigned that severity level.

The following are the severity levels, defined on the appliance, in decreasing order of severity.

  • Critical
  • Major
  • Minor
  • Warning
  • Informational

For example, if you set a warning severity level for the SNMP alarm named LOGIN-FAILURE, the trap messages generated when there is a login failure will be assigned with the warning severity level.

You can also configure an SNMP alarm to log the corresponding trap messages generated whenever the condition on that alarm is met.

To configure an SNMP alarm by using the command line interface

At the command prompt, type the following commands to configure an SNMP alarm and verify the configuration:

  • set snmp alarm <trapName> [-thresholdValue <positive_integer> [-normalValue <positive_integer>]] [-time <secs>] [-state ( ENABLED | DISABLED )] [-severity <severity>] [-logging ( ENABLED | DISABLED )]
  • show snmp alarm <trapName>

To configure SNMP alarms by using the configuration utility

Navigate to System > SNMP > Alarms, select an alarm and configure the alarm parameters.

Configuring SNMPv1 or SNMPv2 Traps

After configuring the alarms, you need to specify the trap listener to which the appliance sends the trap messages. Apart from specifying parameters such as IP or IPv6 address and the destination port of the trap listener, you can specify the type of trap (either generic or specific) and the SNMP version.

You can configure a maximum of 20 trap listeners for receiving either generic or specific traps.

You can also configure the appliance to send SNMP trap messages with a source IP address other than the NetScaler IP (NSIP or NSIP6) address to a particular trap listener. For a trap listener that has an IPv4 address, you can set the source IP to either a mapped IP (MIP) address or a subnet IP (SNIP) address configured on the appliance. For a trap listener that has an IPv6 address, you can set the source IP to subnet IPv6 (SNIP6) address configured on the appliance.

You can also configure the appliance to send trap messages to a trap listener on the basis of a severity level. For example, if you set the severity level as Minor for a trap listener, all trap messages of the severity level equal to or greater than Minor (Minor, Major, and Critical) are sent to the trap listener.

If you have defined a community string for the trap listener, you must also specify a community string for each trap that is to be sent to the listener. A trap listener for which a community string has been defined accepts only trap messages that include a community string matching the community string defined in the trap listener. Other trap messages are dropped.

To add an SNMP trap by using the command line interface

At the command prompt, type the following commands to set the parameters and verify the configuration:

  • add snmp trap <trapClass> <trapDestination> -version ( V1 | V2 ) -destPort <port> -communityName <string> -srcIP <ip_addr> -severity <severity>
  • show snmp trap
Example
> add snmp trap specific 10.102.29.3 -version V2 -destPort 80 -communityName com1 -severity Major

To configure SNMP Traps by using the configuration utility

Navigate to System > SNMP > Traps, and create the SNMP trap.

Configuring SNMPv3 Traps

SNMPv3 provides security capabilities such as authentication and encryption by using the credentials of SNMP users. An SNMP manager can receive SNMPv3 trap messages only if its configuration includes the password assigned to the SNMP user.

The trap destination can now receive SNMPv1, SNMPv2, and SNMPv3 trap messages.

To configure an SNMPv3 trap by using the command line interface

At the command prompt, do the following:

  1. Add an SNMPv3 trap.

    add snmp trap <trapClass> <trapDestination> -version ( V1 | V2 | V3) -destPort <port> -communityName <string> -srcIP <ip_addr> -severity <severity>

    Note: Once set, the SNMP trap version cannot not be modified.
    Example
    > add snmp trap specific 10.102.29.3 -version V3 -destPort 80 -communityName com1 -severity Major
    
  2. Add an SNMP user.

    add snmp user <name> -group <string> [ -authType ( MD5 | SHA ) { -authPasswd } [-privType ( DES | AES ) { -privPasswd }]]

    Example
    > add snmp user edocs_user -group edocs_group
    
  3. Bind the SNMPv3 trap to the SNMP user.

    bind snmp trap <trapClass> <trapDestination> [-version <version>] (-userName <string> [-securityLevel <securityLevel>])

    Example
    > bind snmp trap specific 10.102.29.3 -version V3 -userName edocs_user -securityLevel authPriv
    

To configure an SNMPv3 trap by using the configuration utility

  1. Add an SNMPv3 trap.

    Navigate to System > SNMP > Traps, and create the SNMP trap by selecting V3 as the SNMP version.

  2. Add an SNMP user.

    Navigate to System > SNMP > Users, and create the SNMP user.

  3. Bind the SNMPv3 trap to the SNMP user.
    • Navigate to System > SNMP > Traps, and select the SNMP version 3 trap.
    • Select the user to which the trap should be bound and define the appropriate Security Level.

Enabling Unconditional SNMP Trap Logging

By default, the NetScaler appliance logs any SNMP trap messages (for SNMP alarms in which logging is enabled) when at least one trap listener is specified on the appliance. However, you can specify that SNMP trap messages be logged even when no trap listeners are configured.

To enable unconditional SNMP trap logging by using the command line interface

At the command prompt, type the following commands to configure unconditional SNMP trap logging and verify the configuration:
  • set snmp option -snmpTrapLogging ( ENABLED | DISABLED )
  • show snmp option

To enable unconditional SNMP trap logging by using the configuration utility

Navigate to System > SNMP, click Change SNMP Options and select SNMP Trap Logging.