略。
某局点做SSL VPN认证,设备上认证上线的信息通过syslog日志转发给iMC,iMC侧配置告警规则,将上线信息升级为告警,但是出现第一次上线的时候可以告警,但是用户下线之后再次上线,syslog可以收到,但是不会生成告警,告警也不转发。
复现问题,收集debug级别的imcfaultdm日志,在日志中发现告警中存在此oid信息因为重复被过滤。
2019-05-27 15:34:46.257 [DEBUG (0)] [THREAD(98592)] [CTrapProcessorTaskMgr::processReceiveTrap] dev:2034 Trap oid: 1.3.6.1.4.1.25506.4.2.8.2.6.20
2019-05-27 15:34:46.257 [DEBUG (0)] [THREAD(99044)] [CTrapProcessorTask::dealTrapData] Trap deal start.
2019-05-27 15:34:46.257 [DEBUG (0)] [THREAD(99044)] [CTrapProcessorTask::dealTrapData] copy data.
2019-05-27 15:34:46.257 [DEBUG (0)] [THREAD(99044)] [CTrapProcessorTask::dealTrapData] Repeat filter.
2019-05-27 15:34:46.257 [DEBUG (0)] [THREAD(99044)] [CTrapProcessorTask::dealTrapData] Trap is repeat,fault_oid = 1.3.6.1.4.1.25506.4.2.8.2.6.20, dev_id = 2034
2019-05-27 15:34:46.347 [DEBUG (0)] [THREAD(91436)] [ CDevTrapAdaptor::TrapCB()]
2019-05-27 15:34:47.251 [DEBUG (0)] [THREAD(100156)] [CTrapProcessorTaskMgr::processReceiveTrap()] Receive A Trap.
2019-05-27 15:34:47.251 [DEBUG (0)] [THREAD(100156)] [CTrapProcessorTask::convertPduToTrapData] Get Trap from [10.200.251.1]
2019-05-27 15:34:47.251 [DEBUG (0)] [THREAD(100156)] [CDevBasicInfo::getDevInfo] itDevIPAddrInfo != m_oDevIPMap.end()
2019-05-27 15:34:47.251 [DEBUG (0)] [THREAD(100156)] [CTrapProcessorTask::getDevIDbyIP] iRet == SNACC::AsnDmErrCode::iRST_MSG_FAULT_OPERATION_SUCCESS
2019-05-27 15:34:47.251 [DEBUG (0)] [THREAD(100156)] CTrapDefAccessor::findDevTrapSeverity: get resultByDevID failed,dev_id = 2034
2019-05-27 15:34:47.251 [DEBUG (0)] [THREAD(100156)] [CTrapProcessorTask::convertPduToTrapData] Fainal Trap source: [10.200.251.1]
2019-05-27 15:34:47.251 [DEBUG (0)] [THREAD(100156)] [CTrapProcessorTaskMgr::processReceiveTrap] dev:2034 Trap oid: 1.3.6.1.4.1.25506.4.2.8.2.6.20
2019-05-27 15:34:47.251 [DEBUG (0)] [THREAD(98420)] [CTrapProcessorTask::dealTrapData] Trap deal start.
2019-05-27 15:34:47.251 [DEBUG (0)] [THREAD(98420)] [CTrapProcessorTask::dealTrapData] copy data.
2019-05-27 15:34:47.251 [DEBUG (0)] [THREAD(98420)] [CTrapProcessorTask::dealTrapData] Repeat filter.
2019-05-27 15:34:47.252 [DEBUG (0)] [THREAD(98420)] [CTrapProcessorTask::dealTrapData] Trap is repeat,fault_oid = 1.3.6.1.4.1.25506.4.2.8.2.6.20, dev_id = 2034
通过查看此oid信息确认为iMC Syslog的oid信息,故怀疑为iMC侧重复Trap过滤导致将这个Syslog的告警信息给过滤掉了。
在重复Trap过滤中将这个oid 1.3.6.1.4.1.25506.4.2.8.2.6.20 的Trap信息设置为不重复的Trap之后问题解决。
该案例暂时没有网友评论
✖
案例意见反馈
亲~登录后才可以操作哦!
确定你的邮箱还未认证,请认证邮箱或绑定手机后进行当前操作