Unified Platform Trap Filter Rule

Configuration Examples

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

Document version: 5W106-20241025

Product version: E0714

 

Contents

Introduction· 1

Usage guidelines· 2

Application scenarios· 2

Prerequisites· 2

Configuration examples· 3

Network configuration· 3

Procedure· 3

 

Introduction

Based on the trap filter rules, Unified Platform can filter a large number of traps generated on the network and allows you to receive only the concerned traps. This feature improves the trap values and manageability, and improves the performance of the alarm server. Unified Platform has predefined the following trap filter rules:

·     Undefined trap filter—An undefined trap refers to a trap whose OID has not yet been defined in the system. After the undefined trap filter is enabled, the system drops the undefined traps received. When the specified threshold is reached, the system generates an alarm.

·     Repeated trap filter—When the system receives a trap, the system identifies whether a trap from the same device and with the same parameters has been received. If yes, the system drops the newly received trap, and stops analyzing or processing the trap. When the number of repeated traps exceeds the specified threshold, the system generates an alarm and sends it to the user.

·     Flapping trap filter—A flapping trap means that an abnormal state resumes normal in a short time. After flapping trap analysis is enabled, the system analyzes the received flapping traps. When the specified threshold is reached, the system generates an alarm.

·     Unmanaged trap filter—Unmanaged traps refer to traps generated by resources not added to the system. After the unmanaged trap filter is enabled, the system drops the traps from unmanaged devices. When the specified threshold is reached, the system generates an alarm.

Moreover, you can define filter rules as needed. The following information describes how to configure trap filter rules on Unified Platform in an example.

 

 

Usage guidelines

Application scenarios

This feature is applicable to scenarios where you need to process only a subset of many traps received.

Prerequisites

Unified Platform has incorporated the monitored network devices and Unified Platform can receive traps from them.

 

 

Configuration examples

Network configuration

A company uses Unified Platform to manage the network. The topology of the network in the company is as shown in Figure 1. The operator needs to meet the following two requirements during the company network management process:

·     In the network managed by Unified Platform, if a device reports the same trap more than 50 times within 10 minutes, Unified Platform will generate only one alarm for that trap and filter out other repeated traps except for SNMP authentication failure traps. For more information, see "Editing the predefined repeated trap filter rule."

·     Filter out all link down traps from the device at IP address 10.114.118.115. For more information, see "Adding a custom filter rule."

Figure 1 Topology of the network in the company

 

Procedure

Editing the predefined repeated trap filter rule

1.     Log in to Unified Platform as an administrator.

2.     Navigate to the Monitor > Alarm > Traps > Trap Filter Rules page as shown in Figure 2. The trap filter rule list displays all the trap filter rules in the system.

Figure 2 Trap filter rule list

 

3.     Click the Edit icon  in the Actions column for the repeated trap filter rule on the trap filter rule list. The page for editing the rule opens, as shown in Figure 3.

Figure 3 Editing the predefined trap filter rule

 

4.     Select repeated traps excluded from filtering.

a.     Click the Select Traps button. The Select Traps page opens.

b.     Enter matrix in the Enterprise Name field, and click the Search button to search for traps containing matrix in their enterprise names.

c.     Select the Host Etcd Component Recovery trap, as shown in Figure 4.

Figure 4 Selecting repeated traps excluded from filtering

 

d.     Click OK to save repeated traps excluded from filtering, as shown in Figure 5. After configuration, the system will not filter repeated Host Etcd Component Recovery traps.

Figure 5 Excluding Host Etcd Component Recovery traps from filtering

 

5.     Configure other parameters as follows:

¡     Escalate to Alarm: With this option selected, the system generates a new alarm when the number of repeated traps received exceeds the specified threshold.

¡     Threshold (1- 5000): With the Escalate to Alarm option selected, you can set the threshold. The system generates a new alarm when the number of repeated traps received within the specified time exceeds the threshold. In this example, set the threshold to 50. When a device reports the same trap more than 50 times within the specified time window, the system generates only one alarm for that trap.

¡     Filter Repeated Traps: With this option selected, the repeated traps (except SNMP authentication failure traps selected in repeated traps excluded from filtering) received within the specified time window are reported only once.

¡     Use Sliding Time Window: Select this option to use the sliding time window. If you do not select this option, a fixed time window is used.

¡     Time Window Length (1-1500 Minutes): After you select to use the sliding time window, you can configure the time window length. The repeated traps received within the specified time window are reported only once. In this example, set the time window length to 10 minutes. Then, only one trap will be retained for repeated traps received within 10 minutes.

The configuration result is as shown in Figure 6.

Figure 6 Configuring the repeated trap filter

 

6.     Click OK to complete editing the trap filter rule.

 

NOTE: You can configure repeated traps excluded from filtering, time window length, and using the sliding time window only after you select Escalate to Alarm or Filter Repeated Traps, or both.

 

Adding a custom filter rule

Filter rules support filtering by trap group and by trap. This section uses filtering by trap as an example.

To filter traps by trap group, first select traps and configure trap groups from the Trap Groups menu, and then select a configured trap group on the custom trap filter rule configuration page. Configure a trap filter by trap group in the same way a trap filter by trap is configured.

·     By Trap Group: If you select this option, this filter rule filters traps of the selected trap group.

·     By Trap: If you select this option, this filter rule filters the specified trap.

To add a custom filter rule by trap:

1.     Click Add above the filter rule list to access the Add Filter Rule page as shown in Figure 7.

Figure 7 Adding a custom filter rule

 

2.     Enter the filter rule name, a string of up to 32 characters. In this example, enter 192.168.0.1 Host Etcd Component Recovery.

3.     Select the traps to be filtered.

a.     Click the Select button below the filter type to access the Select Traps page.

b.     Enter matrix in the Enterprise Name field, and click the Search button to search for traps containing matrix in their enterprise names.

c.     Select the link down trap, as shown in Figure 8.

Figure 8 Selecting traps

 

d.     Click OK.

Figure 9 Selected the traps to be filtered successfully

 

4.     Select the resources to be filtered.

¡     All Resources: If you select this option, this filter rule filters traps of all resources.

¡     Selected Resources: If you select this option, this filter rule filters traps of the specified resources.

¡     Selected Resource Groups: If you select this option, this filter rule filters traps of the specified resource groups.

In this example, select the Selected Resources option.

a.     Select Selected Resources.

b.     Click the Select button. Then, select the device at IP address 192.168.0.1 in the window that opens, as shown in Figure 10.

c.     Click OK to save the selected resources.

The system will filter all link down traps from the device at IP address 192.168.0.1.

Figure 10 Selecting resources

 

5.     Set the time span type.

Time Span Type: Options include Days per Week and Time & Date Span. The trap filter rule will take effect within the specified time span. In this example, use the system default settings, as shown in Figure 11.

Figure 11 Selected resources successfully

 

6.     Click OK to complete adding the custom filter rule, as shown in Figure 12.

Figure 12 Added the custom filter rule successfully