TRAPMON.EXE: SNMP Trap Monitor

SNMP Trap Monitor allows you to check the reliability and throughput of your SNMP trap delivery system. SNMP Trap Monitor tests the delivery of SNMP traps from a trap generator to a trap receiver by comparing the number of traps sent and received.

The SNMP protocol does not support acknowledgment of sent traps, but SNMP Trap Monitor stores received traps in a database, providing a way to keep track of sent traps. Therefore, SNMP Trap Monitor must be run on at least two computers, so that the traps sent by an SNMP agent can be received, stored, and compared at all computers running SNMP Trap Monitor. All sites running SNMP Trap Monitor can see all the received traps at any other site.

To reduce network traffic, place one of the SNMP Trap Monitors at the site where the SNMP agent is sending traps; this will reduce network traffic, because traps are internally looped back. The second SNMP Trap Monitor can be placed at another site to test network reliability.

Runs On

Alpha, x86

Files Required for TRAPMON

TRAPMON.EXE
TRAPMON.INI
MGMTAPI.DLL

The following software is also required:

Microsoft ODBC (Open Database Connectivity) Driver 2.0 or higher
Microsoft SQL Server 6.0 or higher
TCP/IP and SNMP protocols
Windows NT SNMP service

Setting Up SNMP Trap Monitor

The following procedures include two instances of SNMP Trap Monitor and one of SNMP agent. Before starting either procedure, complete the following steps:

Install TCP/IP and SNMP protocols on all computers that will run SNMP Trap Monitor. Because SNMP Trap Monitor uses the PUBLIC community, be sure the SNMP protocol's security is set up to receive traps from the PUBLIC community, which is the default.

Install TCP/IP and SNMP protocols on the monitored computer that will be transmitting traps. Set up the SNMP protocol on this computer to send traps to all computers running SNMP Trap Monitor using the PUBLIC community.

Install ODBC on all computers that will run SNMP Trap Monitor. ODBC must point to the computer running SQL Server, in which SNMP Trap Monitor will create its trap database. The name of the database that will be created is specified in the initialization file.

Create or modify an initialization file.

To Set Up SNMP Trap Monitor on a Local and a Remote Site

In this procedure, one SNMP Trap Monitor runs on the monitored node, which is the local computer running the SNMP agent, while the second SNMP Trap Monitor runs on a remote computer.

Setup the SNMP agent in Control Panel on the local site to send traps to itself and the remote SNMP management console.

Run the following command on both the local and remote computers:

trapmon.exe TRAPMON.INI

Transmit traps to the local and remote computers.

To Set Up SNMP Trap Monitor on Two Remote Sites

In this procedure, neither instance of SNMP Trap Monitor runs on the monitored node, which is the local computer running the SNMP agent.

Setup the SNMP agent in Control Panel at the monitored node to send traps to both remote SNMP management consoles.

Run the following command on both remote computers:

trapmon.exe TRAPMON.INI

Transmit traps to both remote computers.

The SNMP Trap Monitor GUI

Shortly after running the TRAPMON.EXE command, the SNMP Trap Monitor GUI appears. This window includes the following items:

The white area at the top is the list of traps in the database, if any. Each record in this list is composed of the following fields, left to right:
- IDENTICAL or MISMATCH. When two or more SNMP Trap Monitors are running, this field shows whether the traps received by all computers are identical—which they should be—or whether there is a mismatch.
- EventInfo. The event source and event ID.
- Agent. The IP address of the computer that sent the trap.
- Names of all computers running SNMP Trap Monitor, followed by the number of traps they have received. When an additional computer runs SNMP Trap Monitor and receives a trap, another column with that computer's name and number of traps received is appended to that trap's record.

No new data is shown until you click Refresh.

Monitored Node. This box shows the computer being monitored, which was specified in the initialization file.
Traps Updated. Shows how many traps have been received at the computer running SNMP Trap Monitor, regardless of the trap type.
Trap Types. Shows how many different types of traps have been received at the computer running the SNMP Trap Monitor.
Action on new traps. If Write is selected, traps sent from the monitored node are written to the database and the Traps Updated counter is incremented. If the trap received is a new type of trap that does not exist in the database, the Trap Types counter is incremented. If Discard is selected, traps sent from the monitored node are not written to the database. Neither the Traps Updated nor the Trap Types counters change.
New Traps Queued. This counter is incremented each time a new trap arrives at the computer running SNMP Trap Monitor.
Reset. Clears the database of all traps and sets the New Traps Queued, Traps Updated and Trap Types counters to 0.
Refresh. Updates the list to include any new data since the last refresh.
Quit. Quits SNMP Trap Monitor.

Usage Strategies

This section outlines some ways to use SNMP Trap Monitor.

Connectivity Testing

Connectivity can be tested by low quantity, timed, controlled event logging. You can confirm the receipt of traps sent from an SNMP agent to an SNMP management console. Problems can be caused by network topology or network configuration.

Data Saturation Testing

A network storm can be simulated by large quantity, untimed, uncontrolled event logging. You can determine if there are any network or SNMP bottlenecks.

Frequency, Threshold, and Throughput Testing

You can generate a certain number of events per second to determine at what frequency traps fail to be received at an SNMP management console. This determines the maximum number of traps that can be reliably sent for a given agent-manager connection.

Connection Saturation Testing for Frequency and Delay

You can generate a number of events per second used in the previous test, then wait. This determines if the receiver at the SNMP management console is able to handle traps received at a constant rate.

Testing Whether a Trap is Lost or Stalled

When sending many traps at once, sometimes not all of them are received; they are either lost or stalled. Wait a few seconds, then send one more trap. If the missing traps were stalled, they will show up with the latest trap.

For example, you send 100 traps at once, but only 98 are received. You then send one more trap and three are received; the missing two traps were merely stalled, not lost.

Troubleshooting

This section offers various suggestions for solving problems.

Try restarting the Windows NT SNMP services on all management and agent consoles.
Make sure that communities and hosts are set up correctly in the control panels.
Make sure that the security feature in Control Panel is set up correctly.
Make sure that the SNMP agent is set up correctly. End-to-end and applications check boxes must be checked in Control Panel on the computer running the SNMP agent.
Make sure the contents of the initialization file are correct.
Make sure the appropriate radio button (Write or Discard) is selected in SNMP Trap Monitor.
If you send one trap but received two, make sure you do not have two SNMP communities with the same host name; check Control Panel.
If you do not receive traps, try making an IPC$ connection to the data source.
Any changes made to the Windows NT SNMP service in Control Panel will not take effect until after the SNMP service is restarted.
When using the Event to Trap Translator, if Windows NT events are logged but no traps are sent, make sure the event log is not full. If it is full, clear the event log or set it to overwrite old events.
Make sure the database named in the initialization files at all computers running SNMP Trap Monitor is the same.

Other Tools to use with SNMP Trap Monitor

Network Monitor

Network Monitor can determine where traps are being dropped in a network, as well as trace problems with network configuration and network devices.

Windebug

Windebug can debug the SNMP extension agents and SNMP management console applications.

SMGENIE

SMGENIE generates events, which the SNMP Event to Trap Translator can convert to traps, which will be forwarded to the SNMP Trap Monitor.

SNMP Event to Trap Translator

The SNMP Event to Trap Translator (see the SMS Administrator's Guide) converts Windows NT system and application events (events written to the Windows NT event log) into SNMP traps.

TRAPMON Syntax

trapmon [init_file]

init_file

A TRAPMON initialization file. The default is TRAPMON.INI in the current directory.

TRAPMON Initialization File

Node_ID RES RES RES ODBC_data_source ODBC_table ODBC_user_ID [ODBC_password]

The TRAPMON initialization file (default name TRAPMON.INI) has one record of the preceding form. The fields in this record have the following meanings:

Node_ID

A computer name without backslashes (for example, node5), or a dotted IP address (for example, 172.918.3.14)

RES

These are reserved for future use. Specify the value 1.

ODBC_data_source

The name of an ODBC (Open Database Connectivity) data source to which you can direct logged data.

ODBC_table

The name of a table within ODBC_data_source to which you can direct logged data. If this table does not exist, TRAPMON creates it.

ODBC_user_ID

The user ID used for connecting to ODBC_data_source.

ODBC_password

The password used for connecting to ODBC_data_source.

Notes on SNMP Trap Monitor's Behavior

Because SNMP traps are transmitted using the User Datagram Protocol (UDP), there are limitations on them that affect the operation of SNMP Trap Monitor:

SNMP traps are not guaranteed to be delivered, and there is no notification if they are not.
Most network stack implementations and routers limit the size of UDP packets. If the packet is too large, the router drops it and records it as a discarded packet. Because many of the SNMP traps generated from Windows NT events are larger that the usual limits on UDP packets, many of these traps will not be delivered to SNMP consoles over a routed network.

SNMP Trap Monitor provides what the SNMP protocol lacks: an artificial means of acknowledging traps sent using the UDP.

SNMP Trap Monitor also provides a means of determining the reliability of SNMP trap transmission, taking into account the following:

Transmission frequency
Quantity of traps transmitted and received
Reliability during network storms
Transmission thresholds
Network topology
Network configuration
Uses of other tools in conjunction with SNMP Trap Monitor