ShoreTel PLatform Alarming with SNMP and HTTPS12-60301Issue 6March 2014Copyright 2013 Reilly Telecom Inc.Page 1

2009 Reilly Telecom Inc.All Rights Reserved.NoticeWhile reasonable efforts were made to ensure that the information in thisdocument was complete and accurate at the time of printing, Reilly Telecom Inc. canassume no liability for any errors. Changes and corrections to the informationin this document may be incorporated in future releases.Documentation disclaimerReilly Telecom Inc. is not responsible for any modifications, additions, or deletions tothe original published version of this documentation unless such modifications,additions, or deletions were performed by Reilly Telecom. Customer and/or End Useragree to indemnify and hold harmless Reilly Telecom, Reilly Telecom's agents, servants andemployees against all claims, lawsuits, demands and judgments arising out of,or in connection with, subsequent modifications, additions or deletions to thisdocumentation to the extent made by the Customer or End User.Link disclaimerReilly Telecom Inc. is not responsible for the contents or reliability of any linked Websites referenced elsewhere within this documentation, and Reilly Telecom does notnecessarily endorse the products, services, or information described or offeredwithin them. We cannot guarantee that these links will work all of the time andwe have no control over the availability of the linked pages.WarrantyReilly Telecom Inc. provides a limited warranty on this product. Refer to your salesagreement to establish the terms of the limited warranty. In addition, Reilly Telecom’sstandard warranty language, as well as information regarding support for thisproduct, while under warranty, is available through the following Web ept where expressly stated otherwise, the Product is protected by copyrightand other laws respecting proprietary rights. Unauthorized reproduction,transfer, and or use can be a criminal, as well as a civil, offense under theapplicable law.Reilly Telecom supportReilly Telecom provides a telephone number for you to use to report problems or to askquestions about your product. The support telephone numberis 1-800-394-2173 in the United States. For additional support telephonenumbers, see the Reilly Telecom Web site: 2013 Reilly Telecom Inc.Page 2

Table of ContentsIntroduction . 4Send alarms as SNMP Notification. 4Send alarms over secure HTTPS . 5Supported Platforms . 6Installation . 6System Configuration . 9Starting the service for the first time . 9Edit the Windows Registry . 9Run RegEdit32 . 10DefaultDestination . 10ProxyProductID . 11Verify Operation. 11Start SPLASH service . 11Open the SPLASH EventLog MM-d-YYYY.log. 1164-bit machine . 1132-bit machine . 11ShoreTel Alarms14.2 indicated new alarm in ShoreTel Core Release 14.2 . 12Appendix A: SNMP Notification Message . 34Appendix B: SNMP MIB File . 36Index. 50Copyright 2013 Reilly Telecom Inc.Page 3

IntroductionShoreTel SPLASH provides 24/7/365 proactive alarm monitoring and management services foradvanced and emerging ShoreTel architectures. Utilizing a proven delivery methodology basedon secure https while delivered within a managed framework.ShoreTel SPLASH provides a proactive, holistic approach to monitoring, managing andprotecting critical network infrastructures ensuring business continuity.SPLASH was developed by Reilly Telecom Inc., the makers of AlarmTraq ( can be used as a front-end product to pass ShoreWare alarms to AlarmTraq or can beused stand-alone to send ShoreWare traps to any SNMP manager or alarms can be sent oversecure https using a web service.SPLASH runs as a Windows service and monitors the event log of the Windows server runningShoreWare services. When a new log entry has been created, SPLASH sends the log entry as anSNMP version 2c trap or over secure https to the destination SNMP manager IP addressspecified in the Windows Registry (see installation).Send alarms as SNMP NotificationSPLASH can send alarms as an SNMP version 2c notification messages (traps) to thedestination SNMP Manager (AlarmTraq, Solarwinds, or HP OpenView).The Management Information Base (MIB) files specify all of the data, or "managed objects"that the alarms makes available. Each object has a unique object identifier (OID), whichconsists of numbers separated by decimal points, a human-readable label, and otherparameters. When an SNMP manager wants to know the value of an object, it queries thealarm using the appropriate OID. For more information see “Appendix B: SNMP MIB File” atthe end of this document.Figure 1 SNMP TrapCopyright 2013 Reilly Telecom Inc.Page 4

Send alarms over secure HTTPSSPLASH can send alarms over secure HTTPS. Hypertext Transfer Protocol Secure (HTTPS) is acombination of the Hypertext Transfer Protocol with the SSL/TLS protocol to provideencrypted communication and secure identification of a network web server.A Web Service is required to receive alarms using this method.Figure 2 Secure HTTPSCopyright 2013 Reilly Telecom Inc.Page 5

Supported PlatformsSPLASH on the following versions of Windows: Windows Server 2003 and 2003 R2 Windows Server 2008 and 2008 R2 Windows 7The SPASH installer bundles all of SPLASH’s prerequisites. There are no additional softwarerequirements.InstallationTo install SPLASH, simply download and run the installer, which is a standard Windowssetup.exe (msi package) and will run as a graphical wizard.The installer must be run with elevated privileges. Installing SPLASH does not require a systemreboot.1- Run the setup.exe file to beginInstallation, and then click Next.Copyright 2013 Reilly Telecom Inc.Page 6

2- Select the installation path. Thedefault path for a 64-bit machine isC:\Program Files (x86)\ShoreTelSplash\Splash\. The default pathfor a 32-bit machine is C:\ProgramFiles\ShoreTel Splash\Splash\3- Confirm the installation and clickNextCopyright 2013 Reilly Telecom Inc.Page 7

4- Wait for installation to complete.5- After the installation has beencompleted, click Close.Copyright 2013 Reilly Telecom Inc.Page 8

System ConfigurationBefore starting SPLASH, you will need to add some configuration options to the Windowsregistry in order for SPLASH to send SNMP traps to your alarm monitoring system such asAlarmTraq.Starting the service for the first timeOpen the Windows Services window by clicking Run Administrative Tools Services. Selectthe service named ShoreTel Splash and select ‘Start Service’ from the toolbar.Once the SPLASH service has started, select ‘Stop Service’ from the toolbar. This step isrequired to populate the Windows Registry with the following entries: DefaultDestination ProxyProductIDEdit the Windows RegistryThe Registry Editor (regedit.exe) is included with Windows to enable you to view and edit thecontents of the Registry. When you open the Registry Editor, you'll see a window divided intotwo panes. The left side shows a tree with folders (see Structure of the Registry above), andthe right side shows the contents (values) of the currently selected folder (key). To expand a certain branch, click on the little plus sign [ ] to the left of any folder, orjust double-click on the folder. To display the contents of a key (folder), just click the desired key, and look at the valueslisted on the right side. You can add a new key or value by selecting New from the Editmenu. You can rename any value and almost any key with the same method used torename files; right-click on an object and click rename, or click on it twice (slowly), orCopyright 2013 Reilly Telecom Inc.Page 9

just press F2 on the keyboard. Lastly, you can delete a key or value by clicking on it, andpressing Delete on the keyboard, or by right-clicking on it, and choosing Delete.HKEY LOCAL MACHINE - this branch contains information about all of the hardware andsoftware installed on your computer.Run RegEdit32To open the Registry Editor, click Run and type RegEditNavigate to the following section:64-bit machineHKEY LOCAL MACHINE\SOFTWARE\Wow6432Node\ ShoreTel Splash\Splash32-bit machineHKEY LOCAL MACHINE\SOFTWARE\ShoreTel Splash\SplashEdit the following Registry keys:DefaultDestinationEnter the IP Address of the SNMP manager where traps will be directed. If more than onedestination is desired, delimit the entries with a semicolon (;).Copyright 2013 Reilly Telecom Inc.Page 10

ProxyProductIDThis is an optional parameter that will send the assigned string to be used to identify theserver sending the trap. If sending the trap to AlarmTraq, the ProxyProductID must be a 10digit number starting with the digit ‘9’.Verify OperationOnce the registry entries have been populated you are ready to start the service and verifyoperation.Start SPLASH serviceOpen the Windows Services window by clicking Run Administrative Tools Services. Selectthe service named ShoreTel Splash and select ‘Start Service’ from the toolbar.Open the SPLASH EventLog MM-d-YYYY.logOpen the EventLog MM-d-YYYY.log file located in the Logs folder:64-bit machineC:\Program Files (x86)\ShoreTel Splash\Splash\Logs\EventLog MM-d-YYYY.log32-bit machineC:\Program Files\ShoreTel Splash\Splash\ Logs\EventLog MM-d-YYYY.logCopyright 2013 Reilly Telecom Inc.Page 11

ShoreTel SshoreWareCSISshoreWareCSIS14.2 indicated new alarm in ShoreTel Core Release RACTACTWARMINMINWARMINMINCopyright 2013 Reilly Telecom Inc.CommentsService started successfully.Service stopped.ShoreTel-CDR service stopping.ShoreWare CMCA startedShoreWare CMCA stoppedCSIS Web Services startingCSIS Web services failed to start. (Theembedded error code is a Microsoft errorcode.)Contact ShoreTel Customer Support and beprepared to provide the CSIS log for review.CSIS Web Services stoppingCSIS Web services experienced a non-fatalerror. (The embedded error code is a CSISor Microsoft error code.)Contact ShoreTel Customer Support and beprepared to provide the CSIS log for review.User authenticatedThe specified user is no longer authorizedfor CSIS server access. Causes include clientlogout, or an inactive connection as theresult of a client going offline withoutlogging out.CSIS Service started. Client access to CSISServices is enabled.CSIS Service stopped. Client access to CSISServices is disabled. (Web services continueto run.)CSIS Server StatisticsThe ShoreWare Director has stopped theRPC Server. 14.2The ShoreWare Director has started the RPCServer. 14.2Database is dropped on server at x.x.x.xPlease check the remote server to confirmthe operation is completed. 14.2Server at x.x.x.x switched to use databaseon Local. Please check remote server toconfirm the operation is completed. 14.2Local database is resync'd to HQ.Replication is stopped on all remote servers.Remote is too far 1809 seconds behind HQ .ShoreTel-DirectorUtil service starting.ShoreTel-DirectorUtil service stopping.Director preview: User x logged in to thepreview in read-only mode. 14.2Page 12

areDRS3108ACTMINThe Distributed Routing Service has startedsuccessfully.The Distributed Routing Service has beenstopped.Network connectivity may be lost to thespecified switch, or the switch may bedown.Fix network connectivity issues, and confirmthat the switch is pPhoneDispSvr2801ACTMINCopyright 2013 Reilly Telecom Inc.DRS re-established communications withthe specified switch.DRS re-established communications withthe specified switch.Distributed Telephony Application ServicestartingDistributed Telephony Application ServicestoppingShoreWare Distributed TelephonyApplication Service connected toShoreWare Telephony Management Server.ShoreWare Distributed TelephonyApplication Service disconnected fromShoreWare Telephony Management Server.This may be a result of an administrativeaction network outage or unexpectedbehavior.ShoreWare Distributed TelephonyApplication Service disconnected fromShoreWare Telephony Service Providerrunning. This may be a result of anadministrative action network error orunexpected behavior.ShoreWare Distributed TelephonyApplication Service encountered a RPCexception. The exception code is "1753 0x000006D9: There are no more endpointsavailable from the endpoint mapper.RtrClnt: 0x006E0F38 server: localhost".The ShoreWare Event Watch service hasstarted.The ShoreWare Event Watch service hasstopped.ShoreWare IM Server StartedShoreWare IM Server StartedShoreWare IM Server StoppedShoreWare IPCS Server Started.ShoreWare IPCS Server Stopped.The IP-Phone Device has been updated tobe managed by Switch: x 14.2The ShoreTel IP Phone Display Service hasstarted successfully.The ShoreTel IP Phone Display Service hasPage 13

been stopped.Complete database refresh failed 14.2Log file C:\Shoreline Data\\Logs\xprt.Logdeleted due to rollover. 14.2Error : for more information see Help andSupport Center at Normal shutdownFor more information see Help and SupportCenter at Normal shutdownFor more information see Help and SupportCenter at service was started.The service was stopped.ShoreTel-Portmap service map service stopping. Switch100ACTMAJService stts is not readyAll services are readyServices Manager received commandrebootServices Manager received command tochange root password from sttsServices Manager detected a new coredumpSpace used for core dumps has beenexceeded.Compact Flash errors could not becorrected 14.2ShoreWare Database Management Servicehas startedYou are in violation of your licenseagreement for the ShoreTel product. Yoursystem license is invalid. You may purchaseadditional licenses through your ShoreTelreseller. 14.2You are in violation of your licenseagreement for the ShoreTel product.ShoreTel has not received your contactinformation. 14.2The ShoreTel Voice Switch is receiving toomany events from the NT Server. Possiblycaused by an application problem on theShoreTel CTMAJCopyright 2013 Reilly Telecom Inc.Check the ShoreTel server for events thatmight indicate an application problem.Troubleshoot the problem and rebFlash memory area is corrupt. If problempersists, return for repair.Application is unable to erase area of Flashmemory.Page 14

If problem persists, return for CTMAJshoreWareSwitch106ACTMAJApplication is unable to write area of flashmemory.If problem persists, return for repair.A software exception occurred.Contact ShoreTel Customer Support and beprepared to provide the log files for furtheranalysis.A task exception occurred. The ShoreTelVoice Switch experienced an internal errorand is 08ACTMAJContact ShoreTel Customer Support and beprepared to provide the ipbx and tmsncc logfiles for further analysis.A restart request has been received system is being shutdown and restarted.No longer reported in NT event log.MAJThis event code reports internal softwaredebug statements for use by ShoreTeldevelopers.The switch cannot seize a trunk.shoreWareSwitch109ACTVerify that the trunk line is connected to theShoreTel Voice Switch. Check wiringbetween ShoreTel Voice Switch and thetelephone company ARConnect a phone or telephone test set tothe line, then go offhook and lTrunk port has been taken out of service bythe administrator.The trunk line is again functional and is backin service.Trunk port has been put back in service bythe administrator.Specified extension port removed fromservice.Put the port back in service when thesystem administrator indicates that it isappropriate.Specified extension port is back in service.The switch was reset and subsequentlyrestarted.The event also provides current versioninformation for the switch.Copyright 2013 Reilly Telecom Inc.Page 15

eSwitch140ACTMAJshoreWareSwitch143ACTMINThe switch is unable to communicate withthe other ShoreTel Voice Switch specified inthe event. The switches are not able toplace calls to each other.The specified switch may be off ordisconnected from the network. Check theswitch in question to conThe switches established a connection andare communicating with each other.The switch is losing an excessive number ofpackets.Verify that your network configurationmeets ShoreTel requirements.The call cannot be forwarded to thespecified extension.Confirm that the specified extension's callhandling mode configuration is valid. Thiserror can appear when the destinationextension is connected to a ShoreTel VoiceSwitch that is either offlineAn incoming fax transmission call was notredirected to the fax extension.Confirm that the extension is properlyconfigured for fax redirection. Confirm thatthe fax extension is operating properly.The ShoreTel Voice Switch was unable toconfigure the specified extension on thedesired port.Reboot the switch. If this error persists,contact ShoreTel Customer Support.The specified extension dialed a restrictednumber.Inform user about dial-out restrictions.Memory block corruption detected.Reboot the switch. If the event persists,replace the switch.The flash memory in the ShoreTel VoiceSwitch is bad.Replace the switch.The specified port did not receive properecho cancellation properties. The trunk orphone connected to the port may exhibitpoor sound quality or echo.Use ShoreTel Director to reset the port. Ifthe error was reported on aphone port, lift the phone’sCopyright 2013 Reilly Telecom Inc.Page 16

eWareSwitch148ACTMINshoreWareSwitch149ACTMINThe specified trunk connected to the portfor two or more hours.Confirm that an active call is in progress. Ifno call is present, reset the port fromShoreTel Director.The echo suppression software was unableto adapt to a call in progress.No action for an isolated occurrence. If theerror persists, follow the course of actionsuggested for Event 143.The echo suppression software is properlyconfigured.The echo suppression software is properlyconfigured.The echo suppression software detected alow echo-return loss on the specified port.This error can occur when modem or faxcalls connect to a port. Event is infrequentand random.No action for an isolated occurrence. If theerror persists, follow the cThe echo suppression software detected alow echo-return loss on the specified port.shoreWareSwitch151ACTWARNo action for an isolated occurrence. If theerror persists, follow the course of actionsuggested for Event 143.Reboot due to configuration change.shoreWareSwitch152ACTMINThe DSP on this switch is nearing capacity.shoreWareSwitch153ACTMAJThe DSP on this switch reached maximumcapacity. In most instances, this event doesnot affect operations.shoreWareSwitchshoreWareSwitchCopyright 2013 Reilly Telecom Inc.157158ACTACTMAJMINNo action for an isolated occurrence. If theerror persists, reboot theswitch.The DHCP server responded negatively to aDHCP lease renewal request. The IP addresspreviously assigned to the switch is nolonger available for that device. The DHCPserver assigns the switch a new IP address.In ShoreTel Director, display the SwitchesThe DHCP lease for the switch expired andthe switch is currently obtaining a new IPaddress. While the switch is obtaininganother IP address, it is unable tocommunicate with the ShoreTel server.Page 17

In ShoreTel Director, display the Switchespage and chshoreWareSwitch165166167ACTACTACTMINMAJMINThe IP address currently stored in theswitch’s flash memory is not the same asthe address that DHCP is trying to assign toit. The switch automatically reboots andobtains a new address.In ShoreTel Director, display the Switchespage and open the switThe ShoreTel Voice Switch experienced afatal internal software error.Contact ShoreTel Customer Support forupdated information about fatal errors.The ShoreTel Voice Switch stoppedcommunicating with the TMS Server. Thiserror can result from a CPU overload on theShoreTel server.Check the ShoreTel server for applicationsthat are placing inordinate demands on theprocessor. Correct any applicatioA device with the same IP address as theswitch appeared on the network.Remove the offending device from thenetwork, or ask the network administratorto assign the switch an alternate IP address.The switch is connected to the Ethernetnetwork.Switch NGTNCT00 T1K: Autonegotiationdone: using port 1: 100Mb Full DuplexThe switch is no longer connected to theEthernet network.Confirm that network cables and ports areconnected properly and are in workingorder.The twisted pairing wiring for an ethernetcable is reversed.Although the switch continues to function,replace the suspect cable.The fan in the ShoreTel Voice Switch failed.Replace the ShoreTel Voice Switch.The fan in the ShoreTel Voice Switch isrunning slow. If the condition persists, theswitch may overheat.If this event is accompanied by Event 168,no action is required. If the error persists,Copyright 2013 Reilly Telecom Inc.Page 18

replace the switch.shoreWareSwitch168ACTWARThe fan in the switch is running 9ACTWARshoreWareSwitch170ACTMINThe internal operating temperature of theswitch is within normal operatingparameters.Operating temperature: normal.Operatingtemperature: normalThe internal operating temperature of theswitch is above the acceptable k if the event is accompanied by Event166. If so, replace the switch. If the fan isworking properly, check the environment inwhich the switch is operating to confirm tThe internal operating temperature of theswitch exceeded the acceptable operatingrange. The switch may soon fail.Check if the event is accompanied by Event166. If so, replace the switch. If the fan isworking properly, check the physicallocation ofThe ShoreTel Voice Switch was unable towrite to the flash memory.MAJReboot the switch. If the error persists,contact ShoreTel Customer Support.The 48-Volt DC power supply failed.MAJReplace the switch.The 70-Volt DC power supply CTMAJReplace the switch.The power supply that reported a failure isonce again operating correctly.The firmware upgrade for the switch failed.WARWARMAJCheck the switch event logs for subsequentappearances of Events 177 and 178. Thepresence of these events means that theswitchautomatically recovered and you can ignorethe alert of upgrade failure.If EventA firmware upgrade started.The firmware upgrade was successful.Board tch177178179ACTACTACTReturn for repair.Copyright 2013 Reilly Telecom Inc.Page 19

shoreWareSwitch180ACTMAJBoard failure.shoreWareSwitch181ACTMAJReturn for repair.Board failure.shoreWareSwitch182ACTMAJReturn for repair.Board failure.MAJReturn for repair.Board MAJReturn for repair.Board failure.shoreWareSwitch185ACTMAJReturn for repair.Board failure.MAJReturn for repair.Board MAJReturn for repair.Board failure.shoreWareSwitch188ACTMINReturn for repair.Temperature in room too cool.MAJFix the environment.Temperature in room too JFix the environment.The trunk on the specified port wascontinuously active for the number ofminutes specified. This message isgenerated after every two hours ofcontinuous trunk activity.Check the trunk and verify that an activecall is in progress. If no call is preseAnother ShoreTel Server attempted to takecontrol of the switch.Only one ShoreTel server can control aswitch; multiple servers cannot manage aswitch simultaneously. Decide whichShoreTel server you want to manage theswitch, then delete the switch frThe IP address configured for the switch inDirector is not the IP address the switch isusing.From Director, change the switch’s IPaddress to match the address the switchuses.Copyright 2013 Reilly Telecom Inc.Page 20

Reports the switch’s memoryusage.Switch statsAn attempted call exceeded the li

SNMP version 2c trap or over secure https to the destination SNMP manager IP address specified in the Windows Registry (see installation). Send alarms as SNMP Notification SPLASH can send alarms as an SNMP version 2c notification messages (traps) to the destination SNMP