How to properly configure snmp trap mac-notification on cisco 2960?

Question

Cisco

I'm digging with the reception of ladders from the Cisco 2960. The information comes from about 50 devices. I set up the switches and the server, the traps come, are caught, parsed and entered into the database. But then I started to notice that some traps were not being processed. The mac address-table notification change table itself also has several states in one entry. How can this be fixed, or at least what is causing it?

Answer 1

Yes, I saw it) I do not fully understand why several records can be in one ladder.
For example, a piece of an entry from sh mac address-table notification change:
MAC Changed Message :
Operation: Added Vlan: 67 MAC Addr: xxxx.xxxx.xxxx Dot1dBasePort: 42
History Index 4, Entry Timestamp 277485053, Despatch Timestamp 277485053
MAC Changed Message :
Operation: Deleted Vlan: 67 MAC Addr: xxxx.xxxx.xxxx Dot1dBasePort: 42
Operation: Added Vlan: 67 MAC Addr: xxxx.xxxx.xxxx Dot1dBasePort: 42
History Index 5, Entry Timestamp 277599119, Despatch Timestamp 277599119 Receives
:
UDP: [ xxx.xxx.xxx.xxx]:62108->[xxx.xxx.xxx.xxx]:162
.1.3.6.1.2.1.1.3.0 67:22:03:11.54
01 00 XX XX XX XX XX XX A4 .1.3.6.1.6.3.1.1.4.1.0 .1.3.6.1.4.1.9.9.215.2.0.1 00 01 02 00 XX XX XX
XX XX XX A4 00 01 00 "
.1.3.6.1.4.1.9.9.215.1.1.8.1.3.59
586819153
1.3.6.1.6.3.18.1.4.0 "xxx"
.1.3.6.1.6.3.1.1.4.3.0 .1.3.6.1.4.1.9.9.215.2
The parser does not process such events because it is designed for the mac notification to be in one line. And when processing such a message, of course, a failure occurs.
Therefore, the question arises - is it possible to do something on the device side?
UPD: Solution found) For those who are interested, I wrote an article on this topic on Habré

Answer 2

The point turned out to be that in one trap, the device itself can transmit several mac-notification states in the cmnHistMacChangedMsg object.

If I understand correctly, this is how it should be. Quoting Cisco SNMP object navigator :

This object contains the information of a MAC change notification event. It consists of several tuples packed together in the format of '...'.

several tuples

several

I think the problem is in the parsing (parsing) of the message.