Can’t set correlation for received SNMP Traps

zyl

Hello,

I have problems with setting up Rules for SNMP Traps received from SolarWinds.

SNMP Trap connector is set:

Filters for traps were created:

and I can see received SNMP Trap messages:

Rules section:

For any other InternalNewToolData I can create rule and get incident:

No luck with Traps received from SolarWinds (even if Trap is in different format, so SystemStatus -> InternalNewToolData)

Any tips?

LEM version 6.1.0

Best regards,

Matt

Find more posts tagged with

correlation_rules

lem_6.1

lem_rule_building

lem_rule

correlation

lem

snmp traps

Accepted answers

FormerMember

Check out the timestamps - it looks like either the time/timezone on your LEM appliance isn't set or it differs from your Orion system sending the trap. Due to that huge delta, the rules won't fire because they think that data is too far outside of the normal activity window.

This KB might help (it applies to incidents as well as email, any action really): SolarWinds Knowledge Base :: Troubleshooting LEM Rules and Email Responses

All comments

FormerMember

This KB might help (it applies to incidents as well as email, any action really): SolarWinds Knowledge Base :: Troubleshooting LEM Rules and Email Responses

zyl

Hello,

NTP fixed.

Without success.

I have tried with SNMP Traps from my PC:

DetectionTime is still different.

Should I do another tests?

btw. how LEM is parsing SNMP messages?

Best regards,

Matt

FormerMember

If you have any other events in your "LEM Internal Events" filter, what do their timestamps show? (How does it compare to the SNMP traps?)

The date is parsed from the log on the appliance (you can see it there - 20150528.163102), so (at least ) two things are possible -

1. appliance time was wrong (first guess)

2. maybe the connector isn't properly parsing things (also possible)

zyl

Timestamps in "LEM Internal Events" are fine. There is small difference, less than 5 minutes in InsertionTime and DetectionTime.

LEM can successfully fire alert on those evens.

Problem is with SNMP Traps.

I'm filtering by:

SystemStatus.ToolAlias = SNMPTrapAlias

This is the Filter for all SNMP Traps messages (assigned to SNMP connector):