Trap Alerting in Orion

I know this has been covered before, but has anyone come up with creative solutions to handle trap management? I'm really trying to figure out a way to toss our existing SNMPc implementation into the trash, which handles traps fairly well, and replace it with Orion.

I think I have a cobbled solution. Any feedback appreciated?

Trap received with Trap Manager. Filter, and use VB script to somehow parse the content, and insert an entry in the Node database (Custom Property field for the associated Node)

Create an Advanced Alert monitoring the existance of a field (ie. Error_Message field (NOT_NULL)). If exist, Alert...and display error message in alert.

When trap comes in clearing the alert, the script pulls the message out of the database, and the advanced alert clears.

I'm not a VB person, so this will take some work, but has anyone else come up with something similar?

Find more posts tagged with

advanced_alerts

traps

event_log

orion

npm

vbscript_advanced_alerting_trap

Accepted answers

All comments

FormerMember

Euphorik,

Can you give us a little more detail on your goal? You want Orion to receive the trap and create an Advanced Alert? Why create an Advanced Alert instead of triggering something from the Trap Alert engine? I'm not saying you shouldn't, but it would be easier to comment if we all had some insight into the problem.

Cheers,

Denny

euphorik

Would love to simply use an Advanced Alert, but I'm not sure how to go about it.

For example...we have a telco switch that has limited SNMP pollable instances. However, when major events occur, this device will send traps to alert us of issues (DS3's going down, etc). From what I can tell, the Alert engine can only make decisions on "pollable" instances.

Unless I'm interpreting the capabilities of the Advanced Alerting Engine wrong, I don't simply want to generate an e-mail based on an incoming trap, but I would like a corresponding Alert on the main Orion page to show up, until the situation has cleared. (ie. Alert when DS3 goes down, clears when it comes up). But this DS3 status is NOT pollable directly....

That clear things up a bit?

Josh_Stephens

Euphoric,
No need to use the Advanced Alert Engine or to worry about polled values. The SNMP Trap Receiver within Orion includes its own alert engine - it's disguised under a menu option called "Rules" We've gone back and forth about changing this terminology, and I think this is good point in favor of changing it

Anyhow, the SNMP Trap Receiver will allow you to do exactly what you're describing through its rule engine. Take a look, and let me know if you need more specific instructions but I think that after you walk through it it'll make sense.

Have a good weekend,

Josh Stephens
SolarWinds

Magman

For those alert to work, does the Trap viewer must be running?

euphorik

Thanks Josh.

I was aware of the built in alerting engine within the trap viewer itself, which I'm currently using to identify inbound traps, and generate ALERT and CLEAR e-mails..however since it doesn't exactly tie in with NPM, I was hoping to use the website as a dashboard to view the active trap alerts.

ie. When I get a DS3 down, this will show up in Active Alerts on the NPM homepage, and when I get the clear trap, it will be removed from the Active Alerts. This way I essentially have a dashboard view of where my issues are without relying on trying to generate e-mail alerts (or otherwise). The trap alerting engine itself doesn't appear to have a specific "alert --> clear" mechanism, but rather simply is built to process inbound traps.

This is why I was thinking of the script to set a database variable, then use the Advanced Alerting engine to trigger an Alert based on the presence of that variable. With a clear triggered when the variable is cleared...then hopefully getting that particular variable to appear in the "Current Value" portion of the actual Alert when it's triggered.

Hopefully this description clears things up. Unless I'm still missing something :-p

planglois

Wow! this topic was created in 2007. 6 years later, despite all request from users, this feature is still not embedded in NPM. I can say that I am disapointed, as SNMP traps are part of the foundation of monitoring... We desperately need that feature. This will be a deal breaker at next maintenance support renewal.

bps

I agree, this will be a discussion next mainteneance support renewal! I can not go on like this. The topic SNMP-MIB (self-compiling) and alert management out of a Trap or Syslog is simply BAD.....

jpuckett

I think you are confused. They don't care.

I've asked Sales Managers, Account Executives, Regional Sales Managers, Senior Account Executives, and technical support personnel.

They either shrug their shoulders at the question. Or send me on some wild, half considered goose chase.

Most recently to this inquiry by our Account Executive:

James,
Good afternoon. I am the Senior Account Executive for your region. In review of projects we have on record I see your SolarWinds project has come to a stop for one reason or another - as the Senior Account Executive, it is my responsibility to find out what happened, as we do not see this trend often.
Was there a particular reason why it’s fallen off your radar? If it’s missing technical points, I am more technical and would love to help out. If this project was dropped specifically due to price, I was given restricted discount incentives specifically dedicated to projects such as yours which will allow me to significantly impact your cost if you are in a position to move forward this month.
Please let me know what’s needed at this time to get the needle pointed in the right direction. I certainly do not mean to keep bothering you with constant emails and calls, so please let me know if this is a conversation you would like to pursue or if we should close out the record all together.

I wrote:

As I have told multiple people at Solarwinds, see the included emails, ECG (and many other Solarwinds users) needs to be able to provide visual, trackable, acknowledgeable alerts from incoming traps to NPM.
At this point, any further purchases of Solarwinds license additions and/or purchases of other modules is on hold until we can find a way to address this issue.
I'd be glad to discuss it further with you, product management, or support. If you'd like to line something up, please let me know what time works best for you and I'll put something on my calendar.
Thanks.

He didn't respond.

To a different inquiry to Solarwinds during the same week, I received:

James, this was my engineer’s response.
This cannot currently be done through Orion. This may be a good fit for Alert Central – best of all, it’s free… don’t know why… but it is.
http://www.solarwinds.com/alertcentral.aspx

Which of course doesn't do ANY of the things that I inquired about in my email.

They just don't care.

bps

this is grate, I had all ready 4 ticket's opened to this issue, mostly the support-eng do not understand what exactly the problem is!

I keep get the answer: yes it is possible to generate a alert from a trap or syslog! I would be very happy do discuss this with someone that can address that PROBLEM to de development!

- compile vendor SNMP

- trap/syslog event's generate active alert in alert center!

this is very important, and if this will not be a feature soon i will have problems to purchases the next licenses as well!

thanks for you post

Pascal

herwig

I created an idea/feature request for this topic and hope it covers most of the needs also covered in this post?

A lot of people seem to want this and also most competitive products support propper Trap handling:

http://thwack.solarwinds.com/ideas/3580

Please vote!

nick_scott

Has anyone documented a solution for traps being converted into advanced alerts ? This is something that is still needed.

tkercher

Not that I know of, I require the same thing. There are some workarounds that you can find within Thwack, but you'll need strong SQL skills which I don't have

sja

well +3 years and where is that feature?

/sja