Curiosity: Trap alerts from unknown devices with wrong hostname

Something peculiar I've noticed with NPM when Solarwinds forwards a trap alert email for a device it is not managing/doesn't know about. The weird thing is that it will populate the node.caption field in the email with a hostname for a different device, which it is managing. It is always the same hostname. I was just wondering if anybody knew why it picks a specific hostname to populate the node.caption field.

I am sure someone will ask why I am using the node.caption rather than the hostname field. It is because the hostname field is too often populated with the host IP address for some reason, whereas the nodes.caption tends to be correct most of the time.

Find more posts tagged with

Accepted answers

All comments

mdriskell

The hostname for a device will be the address that is resolved when a reverse lookup is performed on the IP address it is received from. So if the trap is from a Cisco router for instance unless it is specifically configured to send from one address it will use the closest to the destination. A good practice is to hard set the SNMP trap source on your devices to keep the traps consistent.

In my environment for example all my routers are added by their loopback addresses so in their SNMP trap configuration I have the trap source set to Loopback.

mdriskell

Also to clarify the traps do not import any information from the nodes table in the database other than the NodeID. So even if a trap is received properly and you have the caption set as one thing it will use whatever it gets back from the reverse lookup.

RomeoG

Hi Mike. Thanks for the response, but there has to be more to it than that.

Based on what we see in our implementation, I can assure you that SolarWinds, is in fact, NOT getting that hostname from reverse DNS. In some of these cases, the devices have no DNS host entries and do not resolve at all. Others are properly mapped in DNS. Source-interfaces are properly configured as well.

If the device has not been added into SolarWinds management, and SolarWinds receives a trap that matches a configured trap-alert condition, SolarWinds will plug in a hostname into the trap-alert, and it is always the same hostname [of a device that DOES happen to be managed by SolarWinds] regardless of the IP, location, etc... of the node.

Thanks,

Romeo

PS: I should clarify that I am using the nodes.caption variable rather than the hostname variable (as mentioned in the original post).

superfly

Sounds like it could be a bug so you should log a case for this. Does everything appear fine once the devices is added into NPM?

I too use the node.caption variable (I think it's the Orion default?) and mine all work ok but I've not received alerts for devices that are not in NPM (all my devices are in NPM).

I think DNS is only used for syslog alerting but not for the Advanced Alerting.