Alert Manager - SNMP sending trap from but device is in the database

I have setup an alert to inform if the tx/recv util of a servers interface passes 50%.

I setup a NetPerfMon Event Log Trigger Action and that works.

I setup a "Send SNMP Trap" Trigger Action and that doesnt.

If I run a tail on my SNMP server I can see the trap coming in from the Orion server:

snmptrapd[2884]: 2010-05-05 09:29:44 <UNKNOWN> [UDP: [Orion-Server]:4221]:

However, it is saying <unknown>. The node that is in the Trigger Condition is in the NPM database and is being monitored.

Any ideas?

Find more posts tagged with

Accepted answers

All comments

Questionario

which version of NPM are you using?

willj

v9.5 sp3

willj

bump - anyone?

qle

I'm just spitballing here so forgive me if these questions are too obvious. I assume <UNKNOWN> is actually supposed to be the hostname or IP address of the server with high traffic utilization? Is it possible that the Orion server is trying to lookup the hostname and when it fails, forwards the trap with the <UNKNOWN> hostname?

willj

Thats the first thing I thought it was - but the Orion server can happily resolve the name of the <unknown> device.

qle

Can your SNMP trap server resolve the IP address to a hostname?

neilmborilla

Try adding it to Orion server hosts file found in C:\windows\system32\drivers\etc

Sample:

192.168.10.10 Servername

willj

The Orion server and the snmp-polling server both use the same DNS server. Both can successfully ping the host that appears as <unknown>.

Still no idea why Im getting <unknown> though