SNMP Traps & filtering for alerting

danielgilbey

Hello Thwackers...

I'm looking to get some solid SNMP trap alerting in place & I see that from the Traps page on the web ui I can filter this by device type (see below) but what I'd really like is the ability to have this filter for the trap alerting... Ideally, I want a blanket alert set up to trigger when traps are received from ESX Servers

What about IP ranges I hear you say, yes, I'm aware I can filter by this method, but again, ideally, I'd like a 'set & forget' method (similar to the alerting in the advanced alert manager where I can state a device type) so that when new ESX devices are added, these are automatically picked up... additionally, I could configure these devices with a unique community string designating ESXcommunitystring or similar, but why, if there is a filter available?

Hostname pattern matching is potentially an option, however, some (it seems) of our devices only pull through IP addresses, no doubt this is a minor failing on our part, but even so, there is a device filter in there somewhere...

Did I mention the device filter yet ?

So, I suppose my question is, has anyone been able to get something similar in place, using a 'catch all' method for a specific device type & if you have, would you be kind enough to share the secrets here? I'll be honest, I've not trawled through the MIB tree just yet, if there is a specific MIB I should be looking for, please clue me in.

It would be amazing if, in some not too distant future release, that the SNMP trap alerting aspect was more in-line with the SAM module...

Thanks all, if this has been covered in an earlier thread, apologies, I have looked (promise) but couldn't see anything that covered this in particular...

supercool

Not sure if this is exactly what you are looking for, but this is how we are doing trap alerting using SW in our environment...

I agree it would be great to see a better trap management interface in the web console.  We have been able to set up some specific trap alerting by using the Trap Viewer tool on the server.  While we are sending all of our traps to SolarWinds, we are only wanting alerts on very specific traps.  To do this we are matching in different ways.  Use of a specific MIB has been pretty successful assuming you know what it is that are looking for.  A lot of what we have set up is due to experience with a certain event taking place that generates the trap and then creating an alert on that trap by using Trap Viewer.  We have also matched on IPs, but this can be cumbersome and not so dynamic if you have a lot of IPs or a changing environment.  Another way we match is on our hostnames.  We have a pretty solid naming convention that makes it easy to match on certain portions of the hostname that identify it as a specific type of device.

Below is an example matching on the MIB and then doing some excludes based on certain characteristics...