Enabling Advanced Alerting from SNMP Trap

Hey Everyone,

I am not sure if this is the right spot to post, but I am looking for some good information on setting up an Advanced alert from an SNMP Trap from my routers. I have configured a lot of other kinds of alerts but nothing like this. I have gone through the Solar Winds Technical Reference on Understanding Orion Advanced Alerts and it mentions it in there but not how to set it up.

Any ideas would be greatly helpful.

Thanks,

Kimberly

Find more posts tagged with

traps

SNMP

alerts_snmp_traps

Accepted answers

All comments

mharvey

Kimberly,

There isn't a way to create an advanced alert based on a trap. If the traps are coming into the Orion server then you need can open the SNMP Trap Viewer and create a rule for those traps. Within the rule you can define an action such as emailing a message out. This is the extent that traps can do in terms of alerting within Orion NPM.

Regards,

Matthew Harvey

Loop1 Systems

http://www.loop1systems.com

RichardLetts

You can use the Trap manager to execute the actions; but this is somewhat more limited than the Alert support.

There is a gap between that you can do with the traps and what you can do with alerts

In particular: There is no way to acknowledge an a trap. There is no escalation available for a trap. many of the node/interface attributes are unavailable

The best way I can think of to do this is to create a custom SQL alert.

For example: if you want alerts on nodes that have an authentication failure trap in the past hour then create a custom SQL alert on nodes and put a suitable condition:

WHERE nodeid IN (SELECT nodeid

FROM traps

WHERE traps.traptype = 'SNMPv2-MIB:authenticationFailure'

AND Datediff(hour, traps.datetime, Sysdatetime()) < 1)

This is somewhat poor SQL, but it's what we've got. if you need to look deeper into the contents of the trap then you have to join with TrapVarBinds

Hope this helps

kimberly_adams

Thank you for the replies.

Matthew was on the right track and some additional configurations were needed on my router as well. Another member of my group and I worked out the alerts from the Syslog Viewer and got it to send emails out about our routing table changes. This was a little convoluted but I think this will work for what we are looking for.

If anyone else would like to know more of the specifics of how we are monitoring and alerting on routing table changes and such, please reply to this post and I will share what we have here now.

Thanks again for the help in the right directions.

Kimberly

RichardLetts

I'm interested in how you are alerting off your routing changes.

ckceric

I do think that would be great if the Advance Alert Manager could configure alert for keywords from the traps received, I do a search for a whole afternoon and found the feature request was start from 2010, although some features come out to deal with the trap but we still hope we can handle traps with the Advance Alert Manager that would be better to handle for our users.

D_Dal

Hi Kimberly,

I would like to see how you achieved alerting on routing table changes.

Regards,

Derek