Community
- Command Central
- MVP Program
- Monthly Mission
- Blogs
- Groups
- Events
- Media Vault
Products
- Observability
- Network Management
- Application Management
- IT Security
- IT Service Management
- System Management
- Database Management
Content Exchange
- SolarWinds Platform
- Server & Application Monitor
- Database Performance Analyzer
- Server Configuration Monitor
- Network Performance Monitor
- Network Configuration Manager
- SQL Sentry
- Web Help Desk
Free Tools & Trials
Store

Trap Alert on missing "Heart Beat Trap"

sja

I have some old box that sending Heart Beat Trap every 30 min.

I will like to Alert when I miss that Heart Beat Trap (if you didnt get trap type in the last 120 min Alert)

That will sure help when my forwarder is dropping trap servics.

I don't see any option in Orion Trap viewer to alert in that way.

Find more posts tagged with

Accepted answers

All comments

clubjuggle

To my knowledge, it's not possible to trigger an alert on the absence of a trap. What are you attempting to monitor in this way? Perhaps there's another way to do it.

sja

‌hi

I found something like that in kiwisyslog "you know that box is sending 2 traps every hour"

Need to know when I miss traps

This filter will trigger only when the preceding filters have not been met X times in Y minutes.

The Flags/Counters filters need to be placed after all the other filter types in the rule. This is so the other filters can be processed first.

Details

The Timeout filter is useful for monitoring syslog devices and notifying you when things go quiet. For example, the firewall might normally generate at least 200 messages per hour. If the amount of messages suddenly dropped to only 10 messages in the hour, or even stopped sending messages at all, you could be alerted to the inconsistency via e-mail.

This filter is different from the other flags/counters filters in that it is not fired by an incoming message. It is actually fired by a count down timer due to a lack of messages. Therefore when this filter is fired, no current message is associated with the event. Instead an informational message is created and passed to any actions below the filter. The message is in the following format:

Priority: Local7.Debug (191)

HostIP: 127.0.0.1 (localhost)

MsgText: The rule 'Rule name here' has only been matched X times in Y minutes. The threshold was set for Z times.

Rule: Firewall Monitor

Filters

Filter: Field=Hostname, Type=Simple.

Include: "firewall.company.com" [S]

Filter: Field=Flags/Counters, Type=Timeout

Filter is true if event doesn't occur 1 times in 5 minutes.

Filter: Field=Time of Day, Type= Time of Day

Monday to Friday 8:00 a.m. to 6:00 p.m.

clubjuggle

Sorry, I assumed you were looking for a way to do this in NPM, and I don't have Kiwi Syslog Monitor in my current environment so I didn't think of that. It looks like that will work just fine.

sja

‌Yes I do

I just found that type trap alert only in kiwi ....