Need to create trap template for advanced alert

Question

After defining an advanced alert I have not been able to find info on creating a trap template which is needed in the trigger and reset actions for the sendtrap action.

My alert checks for Xmit+Recv bps and compares that to a custom property I added called CommitRate. The alert triggers OK, and shows up in the Active Alerts view, but the trap does not send. THe following error shows up in the Event Log (I replaced the IP address with x's):

A rule requested that an Alert Action called Send SNMP Trap () to x.x.x.x load a trap definition file called .trap, however the file does not exit.  Try copying the trap defintion file to the executable directory of the service.

I need some documentation that explains the format/syntax of a trap template for Orion. Is there a form or tool that assists with creating trap templates for advanced alerts?

FormerMember · Answer

I'm in the same boat. I have to do reverse engineering on the ForwardSyslog.trap file, and I have to guess the values for the different fields.

Is there any documentation for these advanced altert trap templates? If so ... Where can I find it?

FormerMember · Answer

Update 2: I changed my method a little and seems as though I am close to getting it to work. I can't figure out how to get the value of the OID into the trap. I am assuming it will be a variable that is assigned to Value=, but I don't know what it should be. I have tried "${NetObjectID}", "${PropertyValue}", and "${AlertMessage}" which all resulted in Value: NULL. Here is my latest trap template:

FormerMember · Answer

Update: I copied the ForwardSyslog.trap template found in the Orion program folder. I was able to send the trap, but I still need to understand the format of this file, and where I can find more info on the variables. I have edited the file to include one of the OIDs I want, but sniffer shows the Value as NULL. At first the sniffer was showing "Value: Wrong Type (should be Counter32)". After changing the value of DataType from 67 to 5 (guessed), I no longer get the Wrong Type message, now it comes in as "Value: NULL" Here is the edited file I am working with, I am not having much luck guessing about it's format and variables, e.g. Does DataType=5 actually map to Counter32 or was that a fluke? Contents of bandwidthalert.trap: