Traps -> Events Not Working

All, after reading tons of already posted discussions here regarding this often requested feature.... I am still unable to properly get Traps into the NetPerfMon event screen.

We have some older BTI devices that Solarwinds is unable to Poll, however the MIBs are in Solarwinds and I can MIBwalk the device just fine.. however no resources ever show. So next best solution is to monitor via traps. I've tried a universal device poller but that seems like I have to add 1000 OIDs at a time....?

I've configured the Alert conditions in Solarwinds Trap Viewer and they are being properlly tagged and colored, however the Action to send to NetPerfMon is not doing anything that I can tell.

Additionally my attempts at using an SQL alert are failing miserably... Almost every thread I've read since 2010 lists Traps->Events as a requested feature... but 8 years later and it still requires Professional SQL experience to accomplish?

Side Note: Our Orion and SQL DB is on the same server, but separate VMs. I thought MAYBE it was storing it in the wrong place so I configured two Actions to send to local NetPerfMon and to send to a remote.

Is this NetPerfMon file different then what Solarwinds uses for events? Why is this so damn difficult to forward a trap to the Event/Alert screen?!

There is nothing fancy we need to do with correlation, filtering, etc. Just forward the entire trap to Events/Alerts so our NOC can act and acknowledge.

Thanks!

Find more posts tagged with

snmp trap

Accepted answers

All comments

jamesatloop1

Forget the trap viewer, awful thing. Create an sql orion alert and bamg this in replacing database in variable below. Insert the trap your looking for in between the %%.

SELECT TOP (1000) [TrapID]

,[EngineID]

,[DateTime]

,[IPAddress]

,[Community_ANSI]

,[Community_Unicode]

,[Community]

,[Tag_ANSI]

,[Tag_Unicode]

,[tag]

,[Acknowledged]

,[Hostname_ANSI]

,[Hostname_Unicode]

,[Hostname]

,[NodeID]

,[TrapType]

,[ColorCode]

,[TimeStamp]

FROM ['database'].[dbo].[Traps] where traptype like '%myvariable%' AND DateTime >= cast(dateadd(day, -1, GETDATE()) as date)

vinay.by

Looks like you are going in circles, why don't you use 'Message Center' ? if trap is hitting solarwinds orion then you can view it on 'Message Center' and the same can be used by your NOC folks.

The condition drafted by you isn't 'Netperfmon Event logging' it writes the same onto 'Windows Event logs'

vinay.by

I currently don't have an active solarwinds instance, if not I could have helped you with it

aLTeReGo

The action you are using in the screenshot above will write an event to the Windows Event Log of the Orion server, not the Orion Events in the Orion web interface.

thekraken

So i took what you provided and modified a bit to join the Traps and TrapVarBinds table together so I actually get trap alarm details returned...

However, it only works directly in SQL, not in solarwinds... Can't seem to remove the pre-configured SELECT statement at the top.

Also, how does this know when a new trap comes in? Is there a way to match the SW Alert to check this condition every 15s to the DateTime filter so it only adds anything new in last 15seconds? Or is there a better way, IE: anything new since it last ran? I adjusted the Day -1 to Seconds -15, but it returned identical results.

Thanks for your help!

My current query:

SELECT TOP (1000) [SolarWindsOrion_Test].[dbo].[Traps].[TrapID]

,[SolarWindsOrion_Test].[dbo].[Traps].[DateTime]

,[SolarWindsOrion_Test].[dbo].[Traps].[tag]

,[SolarWindsOrion_Test].[dbo].[Traps].[Acknowledged]

,[SolarWindsOrion_Test].[dbo].[Traps].[NodeID]

,[SolarWindsOrion_Test].[dbo].[Traps].[TrapType]

,[SolarWindsOrion_Test].[dbo].[Traps].[ColorCode]

,[SolarWindsOrion_Test].[dbo].[TrapVarBinds].[OIDName]

,[SolarWindsOrion_Test].[dbo].[TrapVarBinds].[OIDValue]

FROM [SolarWindsOrion_Test].[dbo].[Traps]

INNER JOIN [SolarWindsOrion_Test].[dbo].[TrapVarBinds] ON Traps.TrapID = TrapVarBinds.TrapID

WHERE Tag like '%BTITrap%' AND ColorCode like '%255%' AND DateTime >= cast(dateadd(second, -15, GETDATE()) as date);

RichardLetts

If you have a NOC then they might have time to look at syslogs or traps in the message center, but if they have any volume of alerts this will be a challenge -- best to convert the significant ones to alert

If you want to generate an alert:

1. In the trap viewer use the 'Tag a Trap' function to tag traps you are interested in. this sets a simple value that can be tested with equality.

i.e. trap.tag = 'OVER-VOLTAGE'

this is important because it allows the database engine to make simple comparison of string values, and if you have a suitable index on the tag column allows for very high performance. Some people may suggest using wildcards, but really those are only useful when you do not really know what data you are looking for and perform poorly in a high volume production environment.

2. you can then use this for an alert, e.g:

https://thwack.solarwinds.com/message/228483#228571

(yes, that really is over four years ago)

3. Phone solarwinds and ask why the functionality isn't in the product yet because that appears to be the best way to register the need for this.