Community
- Command Central
- MVP Program
- Monthly Mission
- Blogs
- Groups
- Events
- Media Vault
Products
- Observability
- Network Management
- Application Management
- IT Security
- IT Service Management
- System Management
- Database Management
Content Exchange
- SolarWinds Platform
- Server & Application Monitor
- Database Performance Analyzer
- Server Configuration Monitor
- Network Performance Monitor
- Network Configuration Manager
- SQL Sentry
- Web Help Desk
Free Tools & Trials
Store

Not getting Trap emails

I've setup a router of mine to send traps on a few things, one of them being BGP. I'd like to get emails when I have a BGP peer go down so I went into Trap viewer and setup a rule based on the following but I dont get any emails. I'm sure our email system works as I get them with syslogs and other polling info I have. Anybody know what I'm missing?

Here is the Trap I want to get an email for:

Trap Type: BGP4-MIB:bgpTraps.0.1

Trap Details:

snmpTrapEnterprise = BGP4-MIB:bgpTraps

experimental.1057.1.0 = 10.148.50.13

sysUpTime = 147 days 17 hours 45 minutes 0.15 second

snmpTrapOID = BGP4-MIB:bgpTraps.0.1

bgpPeerState.10.148.31.38 = established(6)

bgpPeerLastError.10.148.31.38 =

Here is how I setup my Alert:

General tab: Rule is enabled, source address is *.

DNS Hostname tab: DNS hostname pattern is *.

Trap Details tab: Trap details pattern is *BGP4-MIB*.

Community String tab: Regular Expression not checked, Community String Pattern is *.

Conditions tab: BGP4-MIB:bgpTraps.0.1 contains *established*

Time of Day tab: all are checked

Trigger Threshold tab: "Define a Trigger..." is not checked.

Aler Actions tab: I have it send email to me. The setup here is exactly the same as I have other email alerts setup with the difference in the message body.

Any help would be appreciated.

Find more posts tagged with

Accepted answers

superfly

Shahram wrote:
If this works then my question would be how to get an alert based on a specific wording in the trap message.

Did you try what I suggested before?

"One more thing you could try is rightclicking on the Trap Details section of the alert you're interested in and select Add Rule. This option adds in all the options for that alert and you should only need to add in the Alert Actions. So this should then send an email once that alert appears again."

All comments

superfly

Try changing "Conditions tab: BGP4-MIB:bgpTraps.0.1 contains *established*" to "Conditions tab: BGP4-MIB:bgpTraps.0.1 is equal to *", that way you should get an email for all the BGP traps that come in. See if that works. Also check if you have you SMTP Server details filled in in the Edit E-Mail/Page Action section. Within the Trap Viewer rule, you have to set what the SMTP server is.

I use Syslog Viewer instead to alert me of BGP neighbour changes.

For Message Type Pattern I look for BGP-5-ADJCHANGE

Then in the email message I send

Subject: BGP Neighbour Change on ${Node.Caption}

Message: ${MESSAGE}

Hope that helps.

Shahram

Thank you for the tips superfly99. I already get the BGP messages from syslog from other devices. Since Syslog is a more CPU intensive operation I was hoping to setup traps instead of it. I may eventually turn on syslog for this router but I need to figure out why my trap alert is not working since I still want to be able to use it. I do have the correct email server setup in the email actions, and I honestly dont want to be alerted several times for one event. I probably have to open a ticket with SolarWinds...

danielleh

Shahram - can you please post back with your ticket number? Keep us up to date with this if you would.

Thanks,

Danielle

superfly

Can you actually see the traps appearing in trap viewer? Sounds like you do get the traps but I just wanted to double check.

So there must be an issue with your alert. Did you try changing the conditions tab to something more "generic"? Basically try getting the trap viewer to send you emails for any snmp trap that comes in (that way you know the email setup is working correcly). Then from there fine tune it to the particular alert.

ecklerwr1

Also does the test fire on the alert send an email? Do you have other alerts already sending emails that work? Have you verified there's nothing being blocked by firewall in the full path?

Shahram

All very good thoughts...

I do get the trap and that is why I opened this discussion because I'm not getting the email.

I dont have anything blocking emails to come through. I get emails from my other syslog rules and poller alerts.

I did open a ticket with Support and they are asking for captures... I'll have to set that up... not easy at this time, or maybe I can just run the capture from the server itself...

I'll try superfly99's suggestion on trying to get an email for a more generic rule.

Ecklerwr1, not sure what you mean by a test fire. Is there a way to manually fire an alert from the NPM server without the router going under the condition?

superfly

ecklerwr1 wrote:
Also does the test fire on the alert send an email? Do you have other alerts already sending emails that work? Have you verified there's nothing being blocked by firewall in the full path?

Where is the test option for testing a Trap Viewer alert? I know there's one in Advanced Alerts but I can't find a test button in Trap Viewer.

Shahram

So we went and created a more generic rule based on Linkup LinkDown and were able to get the email alert. Now we changed our conditions above to BGP4-MIB:bgpTraps.0.1 contains *. Now I only need to wait for it to trigger, or find a maintenance window to force a trigger and make sure I get the alert. If this works then my question would be how to get an alert based on a specific wording in the trap message.

superfly

Shahram wrote:
If this works then my question would be how to get an alert based on a specific wording in the trap message.

Did you try what I suggested before?

Shahram

Just an update to this thread... My BGP just bounced last night and the trap email alerts came in. So that worked for me. I also realized that the "trap detail tab" is where we would key off of details like the "established" I was originally shooting for.

Thanks for everyone who pitched in. I'll start creating more rules now and try using the right click as superfly99 suggested.

superfly

Excellent. Can you please mark this thread as answered unless you need more info