Community
- Command Central
- MVP Program
- Monthly Mission
- Blogs
- Groups
- Events
- Media Vault
Products
- Observability
- Network Management
- Application Management
- IT Security
- IT Service Management
- System Management
- Database Management
Content Exchange
- SolarWinds Platform
- Server & Application Monitor
- Database Performance Analyzer
- Server Configuration Monitor
- Network Performance Monitor
- Network Configuration Manager
- SQL Sentry
- Web Help Desk
Free Tools & Trials
Store

Trap Alert Pattern Matching... How To?

I am trying to create a trap alert for VMWare vCenter traps; however I am having difficulties with a very simple pattern match.

It seems that the Trap Details displayed in the Trap Viewer are not an accurate representation of what the trap actually looks like when it's initially received by Orion. I came to this conclusion because I created a pattern match rule based on the Trap Details shown in the Trap Viewer and it's not working.

My best guess is that since the different details of the trap are broken up and stored separately in the database, when you view the Trap Details in the Viewer, it has been re-constructed and not the same as it's original form.

A screenshot of the Trap Details as displayed in the Trap Viewer is below along with the pattern I am trying to match in my Trap Alert.

I would be interested to hear from anybody that may be able to offer some insights on what I need to match on to get this to work, based on the screenshots below you should be able to see what I am trying to accomplish.

Trap Details

Trap Alert Pattern Match

Find more posts tagged with

Accepted answers

byrona

Okay, I am hoping that this new Trap condition will capture what I am looking for, I will update this thread as soon as I have some results...

All comments

mdriskell

Byrona,

If I remember right the match is the section after the = sign. Can you try matching on just *Red*. I know this isn't a solution for what you are wanting to do but I just checked several of my filters and they are based on conditions in the second part of the message.

byrona

Thanks, I will try this.

If this is truly the case then I am not sure the Trap Alerts component is very useful for most traps as I need to alert when a specific varbind is equal to a specific status, not just when a specific status is present anywhere in the trap.

mdriskell

Byron,

Did you find any way to accomplish referencing the particular varbind and the data? I have a particular set of traps that I think is going to require doing just that to accomplish my needs.

byrona

Well, as you might expect, as soon as I put in the rules as you suggested my systems decided that they were going to operate perfectly and not throw any more traps. Until the system decides to misbehave and throw some more traps I won't be able to tell you. Isn't this just always how it works out. = )

byrona

Byrona,
If I remember right the match is the section after the = sign. Can you try matching on just *Red*. I know this isn't a solution for what you are wanting to do but I just checked several of my filters and they are based on conditions in the second part of the message.

I have confirmed that this is accurate, only the details after the "=" sign is matched. This brings me to the obvious question; how do I filter or match for only a specific varbind in the trap using my example trap provided above?

byrona

Okay, I am hoping that this new Trap condition will capture what I am looking for, I will update this thread as soon as I have some results...

mdriskell

Bryon is this working?

I need to setup something very similar over the weekend.

byrona

Yes, this seems to be working properly.