ahthomas

Everything is set to *. The only thing with specific values is the alert actions tab and the conditions tab.

It's the only rule there, and looks exactly the same as yours.

I setup that rule, and it's still logging like crazy.

That just does a delete from the database right? The empty space will still be there, as will all the network traffic to the server. Good concept but I think it's more effort than required here. Just needs to be blocked at a network level somehow.

Yeah with 1500 devices, 9000 elements my DB is 45GB. Probably because of that! How do I filter it out? Firewall rule?

Will try. If somebody else knows how to find out what is obsessively scanning these devices with the wrong string, I'm all ears...this is absolutely flooding my server.

Actually they're not from a router or switch, that was my mistake. They're from servers only.

So some other instance of SolarWinds, or some monitoring tool? I figured as much. How do I find out what the other monitoring device is that's scanning these things?

So you're saying that these devices are sending traps to SolarWinds with incorrect information or something?

We have a few devices spamming the trap log that aren't even in SolarWinds... which is even weirder.

Well I went to our DR SAP server. Traps are pointed at SolarWinds, SolarWinds is talking to that server over SNMP without error but it's still throwing this trap which is why I know it isn't related to SolarWinds. It couldn't be since SolarWinds isn't getting the authorization errors when I do a list resources. Something…

Yeah, I mean there are 10-20 servers/switches logging this every few seconds. Over the last 15 minutes I've had over 2000 of these events log.

Alright, we have a long change approval process here, so I would have to do that before implementing any such thing. FWIW, SNMP is configured correctly for the devices in question, in Orion.

Yes, they confirmed it's an issue with 10.2RC.

Removed trap destinations and restarted the SNMP service, did not fix the problem.

Yeah the traps tab in the SNMP service settings points to the IP and FQDN of the SolarWinds server, on the SolarWinds server. Not "localhost" though.

They wouldn't change. The server isn't rebooted. Plus, if the ID's changed, they'd be showing as unknown and wouldn't poll manually...

Yeah, but even so, a lot of the non web apps seem to have issues too. Mainly the report writer.

Ticket opened.

Browser doesn't matter. I'm doing PDF's in the reports and no PDF sends. It shows the error mentioned in the OP.

Output of snmpwalk is this: .1.3.6.1.4.1.9600.1.1.1.1.19 = No more variables left in this MIB View (It is past the end of the MIB tree)

Like I said earlier, we setup a SQL job to run every 30 seconds to delete rows containing anything like mentioned in the OP.

In a bit. Also, figured out what MIB walk is. We don't have it, we don't have the toolkit. We aren't looking to put any more money into SW as of now.

I will give those options a try. Is using something like Crystal Reports an option?

Well I guess I have to create 74 maps manually then. I wish SolarWinds had some kind of infrastructure drawing application like Microsoft has. I have over 1000 nodes and 26 locations to map out...

Nope, not the case. Traps are only pointed at SolarWinds. Not locally.

So...you're saying that traps are setup to send to localhost on the servers that are spamming this message? Will check that now.

I imported the undp file and assigned it to one of the Windows machines but no data is being returned...

Yeah, I knew about that. He brought it up because a lot of times the web interface gets hung up to the point of having to exit my browser, clear cache and log in again. He said he never had this issue with the GUI interface I'm talking about.

Right now, it's the only answer. Their engine does not have anything to stop certain things from polling. According to my account exec, this has been submitted to PM for a feature request.