AuthFailures from network devices

Has your community string changed anywhere... are u sure???  That's what I get when the comm string is wrong trying to poll a device.

also, why does it report the outside IP's of the devices?

I can't see what the IP's are or know what they are.  This can be caused by another device trying to poll your devices with the wrong comm string as well (not just your NPM Server)  Do you have anything else polling snmp on your network devices that might not have been changed???

For me it happens when another poller such as splunk polls devices with wrong comm string and then the device forward trap to NPM.

Can you tell is this happening with all devices or just a subset?  It might help to restart the polling services on NPM if it's all of them... I'd try it.

If the IP's your seeing in the trap aren't the ones you expect it might be something else doing the polling besides NPM since the trap is throwing on another IP than the one you have configured for the node in NPM.  I hope that makes sense. :^}

its seems like all network devices are doing this. im pretty sure they reset it about 2 days ago. something interesting, in router/switch configs, i have the server as 1.8 which is orion, but in the traps viewer, it shows them trying to authen to the y.y.y.y which is 1.57, why are they different?

Sound like something else at 1.57 is trying to poll your devices with the wrong comm string possibly if I'm reading you right.  Do you another product like CiscoWorks or something at 1.57?  1.57 may have wrong comm string set and is polling with it.

As a last resort to track down the problem:  Wireshark

Try installing Wireshark on the server that is spitting out the SNMP authentication failure traps and configure the filter to show only UDP port 161.  The output will show which IP address is sending the SNMP request to that server with the incorrect community string.

http://www.wireshark.org/download.html 

its under the proper comm string in orion and is set correctly, i am asking about installing WS now

its an scom, know of anything that might do that? he said he changed the comm strings already.