SNMP Traps and Syslog Traps can raise an advanced alert in NPM

At the moment received SNMP- and Syslog Traps are only parsed and written directly into NPM database

The alerting interface for Traps has nothing to do with the NPM advanced alerting engine - nothing else happens in NPM with that valuable collected information.

Additionally a received critical Trap has no correlation to the nodes status.

So until today Solarwinds NPM is a totally "polling-centric" solution.

Most other competitive monitoring products on market support more comprehensive alerting and node status views based on polling AND on traps.

What we want:

1. Any received Trap - Syslog or SNMP, based on customizable pattern/content criterias should be able to raise an alert in NPM advanced alert manager.

2. The trigger criteria can be regular expression to be able to grep any text content/field out of a Trap.

3. The reset criteria should do the same, to be able to clear raised alerts also by same or different Traps based on customizable pattern.

4. Admin should be able to choose for alert creation:

     a. Repeatedly recieved Traps with same pattern/content should be ignored by alerting engine after alert is triggered once - alert should still be active of course

     b. Repeatedly received Traps with same pattern/content should raise a counter in database to escalate or trigger alerts based on that counter value (e.g. > 10 identical messages should trigger alert)

5. These Trap Alerts (Syslog/SNMP) should change the node status LED in GUI

Why this makes sense:

Most vendors support more alerting features/messages via SNMP Traps than via SNMP polling (also Cisco!)

Alerting based on Traps is much faster than via polling

Alerting based on Traps is more efficient on the network as messages are only created on failure condition compared to polling

Lots of customers use competitive products supporting propper SNMP Trap handling and will not change to Solarwinds as long as this is not supported there.

There are already a lot of requests for Traps (SNMP, Syslog) raising an alert as found in thwack community:

http://thwack.solarwinds.com/message/195721

http://thwack.solarwinds.com/message/122581#122581

http://thwack.solarwinds.com/message/174510#174510

http://thwack.solarwinds.com/message/228483#228483

http://thwack.solarwinds.com/message/192825#192825

http://thwack.solarwinds.com/message/217626#217626

http://thwack.solarwinds.com/message/212761#212761

http://thwack.solarwinds.com/message/36239#36239

Parents
  • guys.  this  require something called bus for messages .... in OSS terminology (this inputs like snmptraps/syslog/exports) are  called northbound, and southbound interface...  honestly i am pretty dissatisfied with currrent progress on this topic...  i am courious, if there is somebody from solarwind emp. who is reading it .. this basic feature is discussed here since ages... this must be core feature of solarwinds...and still we are opening new and new feature requests, and all are(and problably will be ) neglected by solarwind PM team

  • I, uh....what?

    I get you don't like this and it does need improvement, but this isn't one that is entirely neglected. They literally put in framework to update it accordingly via introducing rabbitMQ - which on the long term enables a variety of methods to handle the issue.

  • ok. sory for negative comments. but i work with solarwinds since years, and having serious troubles due to this. hope it will be avaiable fast. cheers.

Comment Children
  • I think it's fair to say that a lot of things need improvement and their teams may be a bit too stretched, but at least this one they *are* working on. lol.

  • I suspect they won't implement this obvious/useful feature not because it's technically difficult to do so, but because by enabling users to generate alerts based on SNMP traps reduces dependence on monitoring ports, and Solarwinds' charges per port. In order words, by implementing this feature they could end up losing money. If you go back through the forums, people have been asking for this for years.... why haven't they implemented it yet? They probably never will.

    It's a real shame because there are all sorts of critical events that generate SNMP traps, but we can't do much with them with NPM, other than log them or generate emails.

    Even if the event can be picked up through SNMP polling, we have to wait until next polling interval before we are alerted to this (maybe 15/30 minutes).

    Also, if the status of some device on the network changes, and changes back to how it was within the polling period, Solarwinds may never even become aware of the incident.

    An event may have occurred, or it may not, who knows??? Not exactly suitable for mission critical situations Solarwinds.

    A serious downside to Solarwinds NPM!

    Thanks,

    Bruce.

  • It's going to be ugly when I tell a new customer is not is not possible. They just spent a ton of $ and I'm going to look friggin' silly. Ugh.

  • Really orioncrack - it is very ugly when management is asking something to improvement in infra monitoring part and as an implementer, we are always saying one thing this feature is not available or this is under feature request, totally bad impression,

    now every one start to suggest use this and that tool, same will give you the correct picture.