CONVERT TRAP TO ALERT, can this be done?

Hello,

Everything is possible Officially SolarWinds has dedicated Alerts for Traps in "Trap Viewer" and those cannot be the same as Alerts in Web console.

I am assuming that this is what you want to achieve - to trigger Alert in web console from Trap.

There are two ways to do that.

First option will need SAM module license

-----------------------------------------------------

1. Define custom Alert for filtered Traps (depending on the use case) in Trap Viewer

2. Add Windows Event Log in Alert Action

3. Define content of the Alert - Hint: include random ID, which will be used later on.

4. Define "Log Message in Event Log on NetperfMon Server" - this will be for monitoring those events internally for SolarWinds

5. In SolarWinds web console, add SolarWinds server as WMI.

6. Create new SAM template to monitor Windows Events and filter them to ID from step 3

7. Once the events will be received by server, you will notice that you can view all the content of the event from web console

You can also assign web Alerts for those events.

Would this be applicable for you?

Second option requires knowledge of scripting

-----------------------------------------------------

1. Download and install Orion SDK

2. Define custom Alert for filtered Traps (depending on the use case) in Trap Viewer

3. Define "Execute an external program" in Alert Actions

4. Point external program to powershell executable with additional parameters, if required

5. Use below documentation for creating custom script, which will initiate web console Alert:

Alerts · solarwinds/OrionSDK Wiki · GitHub

I hope the above will help you.

Kind regards,

Marcin Kazmierczak.

---

IT-Indago Ltd. - Authorized Reseller & SolarWinds Certified SCP Professional

IT-Indago – Be In Control!  |  Follow us on Facebook & LinkedIn

Hi Marcin,

I got so far in the trap viewer that it logs the trap into the event log.

How do you include a random ID?

The help button did not really take me anywhere useful.

Regards,

Sebastian

Might be able to create a database trigger to create an alert record when a trap is created.

Hello,

>> How do you include a random ID?

As far as I know, you cannot define "Event ID" for the Alert action on Trap Viewer. However you can add a point of reference to the Alert message.

Here is a simple example of action:

-----------------

-----------------

Next, go to:

1. Settings -> All Settings -> SAM Settings -> Component Monitor Wizard -> Custom Performance Monitor - WMI

2. Choose a test server (SolarWinds main server would be good)

3. On Performance Object choose any object (you can delete it afterwards)

4. On "Edit Properties" click "Add Component Monitors"

5. Find and add "Windows Event log Monitor"

6. Delete previously added performance component

It should look something like that:

-----------------

-----------------

7. Expand the Windows Event Log Monitor and configure the "match definition". I did something like that:

-----------------

-----------------

8. Save the template

Next, go to the template from SAM Summary view and you will be able to see the Events

-----------------

-----------------

You can click on the selected event log and check the details:

-----------------

-----------------

Once you have it up and running, you can define on the SAM template what status the Application component should have (from "Edit Application Monitor")

-----------------

-----------------

You can also add new Alerts for this Application component.

Basically once you would send the trap to SolarWinds web console, you can do anything with it.

Kind regards,

Marcin Kazmierczak.

---

IT-Indago Ltd. - Authorized Reseller & SolarWinds Certified SCP Professional

IT-Indago – Be In Control!  |  Follow us on Facebook & LinkedIn

Thanks for posting this, I tried using an advanced SQL alert and one of the limitation I ran into was it only grabbed the most recent event. If there were more than one event in the alert they could get missed. I'm going to give this a try next.

This information is super useful! I am able to get an alert to trigger now off of the trap. The issue that I am having is that once the alert triggers, it can not reset (or I do not know how to do so!) and since it does not reset, it will not trigger again for a new trap.

I tested with a juniper VC Member Down trap

     4/17/2019 3:35 PM : JUNIPER-VIRTUALCHASSIS-MIB:jnxVccpMemberDown  SNMP Trap

I need to know how to get resets on these type of alerts as well as being able to alert if multiple devices are sending this same trap at the same time (as is usually the case).

Thank you again!

Thats really helpful and i was able to follow your suggestions and get to seeing the traps in the Event log or in a log file.

However Need some more insight please.

Now the Message of the trap is quite a few lines coming from the DPA. I need to be able to pass the DB name thats impacted (resulting in the trap) into the Alert Message text from SAM. I have SAM integrated with SNOW and need to generate incidents on such details.

Though I have integrated DPA with Orion but I didnt find much help in creating alerts for the DPA DB instances in orion

Any help you can suggest me of will be great please.

Thanks,

Utkarsh