A week ago a It person at a location emailed that a APC UPS is emailing him alerts about a device (our NPM Server) is trying to connect to SNMP.
The UPS is a child device with a 192.168 IP address.
Where do I check on where this activity is being spawned?
If the device appears in NPM, then it's a poller. If it doesn't appear in NPM, then there's a discovery task checking this network.
So do a search in NPM for the IP address of the device in question. If it's not found, check your discovery profiles.