6 Replies Latest reply on Apr 9, 2018 12:31 PM by RichardLetts

    Traps -> Events Not Working

    thekraken

      All, after reading tons of already posted discussions here regarding this often requested feature.... I am still unable to properly get Traps into the NetPerfMon event screen.

      We have some older BTI devices that Solarwinds is unable to Poll, however the MIBs are in Solarwinds and I can MIBwalk the device just fine.. however no resources ever show. So next best solution is to monitor via traps. I've tried a universal device poller but that seems like I have to add 1000 OIDs at a time....?

       

      I've configured the Alert conditions in Solarwinds Trap Viewer and they are being properlly tagged and colored, however the Action to send to NetPerfMon is not doing anything that I can tell.

      Additionally my attempts at using an SQL alert are failing miserably... Almost every thread I've read since 2010 lists Traps->Events as a requested feature... but 8 years later and it still requires Professional SQL experience to accomplish?

       

      Side Note: Our Orion and SQL DB is on the same server, but separate VMs. I thought MAYBE it was storing it in the wrong place so I configured two Actions to send to local NetPerfMon and to send to a remote.

      Is this NetPerfMon file different then what Solarwinds uses for events? Why is this so damn difficult to forward a trap to the Event/Alert screen?!

       

      There is nothing fancy we need to do with correlation, filtering, etc. Just forward the entire trap to Events/Alerts so our NOC can act and acknowledge.

       

      Thanks!

        • Re: Traps -> Events Not Working
          jamesatloop1

          Forget the trap viewer, awful thing. Create an sql orion alert and bamg this in replacing database in variable below. Insert the trap your looking for in between the %%.

           

          SELECT TOP (1000) [TrapID]

                ,[EngineID]

                ,[DateTime]

                ,[IPAddress]

                ,[Community_ANSI]

                ,[Community_Unicode]

                ,[Community]

                ,[Tag_ANSI]

                ,[Tag_Unicode]

                ,[Tag]

                ,[Acknowledged]

                ,[Hostname_ANSI]

                ,[Hostname_Unicode]

                ,[Hostname]

                ,[NodeID]

                ,[TrapType]

                ,[ColorCode]

                ,[TimeStamp]

            FROM ['database'].[dbo].[Traps] where traptype like '%myvariable%' AND DateTime >= cast(dateadd(day, -1, GETDATE()) as date)

          2 of 3 people found this helpful
            • Re: Traps -> Events Not Working
              thekraken

              So i took what you provided and modified a bit to join the Traps and TrapVarBinds table together so I actually get trap alarm details returned...

              However, it only works directly in SQL, not in solarwinds... Can't seem to remove the pre-configured SELECT statement at the top.

               

              Also, how does this know when a new trap comes in? Is there a way to match the SW Alert to check this condition every 15s to the DateTime filter so it only adds anything new in last 15seconds? Or is there a better way, IE: anything new since it last ran? I adjusted the Day -1 to Seconds -15, but it returned identical results.

               

              Thanks for your help!

               

              My current query:

              SELECT TOP (1000) [SolarWindsOrion_Test].[dbo].[Traps].[TrapID]

                    ,[SolarWindsOrion_Test].[dbo].[Traps].[DateTime]

                    ,[SolarWindsOrion_Test].[dbo].[Traps].[Tag]

                    ,[SolarWindsOrion_Test].[dbo].[Traps].[Acknowledged]

                    ,[SolarWindsOrion_Test].[dbo].[Traps].[NodeID]

                    ,[SolarWindsOrion_Test].[dbo].[Traps].[TrapType]

                    ,[SolarWindsOrion_Test].[dbo].[Traps].[ColorCode]

                    ,[SolarWindsOrion_Test].[dbo].[TrapVarBinds].[OIDName]

                    ,[SolarWindsOrion_Test].[dbo].[TrapVarBinds].[OIDValue]

                FROM [SolarWindsOrion_Test].[dbo].[Traps]

                INNER JOIN [SolarWindsOrion_Test].[dbo].[TrapVarBinds] ON Traps.TrapID = TrapVarBinds.TrapID

                WHERE Tag like '%BTITrap%' AND ColorCode like '%255%' AND DateTime >= cast(dateadd(second, -15, GETDATE()) as date);

               

            • Re: Traps -> Events Not Working
              Vinay BY

              Looks like you are going in circles, why don't you use 'Message Center' ? if trap is hitting solarwinds orion then you can view it on 'Message Center' and the same can be used by your NOC folks.

               

              The condition drafted by you isn't 'Netperfmon Event logging' it writes the same onto 'Windows Event logs'

              2 of 2 people found this helpful
              • Re: Traps -> Events Not Working
                Vinay BY

                I currently don't have an active solarwinds instance, if not I could have helped you with it

                • Re: Traps -> Events Not Working
                  aLTeReGo

                  The action you are using in the screenshot above will write an event to the Windows Event Log of the Orion server, not the Orion Events in the Orion web interface.

                  1 of 1 people found this helpful
                  • Re: Traps -> Events Not Working
                    RichardLetts

                    If you have a NOC then they might have time to look at syslogs or traps in the message center, but if they have any volume of alerts this will be a challenge -- best to convert the significant ones to alert

                     

                    If you want to generate an alert:

                     

                    1. In the trap viewer use the 'Tag a Trap' function to tag traps you are interested in. this sets a simple value that can be tested with equality.

                    i.e. trap.tag = 'OVER-VOLTAGE'

                     

                    this is important because it allows the database engine to make simple comparison of string values, and if you have a suitable index on the tag column allows for very high performance. Some people may suggest using wildcards, but really those are only useful when you do not really know what data you are looking for and perform poorly in a high volume production environment.

                     

                    2. you can then use this for an alert, e.g:

                    https://thwack.solarwinds.com/message/228483#228571

                    (yes, that really is over four years ago)

                     

                    3. Phone solarwinds and ask why the functionality isn't in the product yet because that appears to be the best way to register the need for this.

                    1 of 1 people found this helpful