This discussion has been locked. The information referenced herein may be inaccurate due to age, software updates, or external references.

You can no longer post new replies to this discussion. If you have a similar question you can start a new discussion in this forum.

Traps spamming NPM Trap Log. Need to determine source!

ahthomas over 11 years ago

In the SolarWinds trap log, I have tons of trap messages like the below message. How do I determine what is sending SNMP packets with an invalid community string? It's obviously not Orion NPM, but I have no idea what it is.

5/10/2012 2:13:21 PM

10.19.1.3

servername

public

SNMPv2-MIB:authenticationFailure

snmpTrapEnterprise = MSFT-MIB:server
experimental.1057.1.0 = 10.19.1.3
sysUpTime = 37 days 22 hours 6 minutes 45.12 seconds
snmpTrapOID = SNMPv2-MIB:authenticationFailure

Top Replies

0 mdriskell over 11 years ago

It tells you right there that the source is 10.19.1.3
You have SNMP auth failure traps (I'd suspect windows)
Cancel
Vote Up 0 Vote Down

Cancel
0 ahthomas over 11 years ago in reply to mdriskell

The IP in the trap message is the IP of the server... This is the case for everything.
Cancel
Vote Up 0 Vote Down

Cancel
0 mdriskell over 11 years ago in reply to ahthomas

Check your SNMP settings on the server....It sounds like you are sending traps to yourself. But that IP is the source of the trap.
Cancel
Vote Up 0 Vote Down

Cancel
0 mdriskell over 11 years ago in reply to mdriskell

If it is your server and you do want traps sent then I would turn off the Auth Failure checkbox on the settings.
Cancel
Vote Up 0 Vote Down

Cancel
0 ahthomas over 11 years ago in reply to mdriskell

So...you're saying that traps are setup to send to localhost on the servers that are spamming this message? Will check that now.
Cancel
Vote Up 0 Vote Down

Cancel
0 ahthomas over 11 years ago in reply to mdriskell

Nope, not the case. Traps are only pointed at SolarWinds. Not locally.
Cancel
Vote Up 0 Vote Down

Cancel
0 mdriskell over 11 years ago in reply to ahthomas

I'm saying your solarwinds server is probably sending traps to the localhost.
Cancel
Vote Up 0 Vote Down

Cancel
0 mdriskell over 11 years ago in reply to ahthomas

Is your solarwinds server sending traps to itself is what I'm asking.
Cancel
Vote Up 0 Vote Down

Cancel
0 ahthomas over 11 years ago in reply to mdriskell

Yeah the traps tab in the SNMP service settings points to the IP and FQDN of the SolarWinds server, on the SolarWinds server. Not "localhost" though.
Cancel
Vote Up 0 Vote Down

Cancel
0 ahthomas over 11 years ago in reply to mdriskell

Removed trap destinations and restarted the SNMP service, did not fix the problem.
Cancel
Vote Up 0 Vote Down

Cancel