Check out the timestamps - it looks like either the time/timezone on your LEM appliance isn't set or it differs from your Orion system sending the trap. Due to that huge delta, the rules won't fire because they think that data is too far outside of the normal activity window.
This KB might help (it applies to incidents as well as email, any action really): SolarWinds Knowledge Base :: Troubleshooting LEM Rules and Email Responses
If you have any other events in your "LEM Internal Events" filter, what do their timestamps show? (How does it compare to the SNMP traps?)
The date is parsed from the log on the appliance (you can see it there - 20150528.163102), so (at least ) two things are possible -
1. appliance time was wrong (first guess)
2. maybe the connector isn't properly parsing things (also possible)
Timestamps in "LEM Internal Events" are fine. There is small difference, less than 5 minutes in InsertionTime and DetectionTime.
LEM can successfully fire alert on those evens.
Problem is with SNMP Traps.
I'm filtering by:
SystemStatus.ToolAlias = SNMPTrapAlias
This is the Filter for all SNMP Traps messages (assigned to SNMP connector):
Hmm... I verified in the connector it's parsing that 20150528.163102 to create a timestamp (it reformats it to 2015-05-28 16:31:02), so it's weird that somehow it's being timezone adjusted. Usually that'll happen if the LEM appliance is in a different timezone, but then I'm not sure why InsertionTime in general is correct.
Are you receiving other data via syslog on the LEM appliance? Timezone/timestamps are correct on those?
I have no problems with other connectors.
Security Events (FW)
System Events (PIX and IOS Connector)
User Logons (received from LEM Agent)
LEM Agent installed on workstation
For those filters above, both InsertionTime and DetectionTime are the same (or similar).
Example of InternalNewToolData for Cisco NX-OS:
Double checked time settings.
Hypervisor Time = Guest Time (synchronization enabled).
LEM appliance looks fine.
Weird. I'll check with our internal team and see what they think, too,.
I have fixed this.
We had problems with evaluation license (license expiration related to timezone and date) which lead us to discover wrong time settings.
Thanks Nicole for your help!