Documentation forLog Analyzer

Alert when a node stops sending SNMP traps

Some devices cannot be polled, for example, devices behind a one-way network diode. For these devices, SNMP traps are the only way to know that the device is working. Log Analyzer records the date and time of the last trap it received from each node. You can use this value to create an alert that triggers when a node has not sent a trap for a period of time.

Use this alert to:

  • Monitor devices that sit behind a one-way network diode and cannot be polled.

  • Detect when a device that is the only source of critical event traps goes silent. Silence can mean that the device is down, the network path is broken, or a diode failed.

How the last trap time works

  • The last trap time is stored in the LastTrapReceived property of the message source for the node. The value is a UTC date and time.

  • Only traps update the property. Syslogs, Windows events, and other log types do not.

  • LA updates the property at most once a minute for each source. The value can therefore be up to about one minute behind the actual last trap.

  • The one-minute update interval is kept in memory. It resets when the Log management service restarts, and the first trap after a restart updates the property immediately.

  • In environments with additional polling engines, each polling engine keeps its own update interval. The value reflects the last trap that the engine received.

  • A node that has never sent a trap has no value for the property. Include a condition in your alert that excludes empty values so that the alert does not trigger for these nodes.

Create an alert for missing traps

Use the Alert manager to set a condition for missing traps:

  1. In the SolarWinds Platform Web Console, click Alerts and activity > Alerts, and then click Manage alerts.

  2. Click Add new alert and then enter a name and description for the alert.

  3. On the Trigger condition step, set the following properties:

    • Object type: Node.

    • Trigger condition: LastTrapReceived is not <empty>.

      Nodes that have never sent a trap will have LastTrapReceived = NULL and will be excluded from alerting.

For precise control over the threshold, you can use a custom SQL condition:

SELECT n.Caption, ms.IPAddress, ms.LastTrapReceived,
       DATEDIFF(MINUTE, ms.LastTrapReceived, GETUTCDATE()) AS MinutesSinceLastTrap
FROM [Nodes] n
INNER JOIN [SolarWindsOrionLog].[dbo].[OrionLog_LogEntryMessageSource] ms
  ON ms.NodeID = n.NodeID
WHERE ms.LastTrapReceived IS NOT NULL
  AND DATEDIFF(MINUTE, ms.LastTrapReceived, GETUTCDATE()) >= 5

Adjust >= 5 to your desired silence window (in minutes).

Troubleshooting

Issue Possible cause and action
The alert never triggers for a node. The node has never sent a trap, so LastTrapReceived is empty. Confirm that the node has sent at least one SNMP trap.
LastTrapReceived does not change right after a trap. The value updates at most once a minute for each source. Wait about a minute and check again.
The alert triggers for syslog or Windows event sources. The query does not limit results to traps. Add ms.LogSourceType = 2 to the query.
LastTrapReceived or the SWIS property is missing. The installation is not on 2026.4 or later, or the upgrade did not complete. Check the upgrade logs.

For more information about alerts, see Use alerts to monitor your environment with the SolarWinds Platform.