Documentation forSolarWinds Platform Self-Hosted

Monitor SNMP traps

This topic applies to the following products if you are NOT using the Orion Log Viewer to monitor SNMP traps.

IPAM — NAM — NCM — NPM — NTA — SAM — SRM — VNQM

If you monitor a large number of devices, where each device may have many connected objects of its own, requesting information from each device is impractical. You can set up the SNMP Trap Server, and each managed device can notify it about any issues by sending a trap message.

You can also configure alerts to detect SNMP trap inactivity—triggering notifications if a monitored node stops sending trap messages over a specified time period.

SNMP traps are received by the SolarWinds Log Manager for Orion Trap Service, which listens for incoming trap messages on UDP port 162, and then decodes, displays, and stores the messages in the Log Analyzer database.

A SolarWinds installation can process approximately 1000 events (syslogs, traps, Windows Events, log files, or VMWare events) per second. See Log Analyzer Scalability in the Scalability Engine Guidelines. You can process more by increasing your hardware requirements over the minimum requirements.

Before you begin

  • Configure devices to send SNMP traps to the IP address assigned to the SolarWinds Platform server. For more information about proper configuration, refer to the documentation supplied by the vendor of your devices.
  • Make sure the UDP port 162 is open for IPv4 and IPv6.
  • When you use SNMPv3 for polling a device and receive traps from it, confirm that the same authentication type (auth, noauth, or priv) is configured for both polling and traps.

View SNMP traps

To view SNMP traps in the SolarWinds Platform Web Console, click Alerts & Activity > Traps.

Monitored traps will open in the Log Viewer.

See View logs and events with the Log Viewer.

Alert on SNMP trap inactivity

You can configure an alert to notify you if a device stops sending SNMP traps for a specific period to ensure that critical devices are communicating with the SolarWinds Platform.

When the Trap Service receives an SNMP trap, it records a UTC timestamp in the LastTrapReceived column for that device. To minimize database load, this timestamp is updated at most once per minute.

Nodes that have never sent a trap will have a NULL value for LastTrapReceived and will not trigger inactivity alerts. This is by design to prevent false alerts for new or non-trap-sending nodes.

Configure an inactivity alert

  1. In the SolarWinds Platform Web Console, click Alerts & Activity > Alerts.
  2. Click Manage Alerts, and then click Add New Alert.
  3. On the Trigger Conditions tab, set I want to alert on to Node.
  4. Set the initial condition to LastTrapReceived is not empty. This ensures the alert only applies to nodes that have previously sent traps.
  5. To define a specific silence threshold (for example, 5 minutes), use a Custom SQL Condition (Advanced): 
    INNER JOIN [SolarWindsOrionLog].[dbo].[OrionLog_LogEntryMessageSource] ON 
    [SolarWindsOrionLog].[dbo].[OrionLog_LogEntryMessageSource].NodeID = [Nodes].NodeID
    WHERE 
    [SolarWindsOrionLog].[dbo].[OrionLog_LogEntryMessageSource].LastTrapReceived IS NOT NULL
    AND [SolarWindsOrionLog].[dbo].[OrionLog_LogEntryMessageSource].LastTrapReceived <= DATEADD(MINUTE, -5, GETUTCDATE())

    Replace -5 with the required silence threshold, in minutes. For example, use -15 for 15 minutes.

    Choose a threshold that is significantly longer than the normal trap interval of the device. The alert might trigger up to one minute before or after the configured threshold, because LastTrapReceived is updated at most once per minute per source and alert conditions are evaluated periodically.

  6. Configure your Trigger Actions (such as Send an Email or Create a ServiceNow Incident).
  7. Complete the wizard and click Submit to save the alert.

 

Learn more