Trap Event Editor

Trap Event List Filters

Filters enable you to limit the trap events that appear in the list. All filters are optional and cumulative.

• In the ID field, enter an internal trap event identifier to display a specific trap event.

• Click the OID to display the SNMP OID Browser where you can select the target OID. You can enter the name of the target OID to display trap events for a specific OID.

• Click the Log drop-down.

  • Select No Filter Specified to display all trap events.

  • Select Yes to display trap events that display applicable traps on the Logged Traps page.

  • Select No to display trap events that do not display applicable traps on the Logged Traps page.

• Click the Alert drop-down.

  • Select No Filter Specified to display all trap events.

  • Select Yes to display trap events that trigger an alert to appear on the Alerts page. If you select Yes, you can click the corresponding drop-down and select an alert severity to further filter the trap event list.

  • Select No to display trap events that do not trigger an alert to appear on the Alerts page.

• In the Message field, enter a portion of the trap event message to display trap events that contain the string you enter in the message.

• In the Flags section, select each check box to display traps that are flagged to be emailed, grouped, and/or contain variable bindings.

• Click Apply Filter to display the trap events that meet your filter criteria.

Trap Event List

Each trap has a primary OID that designates the trap type. Each trap event has a target OID. When the trap primary OID matches the trap event target OID and any trap event variable conditions you define, the trap triggers the trap event. The list of trap events displays the following information.

• Flags - can display the following flags.

- Trap event triggers an email.

- Trap event applies to specific device groups/device types.

- Trap has variable conditions.

• ID – Displays the internal identifier for the trap event which is helpful for API workflows.

• OID - Displays the resolved name of the trap event target OID.

• Log - Displays Yes when you define the trap event to display the trap on the Logged Traps page or displays No when the trap does not appear on the Logged Traps page.

• Alert - Displays the severity level for the alerts the trap triggers when you define the trap event to trigger an alert or displays No when you define the trap event to not trigger an alert.

• Message - Displays the message you define for the trap to display.

• Enabled – Displays Yes when the trap event is enabled or displays No when the trap event is disabled.

Manage Trap Events

Perform the following steps to manage trap events.

1. Click Add Trap Event, click , or (from the Unknown Traps page) select an unknown trap and click Configure Trap Event to display the Add/Edit Trap Event pop-up.

2. Select the Enabled check box to enable the trap event. Leave clear to not apply the trap event and to display applicable traps on the Unknown Traps page.

3. The Match options enable you to apply the trap event to a specific OID, device groups/device types, or devices. A match is a logical AND option. The trap primary OID must come from the device group/device type or the device you specify to trigger the trap event. To make the trap event applicable for all device groups/device types and devices do not define Match options.

   • The Target OID provides access to the SNMP OID Browser where you select the target OID for the trap event. When you edit a trap event or you access the Trap Event Editor from the Unknown Traps page, this field displays the name of the OID you select. You can enter the OID name in this field if you know the OID name.

   • Click the Device Groups drop-down and select the check box for each device group/device type to trigger the trap event.

   • Click the Devices drop-down and select the devices to trigger the trap event.

4. The Variable Conditions field enables you to define the conditions for which a trap event is applicable.

   1. Click Add to add a row to the table and to define a new variable condition.

   2. Click the OID to display the SNMP OID Browser where you select the trap target OID.

   3. Click the Op drop-down and select a comparison operator.

   4. In the Value field, enter the value that must be met to trigger the trap event.

   5. Click Update to save the variable condition.

   6. Repeat to add additional variable conditions. All variable conditions for a trap event are AND'd together.

5. The Unique OIDs field enables you to designate unique OIDs to associate to the trap event.

   1. Click Add to add a row to the table and to add an OID.

   2. Click the OID to display the SNMP OID Browser where you select the OID.

   3. Click Update to save the OID with the trap event.

6. Select the Log check box to display traps on the Logged Traps page. Leave clear to have traps not appear on the Logged Traps page. For an enabled trap event, when you leave this check box clear, traps that meet the trap event criteria do not appear on either the Unknown Traps page or the Logged Traps page.

   Examples:

   • For devices that send traps when traffic is denied through a firewall rule, a logged trap enables you to trace the events to a firewall to determine the cause of missed traffic.

   • Frequent but irrelevant traps such as when devices send traps each time a new IP address is leased via DHCP may not be useful.

7. Select the Alert check box to have the trap trigger an alert.

   1. Click the drop-down and select the alert severity to display for the alert.

   2. In the text field, enter the message to appear for the trap when the trap event triggers. The message can contain the following variables. This field contains a default message. Hover over the message to display a legend containing information about the available variables. You can change this message or replace it with new text to suit your specific needs.

   • $dev - To display the name of the device that the trap came from.

   • $oid - To display the trap target OID in name format.

   • $oidnum - To display the trap target OID in number format.

   • $var - To display the variable condition for the trap in name format.

   • $varnum - To display the variable condition for the trap in number format.

   • $n - Where n is an integer representing a variable binding, or varbind, to display the varbind received in the trap. For example, $1 would display the first varbind. $2 would display the second varbind, and $3, the third, etc.

   • ${numericOID} - To display the value of the varbind represented by the numeric OID that you specify. Replace numericOID with the full numeric representation of the OID, including the leading dot, for example: ${.1.3.6.1.4.1.4055.1.2.1}.

   • ${alphaOID} - To display the value of the varbind represented by the alphanumeric OID that you specify. Replace alphaOID with the name of the object identifier that represents the value, for example: ${ifName} . Note that the appropriate MIB must be loaded on the SevOne appliance for a varbind to be represented by an alphanumeric name as opposed to a numeric OID.

     When specifying variable OIDs (varbinds), it is helpful to review Unknown Traps. From there you can search for and identify any previous traps that have been received and the variables (varbinds) that were received with the trap.

8. Select the Email check box to enable the following fields.

   • Select the Mail Once check box to send one email when the trap triggers the first occurrence of the trap event. All subsequent occurrences are not emailed.

   • Click the Users drop-down and select the users to receive an email when the trap event triggers.

   • Click the Roles drop-down and select the user roles to receive an email when the trap event triggers.

   • In the Email Addresses field, click Add to enter the email addresses where an email is to be sent when the trap event triggers.

9. Click Save.