Trap Event Editor

Tab 'General'

The General tab enables you to define the basic trap event settings.

1. Select the Enabled check box to enable the trap event. Leave clear to not apply the trap event and to display applicable traps on the Unknown Traps page.

2. Under section General, you can apply the trap event to device groups/device types, or devices.

   1. In field Description, enter description for the trap event.

   2. Click the Device Groups drop-down and select the check box for each device group/device type to trigger the trap event.

   3. Click the Devices drop-down and select the devices to trigger the trap event.

3. Under section Unique OIDs, you can designate unique OIDs to associate to the trap event.

   1. Click to add a row to the table and to add an OID.

      • Click the OID to display the SNMP OID Browser where you select the OID.

      • Click Update to save the OID with the trap event.

4. Under section Actions,

   1. Select the Log check box to display traps on the Logged Traps page. Leave clear to have traps not appear on the Logged Traps page. For an enabled trap event, when you leave this check box clear, traps that meet the trap event criteria do not appear on either the Unknown Traps page or the Logged Traps page.

      Examples

      • For devices that send traps when traffic is denied through a firewall rule, a logged trap enables you to trace the events to a firewall to determine the cause of missed traffic.

      • Frequent but irrelevant traps such as when devices send traps each time a new IP address is leased via DHCP may not be useful.

   2. Select the Alert check box to have the trap trigger an alert.

      • Click the drop-down and select the alert severity to display for the alert. For example, Emergency, Alert, Critical, Error, Warning, Notice, Info, or Debug.

   3. Select the Email check box to enable the following fields.

      • Select the Mail Once check box to send one email when the trap triggers the first occurrence of the trap event. All subsequent occurrences are not emailed.

      • Click the Users drop-down and select the users to receive an email when the trap event triggers.

      • Click the Roles drop-down and select the user roles to receive an email when the trap event triggers.

      • In the Email Addresses field, click to enter the email addresses where an email is to be sent when the trap event triggers.

   4. Click Save As New or Save to save. Click Cancel to cancel the add / edit of the trap event.

Tabs 'Trigger' & 'Clear'

The Trigger / Clear tabs enable you to define the conditions to trigger / clear the trap event and to define the trigger / clear messages respectively.

Under section Match, you can apply the trap event to a specific OID. A match is a logical AND option. The trap primary OID must come from the device group/device type or the device you specify to trigger the trap event. To make the trap event applicable for all device groups/device types and devices do not define Match options.

1. The Trigger OID / Clear OID provides access to the SNMP OID Browser where you select the target OID for the trap event. When you edit a trap event or you access the Trap Event Editor from the Unknown Traps page, this field displays the name of the OID you select. You can enter the OID name in this field if you know the OID name.

2. The Trigger Message / Clear Message field allows you to enter the message to display when this trap event is triggered. For example, Trap received from $dev: $oid -- Bindings: $var -- The number of broadcast packets received in a second from a port is higher than the broadcast threshold.

   1. $dev - to display the source device of the trap (in textual format).

   2. $oid - to display the trigger OID (in textual format).

   3. $oidnum - to display the trigger OID (in numerical format).

   4. $var - to display the Varbinds and respective values (in textual format).

   5. $varnum - to display the Varbinds and respective values (in numerical format).

      When specifying variable OIDs (varbinds), it is helpful to review Unknown Traps. From there you can search for and identify any previous traps that have been received and the variables (varbinds) that were received with the trap.

3. Under section Variable Conditions, you can define the conditions for which a trap event is applicable.

   1. Click to add a row to the table and to define a new variable condition.

      • Click the OID to display the SNMP OID Browser where you select the trap target OID.

      • Click the Op drop-down and select a comparison operator.

      • In the Value field, enter the value that must be met to trigger the trap event.

      • Click Update to save the variable condition.

        Repeat to add additional variable conditions. All variable conditions for a trap event are AND'd together.

4. Under section Webhooks,

   Applies to tab 'Trigger' only

   Select Override Cluster Setting check box to override the setting in Administration > Cluster Manager > tab Cluster Settings > Alerts subtab > field One Webhook per Alert.

   • Only send on first trigger check box is available only when Override Cluster Setting check box is selected. This allows you to override the setting configured cluster-wide. New setting is applied to the selected trap event only. When this check box is selected, it will send webhook only on the first trigger of an alert. However, when unchecked, it will send a webhook for every occurrence of an alert even if an alert already exists for that triggered trap event.

   For traps, you may set field Update Interval from Administration > Cluster Manager > tab Cluster Settings > Trap Collector subtab. By default, Update Interval is set to 300 seconds (i.e., 5 minutes).

   In SevOne-trapd, trap triggering list is loaded every 5 minutes based on the default value set in field Update Interval. When an alert is acknowledged from Events > Alerts, it does not pass through SevOne-trapd; it is now in trap triggering list's cache. If the same alert triggers again within 5 minutes after being manually acknowledged and, Only send on first trigger is enabled, trapd assumes that it is an incremented occurrence and ignores sending the webhook.

   The lower the setting of Administration > Cluster Manager > tab Cluster Settings > Trap Collector subtab > field Update Interval, the lower the likelihood of webhook failing / missed. The setting of field Update Interval can affect trap webhooks.

   1. Click Webhook Definitions drop-down and choose one or more webhook definition ids from the list. If no webhook definition ids are available or you want to create additional webhook definition ids, click icon.

   2. Test Webhook button provides the testing ability for the webhook definition(s) applied to the trap event. You will get a pop-up with the result for the user, including the following details. The notifications can be sent to SevOne NMS application itself.

      • Webhook Definition ID - returns the webhook definition id.

      • Webhook Definition Name - returns the webhook definition name.

      • Ping Result - r eturns the value of ping test fail or success. If success, it proceeds further.

      • Status Code - s tatus code of the webhook request.

      • Response - when a webhook request is executed, it returns a response body.

      • Response Error - if webhook request fails to execute, it returns a response error.

      • Response Header - c ontains all response header values when webhook request has completed.

      • Curl Request - c url request has a curl command for every successful request.

      Click Close to exit.

Scenario# 1

• Select trap event id 25 and click to assign webhook definition ids 4 and 7 to it. Webhook Definition ID 5 is not assigned to trap event id 25.
  

  

• You will get the following pop-up with a list of 3 webhook definitions available.
  

  

  
  

  • The Search field allows you to search from the list of webhook definitions available in the table below.

  • Field Apply To - select Trigger or Clear check box to apply the webhook definition to Trigger or Clear conditions respectively.

  • Select Override Cluster Setting check box to override the setting in Administration > Cluster Manager > tab Cluster Settings > Alerts subtab > field One Webhook per Alert.

    • Only send on first trigger check box is available only when Override Cluster Setting check box is selected. This allows you to override the setting configured cluster-wide. New setting is applied to the selected trap events only. When this check box is selected, it will send webhook only on the first trigger of an alert. However, when unchecked, it will send a webhook for every occurrence of an alert even if an alert already exists for that triggered trap event.

• Select webhook definition ids 4 and 7 to assign to trap event id 25.
  

  

• Click Save and you will get a pop-up.
  

  

  
  

  • Click Ok to overwrite the webhook definitions currently assigned to trap event id 25 with webhook definition ids 4 and 7.

  • Click Review Changes to review the trap webhooks association before overwriting trap event id 25. A pop-up appears.
    

    Since this is the first time webhook definition(s) are being assigned to trap event id 25, there are no Existing Definitions for it.

    Click Done after reviewing the details. If you want to continue with the assignment of the webhook definitions to the trap event(s) selected, click Ok to save or Cancel to exit.
    
    If you clicked the Ok button, you will see that trap event id 25 has icon in column 5 under Flags. This indicates that trap event id 25 now has webhook definition ids 4 and 7 assigned to it.
    

    
    To confirm this, click row with trap event id 25 > in Actions column click . Choose tab Trigger. You will see that webhook definition ids 4 and 7 (Trap using Slack - 4 and Trap for Watson AIOps - 7 respectively) are assigned to trap event id 25.
    
    

    You will see that Trap Event ID 25 has Webhook Definition IDs 4 and 7 assigned to it.

    Webhook Definition ID 5 is available but not used.

    

    If you choose to assign Webhook Definition ID 5 to Trap Event ID 25, select Trap for Data Insight from the drop-down list and click the Save button.

    
    

Scenario# 2

• Select trap event id 63 and click to assign webhook definition ids 5 and 7 to it. Webhook Definition ID 4 is not assigned to trap event id 63.
  

  

• You will get the following pop-up with a list of 3 webhook definitions available.
  

  

  
  

  • The Search field allows you to search from the list of webhook definitions available in the table below.

  • Field Apply To - select Trigger or Clear check box to apply the webhook definition to Trigger or Clear conditions respectively.

  • Select Override Cluster Setting check box to override the setting in Administration > Cluster Manager > tab Cluster Settings > Alerts subtab > field One Webhook per Alert.

    • Only send on first trigger check box is available only when Override Cluster Setting check box is selected. This allows you to override the setting configured cluster-wide. New setting is applied to the selected policies only. When this check box is selected, it will send webhook only on the first trigger of an alert. However, when unchecked, it will send a webhook for every occurrence of an alert even if an alert already exists for that triggered threshold.

• Select webhook definition ids 5 and 7 to assign to trap event id 63.
  

  

• Click Save and you will get a pop-up.
  

  

  
  

  • Click Ok to overwrite the webhook definitions currently assigned to trap event id 63 with webhook definition ids 5 and 7.

  • Click Review Changes to review the policy webhooks association before overwriting trap event id 63. A pop-up appears.
    

    Since this is the first time webhook definition(s) are being assigned to trap event id 63, there are no Existing Definitions for it.

    Click Done after reviewing the details. If you want to continue with the assignment of the webhook definitions to the trap event(s) selected, click Ok to save or Cancel to exit.

    Trap event id 63 already has icon in column 2 under Flags for Grouping Options.

    
    If you clicked the Ok button, in addition to icon, you will also see that trap event id 63 has icon (for webhook definition) in column 5 under Flags. This indicates that trap event id 63 now has webhook definition ids 5 and 7 assigned to it.
    

    
    To confirm this, click row with trap event id 63 > in Actions column click . Choose tab Trigger. You will see that webhook definition ids 5 and 7 (Trap with Data Insight and Trap for Watson AIOps respectively) are assigned to trap event id 63.
    
    

    You will see that Trap Event ID 63 has Webhook Definition IDs 5 and 7 assigned to it.

    Webhook Definition ID 4 is available but not used.

    

    If you choose to assign Webhook Definition ID 4 to Trap Event ID 63, select Trap using Slack from the drop-down list and click the Save button.