SNMP Trap Receiver Monitoring

Simple Network Management Protocol (SNMP) traps are a type of message network devices can send to a central monitoring device to signal an issue or event.

SNMP traps can be considered a type of log message. They typically contain information like:

• Event time and severity level
• Event OID and source agent
• Event message

An SNMP trap can be used to quickly gain insight into issues network devices may be experiencing. This speed is enabled by SNMP traps being sent by agents across a network as soon as issues arise, as opposed to waiting on a central management tool to poll their status. With SNMP, a wide variety of events can trigger a trap—and consequently, an alert or action.

SNMP traps inform a central SNMP receiver of whatever issue the device is currently experiencing. When an event (like a failure or error) occurs on the device, a message is sent from the device to the central manager. The manager decodes and analyzes the message, then can trigger alerts or actions or display key information for admins.

There are two ways SNMP traps can ensure the right data is communicated to the manager:

1. Data within traps. Alert data can be included within the traps. In this case, all traps have the same object identifier (OID) and the managing device must be able to process the information within the trap.
2. Granular traps. In this case, traps have their own OIDs, so the SNMP manager can easily identify what kind of message the trap is sending. The management information base (MIB) stores the translation of each OID, so the manager can simply refer to the MIB to understand the trap message. The actual trap doesn’t have to carry alert information, which minimizes bandwidth usage.

Traps are an efficient method for tracking errors and events because the SNMP client doesn’t have to poll each device—the network device automatically sends a notification of a problem. Tracking SNMP traps can especially benefit those monitoring a large number of devices, since it can be impractical to poll each device individually.

Another advantage of using SNMP traps is they can immediately trigger actions in response to events—the device doesn’t have to wait for a status request. Traps can also trigger responses through the trap receiver. Trap receivers can send alerts, trigger external actions, display data in the dashboard. This means admins quickly gain insight into issues that may require troubleshooting.

Trap receivers are designed to decode trap messages and display this information in a dashboard. The receiver either decodes the data it contains or compares its OID to the MIB to identify the issue, generate alerts, perform trigger actions, and can send the traps to other monitoring and management tools or log traps for later reference.

While SNMP-enabled devices can send traps to any device that has previously sent an SNMP request, this doesn’t ensure the traps are read. Not all SNMP trap monitoring tools can read or address traps, which is why using software designed to monitor SNMP traps can play an important role in effectively handling traps from across your network.

Monitoring SNMP traps can help provide performance insight into your network devices. If a network device or critical system goes down, it’s important to respond to and troubleshoot the issue as quickly as possible. This requires instant awareness of issues that SNMP traps can help provide.

The SolarWinds SNMP trap service listens for incoming traps by using UDP port 162 and works for IPv4 or IPv6. It then translates and archives the trap message while making it visible on the easy-to-use dashboard. It can handle high numbers of simultaneous traps—about 500 per second. Once received, SNMP traps are stored within the Orion database in the Traps and TrapVarBinds tables.

Log Analyzer is built to collect, consolidate, and help you quickly analyze thousands of syslog, traps, Windows, and VMware events, so you can more easily perform root-cause analysis by filtering trap messages according to specific conditions fitting your troubleshooting needs.