SNMP trap processing

SNMP traps are generated whenever an event occurs within a network device, including network and hardware issues. Site24x7 processes SNMP trap messages to detect issues quickly and sends notifications to administrators for faster troubleshooting and resolution.

What are SNMP traps?

An SNMP trap is an event message sent by a network device to a network management system (NMS) whenever a change of state or an anomaly is detected. An NMS like Site24x7 receives the event messages, or traps, generated by these devices, processes them, displays them in a list view, and sends you a notification based on the thresholds configured for each trap.

SNMP v1 traps

Basic SNMP v1 traps fall into two broad categories: generic and enterprise traps.

There are six types of generic traps:

• coldStart: The sending entity has been reinitialized with a configuration change. In simple terms, the SNMP device has powered on.
• warmStart: Similar to coldStart, but the device configuration remains unaltered because the device is already on. In other words, the SNMP device has reloaded the software.
• linkUp: One of the connected interfaces has changed its state from Down to Up.
• linkDown: One of the connected interfaces has changed its state from Up to Down.
• authenticationFailure: An SNMP agent received a request from an unrecognized community name.
• egpNeighborLoss: The agent cannot communicate with its Exterior Gateway Protocol (EGP) peer.
• enterpriseSpecific: The agent sends vendor-specific error conditions or codes that apply only to the device or manufacturer.

SNMP v2c/v3 traps

SNMP v2c/v3 traps are classified based on trap object identifiers (OIDs), as defined in the vendor's management information base (MIB). Trap OIDs are object identifiers that specify the type of trap being received.

Configuring SNMP traps

Before Site24x7 can receive traps, you must configure your network device to send SNMP traps to Site24x7. Specify the IP address of the On-Premise Poller and port 162 for traps to be received over the User Datagram Protocol (UDP). Ensure that this port is free and unblocked in your firewall settings at both the device and organization level.

Navigating to SNMP Traps

In Site24x7, the SNMP Traps section is accessible from the left navigation menu. It contains five subsections:

Viewing SNMP traps

To view all SNMP traps:

1. Log in to your Site24x7 account.
2. Navigate to Network > SNMP Traps.

Recent Traps view

The Recent Traps view is the default landing page of the SNMP Traps section. It shows a status summary bar at the top, followed by a list of trap events received. When no traps have been received yet, a setup guide is shown to help you get started.

Status summary bar

The status bar at the top of the Recent Traps view shows the following counters:

Setting up trap processing (first-time setup)

Follow these steps if you have not yet set up trap processing.

Step 1: Enable the trap module (one-time setup)

After adding an On-Premise Poller, you must enable the trap module before traps can be received. To do this:

1. Navigate to Network > SNMP Traps > Trap Settings.
2. In the Settings field, select On-Premise Poller.
3. Select the required On-Premise Poller, then toggle the Trap module status field to Enable.
4. Provide inputs for the Port field.
5. In the Device status section, ensure the device appears under Enabled Device(s). If it appears under Disabled Device(s), select it, then click the right arrow icon → between the two columns. This will move the device to Enabled Device(s).
6. Select an MIB file in the MIB-based OID Translations field, then click Update.

Step 2: Associate an existing trap processor

To associate an existing trap processor with multiple devices:

1. Navigate to Network > SNMP Traps > Trap Settings.
2. Select Trap Processor in the Settings field.
3. Choose the trap processor you want to update.
4. In the Bulk Action field, select Add from the drop-down menu.
5. Add filters if needed in the Filter field.
6. Select the monitors from the Select Monitors list, then click Update.

To associate multiple trap processors with a single device:

1. Navigate to Network > Network Devices.
2. Click the device name to open the device details page.
3. Click the Traps tab.
4. Click Add Traps.
5. Select the trap processors you want to associate with the device. You can select multiple trap processors at once.
6. Click Save.

Step 3: Add a custom trap processor

To add a new custom trap processor:

1. Navigate to Network > SNMP Traps > Trap Processors.
2. Click Add Trap Processor.
3. Complete the form and click Save.
4. Next, click the Associate icon in the Action column to associate the processor with the relevant devices.

For detailed instructions, see Adding trap processors.

Acknowledging traps

Configured trap processors are listed in the Recent Traps view based on their current status: Down, Critical, Trouble, or Up. This allows you to quickly see the count of total and active trap processors.

To acknowledge a trap:

1. Navigate to Network > SNMP Traps.
2. Select a trap to view its details, such as the time of receipt and message.
3. Click the thumbs-up icon to acknowledge the trap.
   For example, if a LinkDown(v2c) trap is in the Trouble state, it affects the device status. Since this trap cannot be resolved automatically, you must manually acknowledge it. After acknowledgment, the device status changes to Up if this was the only trap causing the issue.
   Figure 1. The Recent Traps view.

All Trap Events view

The All Trap Events view provides a chronological log of all trap events received from your network devices. Unlike the Recent Traps view, which shows the current status of trap processors, this view lets you browse, filter, and analyze historical trap data over a selected time range.

Key features

• Date range selector: Filter trap events by time range (for example, Last 24 Hours, Last 7 Days, or a custom period).
• Alerts: Create or view trap-triggered alert events in a list format.
• Upload: Upload log data related to traps.
• Log Templates: Manage log templates used to parse and display trap event data.

To navigate to All Trap Events:

1. Navigate to Network > SNMP Traps.
2. Click the All Trap Events tab.

Trap Processors view

Trap processors process the raw SNMP traps sent by network devices and display them as simple, readable messages. The Trap Processors view lists all natively supported and custom-configured traps. From this view, you can add new trap processors as well as edit, associate, or delete existing ones.

Viewing trap processors

To access the Trap Processors view, navigate to Network > SNMP Traps > Trap Processors.

Figure 2. The Trap Processors view.

The Trap Processors table includes the following columns:

Viewing trap processor details

Click a trap processor row to view its details in a side panel. The following fields are displayed:

Figure 3. After clicking a trap processor.

Adding trap processors

You can create and configure trap processors from the Trap Processors view. Site24x7 provides two ways to add a trap processor: using the MIB Browser or by entering the trap details manually.

To add a trap processor:

1. Navigate to Network > SNMP Traps > Trap Processors.
2. Click Add Trap Processor. The Add Trap Processor form opens.
3. In the MIB Browser section, select how you want to import the trap:
   • Generic MIBs: Available by default in Site24x7. Select the Vendor and MIB from the drop-down menus to prepopulate the trap details.
     
     Figure 4. Adding trap processors with generic MIBs.
   • Custom MIBs: Upload MIBs from your system. Select the On-Premise Poller that stores the MIB files, then select the MIB from the drop-down menu or click the plus icon + to upload a new one. In the Upload MIB screen, select the file, choose the On-Premise Poller where the file will be saved, authorize Site24x7 to store it, and click Upload. Ensure the MIB file size is under 1MB.
     
     Figure 5. Upload MIB screen.
4. Enter the following details:
   • Trap Processor Name: Enter a unique name to identify the trap processor.
   • Description: Enter a description that explains the purpose of this trap processor.
   • SNMP Version: Select the SNMP version used by the device: v1 or v2c/v3.
   • Trap OID: The OID for the selected trap is displayed here. You can edit it if required. If you select v2c/v3 as the SNMP version, you can add multiple trap OIDs in a single trap processor by clicking the plus icon +.
   • Generic Type: For SNMP v1, select the generic trap type from the drop-down list. The available options are: coldStart(0), warmStart(1), linkDown(2), linkUp(3), authenticationFailure(4), egpNeighborLoss(5), enterpriseSpecific(6).
   • Specific Type: Visible when you select enterpriseSpecific(6) as the Generic Type. Enter the device manufacturer's custom trap type.
   • Source: Select the IP source from which Site24x7 receives traps. Choose $Source when the trap is sent directly to the On-Premise Poller or $Agent when the trap is forwarded from another source.
   • Severity: Select the severity level for this trap: Clear, Trouble, Critical, or Down. If you select Trouble, Critical, or Down, you must also configure the threshold and rearm criteria.
   • Failure Component: Use this field if a single trap OID has multiple failure components. Append the VarBind number to generate separate alarms for each failed component. For example: $Source_trapName_trap_$v5.
   • Auto Acknowledge: Enable this option to automatically acknowledge alarms generated by this trap. When enabled, the alarm closes automatically without requiring manual intervention.
   • Custom Trap Message: Override the default trap message with custom content. Use @0 and @1 as placeholders for VarBind keys and $0 and $1 for their corresponding values. For example, @2 is $2 displays as sensorName is 75°C.
   • Replace Monitor Alert Reason: Enable this option to replace the monitor's alert reason with the custom trap message whenever this trap is triggered.
   • Associate with All Devices: Enable this option to associate the trap processor with all currently monitored devices and any devices added in the future.
   • Repeat Alerts: Enable this option to resend alert notifications at regular intervals while the trap condition persists. This is useful for ensuring that ongoing issues are not overlooked if the initial alert is missed.
   • Daily Limit: The maximum number of traps that Site24x7 processes per day. The default limit is 500 traps. To increase this limit, contact support@site24x7.com.
5. Click Save to save the trap processor, or click Reset to clear the form.

Threshold and rearm criteria

When you set the severity level to Trouble, Critical, or Down, you must configure the threshold and rearm criteria. These define the conditions under which Site24x7 generates an alarm and when it considers the monitor to have recovered.

Figure 6. Setting threshold criteria and rearm criteria while adding trap processors.

Threshold Criteria

Threshold criteria define the conditions that trigger an alarm. In the Threshold Criteria field, you can set multiple conditions and choose whether all or any of the conditions must be met:

• All the Conditions: An alarm is triggered only when all configured conditions are satisfied simultaneously.
• Any of the Conditions: An alarm is triggered when any one of the configured conditions is satisfied.

Each condition is defined by the following attributes:

Rearm Criteria

Rearm criteria define the conditions that determine when a monitor has returned to a normal state. When the rearm condition is satisfied, the monitor status changes from Trouble or Down back to Clear.

Example: If the threshold condition is >65, an alarm triggers when the value reaches 70. Without a rearm value, any subsequent drop below 65 also triggers an alert. If you set a rearm value of 50, you receive a recovery alert only when the value drops below 50, reducing unnecessary notifications.

The Rearm Criteria field uses the same configuration options as Threshold Criteria. This includes Varbind, Condition, and Value options; All the Conditions or Any of the Conditions logic; and AND or OR operators.

Unsolicited Traps

An unsolicited trap is any SNMP trap received by Site24x7 for which no trap processor has been configured or associated with the sending device. These traps are automatically captured and displayed in the Unsolicited Traps view.

Viewing unsolicited traps

To view unsolicited traps:

1. Navigate to Network > SNMP Traps > Unsolicited Traps.
2. Select an On-Premise Poller from the Choose an installed On-Premise Poller drop-down menu. The list of unsolicited traps received by that On-Premise Poller is displayed.
   
   Figure 7. The Unsolicited Traps view.

Adding an unsolicited trap as a trap processor

You can promote an unsolicited trap into a fully configured trap processor directly from the Unsolicited Traps view.

To add an unsolicited trap:

1. Navigate to Network > SNMP Traps > Unsolicited Traps.
2. Select the On-Premise Poller that received the trap.
3. Click the plus icon + next to the trap you want to configure. The Add Trap Processor form opens with the OID prepopulated.
   
   Figure 8. Adding an unsolicited trap.
4. Complete the remaining fields as described in Adding trap processors.
5. Click Save.

After adding the trap processor, you can view the data in the Recent Traps view and the Trap Processors view.

Trap Settings page

The Trap Settings page gives you granular control over SNMP trap management for your network devices. While Site24x7 automatically associates all trap processors with every network monitor you add, you can use this page to customize trap handling. For example, you can disable trap monitoring for specific devices, restrict certain traps to critical devices only, or enable or disable the trap module for specific On-Premise Pollers.

Editing Trap Settings

To edit Trap Settings:

1. Navigate to Network > SNMP Traps.
2. Click the Trap Settings tab.
3. In the Settings field, select Trap Processor or On-Premise Poller:
   • Trap Processor: Associates or disassociates a specific trap processor with devices.
   • On-Premise Poller: Enables or disables trap processing for devices managed by a specific On-Premise Poller. Can be optionally filtered by device category or template.

Trap Processor settings

If you select Trap Processor in the Settings field, specify the following:

• Trap Processor: Select the trap processor to associate or disassociate with devices.
• Bulk Action: Select an action:
  • Activate: Resumes trap processing on associated devices. No devices are shown if no traps are suspended.
  • Suspend: Temporarily pauses trap processing for the selected devices.
  • Add: Associates the processor with the selected devices and activates it.
  • Delete: Removes the association and stops trap processing for the selected devices.
• Filter: Filter devices by On-Premise Poller, Display Name, HostName, IP Address, Category, or Template Name.
• Select Monitors: Select the devices to apply the bulk action to. If no devices are listed, the selected action is not applicable to any currently monitored device.

On-Premise Poller settings

If you select On-Premise Poller in the Settings field, specify the following:

• Choose an On-Premise Poller: Select the On-Premise Poller from the drop-down menu.
• Status: Shows whether the trap module is currently enabled or disabled for the selected poller. Toggle between Enable and Disable to turn the trap module on or off.
• Port: Enter the UDP port on which traps are received. The default value is 162.
• Filter: Filter devices by On-Premise Poller, Display Name, HostName, IP Address, Category, or Template Name.
• Devices (Category, Template, Device list): Select a device Category and Template to filter the device list. Use the left arrow icon ← and right arrow icon → to move devices between the Unassociated Device(s) pane (left) and the Associated Device(s) pane (right). Devices in the Associated Device(s) pane are enabled for trap processing.

Click Update to save your changes.

Editing and deleting trap processors

All configured trap processors are listed in the Trap Processors view. You can manage them using the icons in the Action column:

Action	Icon	Description
Edit	Pencil icon	Opens the Edit Trap Processor form. You can modify all fields except the Trap Processor Name.
Associate	Associate icon	Opens the Associate view, where you can add or remove device associations and perform bulk actions (Activate, Suspend, Add, Delete).
Delete	Trash icon	Permanently deletes the trap processor after confirmation.

Figure 9. Editing a trap processor.

Figure 10. Associating a trap processor.

Device-wise traps

You can view and manage traps for a specific network device from within the device details page. This view shows only the traps associated with that device.

Viewing device-wise traps

To view device-specific traps:

1. Navigate to Network > Network Devices.
2. Click the device name to open the device details page.
3. Click the Traps tab. The following information is displayed for each trap:

   Column	Description
   Status	The current status of the trap (Up, Trouble, Critical, or Down).
   Message	The trap message received from the device.
   Last Received At	The date and time when the trap was last received.
   Trap Name	The name of the trap processor associated with this trap.
   Action	Options to edit threshold conditions for the trap.

   
   Figure 11. Device-specific traps.

Filtering device traps

The Traps tab provides two filter tabs to manage the display:

• Active: Shows only the traps that are currently active for this device.
• Suspended: Shows only the traps that have been suspended for this device.

Managing device traps

In the top-right corner of the Traps table, the following buttons are available:

To edit threshold conditions for a specific trap on a device:

1. Navigate to the Traps tab for the device.
2. Click the hamburger icon in the Action column for the trap you want to edit.
3. Modify the threshold conditions as needed. The same Varbind, Condition, and Value attributes described in Threshold and rearm criteria apply here.
   
   Figure 12. Setting threshold conditions.
4. Click Save to save your changes.

Related articles

• Configuring a network device to send SNMP traps
• How to use the MIB Browser
• Testing if the On-Premise Poller is receiving traps
• Custom SNMP monitoring
• Trap Settings