Filter duplicate SNMP traps?

[fishmn]

Any SIM gurus know of a way to setup an event handler that will drop/remove duplicate SNMP traps sent from the same host in window of time? We usually get 4 duplicate traps for most events. It would be nice to only get one.

Thanks for any replies.
Ron

[David Claypool]

The short answer is no, HP SIM doesn't have a built-in method for doing that. It's really better to attack the source and find out why you are getting 4 events for every real event--and is that really happening? Or do they appear to be the same thing on casual reading and could turn out to be more serious on investigation?

[Rob Buxton · Accepted solution]

I'd check the SNMP Traps setting to see that you're not sending the same trap to multiple community names for the same server.

It just needs the one entry for the Traps destination.

[fishmn]

By golly that is what it is.. I've got 4 community strings... shooting myself in thy foot. Thanks for the pointer


1 bcwacomm READ_ONLY
2 bcwapriv READ_CREATE
3 private READ_CREATE
4 public READ_ONLY

[Rancher]

I am getting two event notifications for each item and am now really confused on the SNMP settings! I thought you needed both, a read community name and a read/create community name. I have found that if I don't have both, all of the information does not show in Sims. Should only one of them have the Sims server set as its trap destination? Does the read string only need to point to the local host, or to nowhere? Maybe it just needs to accept packets from the local host with no trap destination set?

[Rob Buxton]

Two different areas of the SNMP settings.
One is the Traps tab, which is the destination used by the agents when they send a trap.

The other is the Security tab where the allowed hosts and the community names are set. This allows HPSIM to access the server via SNMP.