Forum Discussion

JaM's avatar
JaM
4 years ago

Can I format alert message from a SNMP trap?

We're trying to setup an alert from a SNMP trap.  The alert will send SMS and Voice Call.  You can imagine how it sounds to get a voice call with all the unformatted output below.

The ##VALUE## of the output is as follows:

1.3.6.1.4.1.1214.1.10: Schedule 1.3.6.1.4.1.1214.1.11: sysops 1.3.6.1.4.1.1214.1.12: ENAW-TID 1.3.6.1.4.1.1214.1.13: ENAW-ETL03P 1.3.6.1.4.1.1214.1.3: 1 1.3.6.1.4.1.1214.1.4: 1 1.3.6.1.4.1.1214.1.5: Critical Alert 04-01-2021 ETL03p SNMP TEST Job #2 The system cannot find the path specified. 1.3.6.1.4.1.1214.1.6: 2195603 1.3.6.1.4.1.1214.1.7: ETL03p SNMP TEST Job #2 1.3.6.1.4.1.1214.1.8: 11 1.3.6.1.4.1.1214.1.9: 3 enterpriseOid: 1.3.6.1.4.1.1214 generalCode: 6 snmpVersion: v1 specificCode: 1 sysUpTime: 1511109 trapVariableBindingCount: 11

 

Would there be a way to format the ##VALUE## or use a different token so that the alert only shows information under trap OID 1.3.6.1.4.1.1214.1.5?  So the value would look more like "Critical Alert 04-01-2021 ETL03p SNMP TEST Job #2 The system cannot find the path specified"

Hope yall can help, thanks for your time!

  • mnagel's avatar
    mnagel
    Icon for Professor rankProfessor
    4 years ago

    What you want is a dynamic template processor, but all we have is simple token substitution and no indication that will ever change (I have asked repeatedly for years).  You can route alerts to an external integration, which is how we handle transformation of tokens, but you lose some stuff when you do that depending on how you integrate.  For example, we use external email integration into our ticket system with a filter that handles the transformation, but custom email integrations do not get the same handling as builtin email for certain things (e.g., you do not get ACK or SDT notices).

  • Anonymous's avatar
    Anonymous
    4 years ago

    @mnagel is right. You can't post-process the ##value## token. However, you can specify the overall event message by editing it at the EventSource level. Doesn't really address your issue, which is a common ask.