AdvisorAdvisor
We've a Trap server in our environment & all our clients send Traps into it. The problem is that it belongs to our old solution architecture (which we like a lot) but, they'll be shutdown soon.
Our upper management wants to get rid of those & all the VPN tunnels we've from our DCs to our clients infra (which allowed us to send Traps to a single spot).
That's why we're ultimately leveraging a workaround for the stuff we still need to rely on Traps. Never mind, I think we just found a solution.
We'll receive the duplicated Traps on LM, set the ES to clear them every 5 minutes (which really doesn't matter because we're sending them to SNOW & ignoring the CLEAR events there).
This way the alert will have to be cleared manually on SNOW & we're also transforming the Event ID (alert id on LM) to be static (this way we only have 1 alarm on SNOW).
Thanks!
