How can we change the text sent when an SNMP trap is cleared? We want to send the text Cleared to let our SNMP system know that the trap has been cleared.
By default when a condition like one of the following is used in an event-driven rule, the message text sent by an SNMP action under the rule is the same when the trap is originally triggered and when it is cleared.
Condition using rule name:
@event_foglight_rule_name == "CPU Utilization"Condition using rule ID:
@event_foglight_rule_id == "c83632ae-3468-4ac1-bd69-523595e18750"It is possible to modify the text when the SNMP trap is cleared by changing the alarm message parameter in the SNMP Trap action configuration of the event-driven rule.
It would be possible to have a custom rule to modify the message only on "Clear" events.
The following condition can be used to send traps on "Clear" events for the specified rule name:
(@event_foglight_rule_name == "CPU Utilization") && (@event.getInt("change/value") == 1)
The following condition can be used to send traps on "Clear" events for the specified rule Id.:
(@event_foglight_rule_id == "c83632ae-3468-4ac1-bd69-523595e18750") && (@event.getInt("change/value") == 1)In the trap action parameters, set "AlarmMessageValue" to "Cleared".
The "snmpTrapOID" value in the trap message can be used to differentiate between "Clear" and "Fire" / "Acknowledge" alarm events.
Depending on the SNMP trap version, the message may include "Specific Trap" value of "60" for "Clear" alarm events and "70" for "Fire" and "Acknowledge" events.
Another option would be to include the event change type name "@event.get("change/name")" as a customized value in the trap action; for more information refer to Support for customized values in Foglight trap actions (4228912).