SNMP Traps & Syslogs

Kentik's Network Monitoring System (NMS) support of SNMP trap and syslog events is documented in the following topics:

• About SNMP Trap & Syslog
• SNMP Trap & Syslog Setup
• Query Events with Data Explorer
• Create SNMP Trap & Syslog Alerts

Kentik NMS supports SNMP Traps and Syslog Messages, two of the most widely used protocols for real-time network event communication. Ingesting these events into Kentik enables you to set up real-time alerts for things like hardware failures, interface status changes, and critical software log messages. You can also use Kentik’s Data Explorer to query this event data for troubleshooting or investigating unusual server logs.

With SNMP traps and syslog ingestion, you can centralize and correlate even more telemetry within Kentik’s Network Intelligence platform.

SNMP traps are events immediately pushed by SNMP-enabled devices when specific conditions occur, bypassing both SNMP polling and Streaming Telemetry data collection intervals.

With Kentik’s SNMP trap integration, you can:

• Receive SNMP traps from routers, switches, firewalls, and servers
• Filter and search trap events by name and OID
• Create alerts and notification policies based on SNMP traps
• Visualize trap events with other telemetry for contextually broader analysis

Syslog messages capture detailed system-level events across a wide range of devices.

Kentik’s syslog integration enables you to:

• Collect syslog events from routers, switches, firewalls, and servers
• Filter and search syslog events by name, severity, and message content
• Create alerts and notification policies based on syslog messages
• Visualize syslog events with other telemetry for contextually broader analysis

The steps for setting up SNMP trap and syslog for both existing and new NMS customers are as follows:

Follow these steps to set up SNMP trap and syslog:

1. Install and Enable Capabilities:
   - Navigate to Settings » Universal Agents from the main nav menu.
   - Click the pencil icon to open the Agent Details drawer.
   - Proceed to the next screen by clicking Cancel.
   - Under Capabilities » Available, click Install for SNMP Trap Receiver and/or Syslog Server.
   - Enable each capability under Capabilities » Installed by clicking the switch ON (turns blue).
   - Repeat for additional agents.
2. Configure Devices:
   - Direct devices to send traps and syslogs to the configured Universal Agent(s).

Notes:
- SNMP trap and syslog ingestion require messages to come from a licensed NMS device.
- When using a syslog forwarder, spoof the original device IPs in the forwarded logs to associate logs with their originating devices.
- To change the TCP/UDP port numbers for SNMP trap and syslog ingestion, contact support. UI functionality will be added in the future.
- Use the filter sidebar to show agents with SNMP Trap Receiver and/or Syslog Server capabilities enabled.
- For more on working with Universal Agents, see Universal Agents.

Follow these steps to set up SNMP trap and syslog:

1. Complete the steps in NMS Setup.
2. Follow Existing Kentik NMS Customers steps to install and enable the SNMP Trap Receiver and/or Syslog Server capabilities.

Kentik supports querying SNMP trap and syslog metrics and dimensions in Data Explorer.

Note: For complete lists of the related dimensions, see SNMP Traps Dimensions and Syslog Dimensions.

Steps to Query SNMP Trap and Syslog Events:

1. Navigate to Core » Data Explorer from the main nav menu.
2. In the Metrics pane of the Query drawer, select SNMP Traps: Events or Syslog: Events from the dropdown.
3. To optionally add dimensions:
   - Click Edit Dimensions in the Dimensions pane.
   - Use the search field to filter dimensions by “traps "or “syslog”, for example.
   - Select dimensions and click Save to display the query results table.

Take your Data Explorer query for SNMP trap or syslog events further by creating a new alert policy directly from the query context.

1. After running your query, click Actions » Create Alert Policy.
2. Click Continue on the confirmation dialog to access the Add NMS Alert Policy page.
3. Follow the steps in Create SNMP Trap & Syslog Alerts to finalize the new policy.

Note: For more, see Add a Query-based Policy.

In addition to the ability to Create Alert Policy from Query, you can also create SNMP trap and syslog alert policies from scratch.

1. Navigate to Settings » Alert Policies and click Add Alert Policy.
2. In the dialog, select NMS and click Continue.
3. Enter a Name, optional Description, and set the policy On/Off. Click the right arrow to proceed.
4. Choose Event from the Policy Type dropdown.
5. Select Syslog or SNMP Trap under Event Type. Optionally, edit Dimensions or Filters, then click the right arrow to proceed.
6. Choose a Severity level for alerts generated from this policy.
7. Click + Add Condition Group under Alert Conditions.
8. Set Dimension, Operator, and Values (e.g., "Trap Type", "is", "ciscoConfigManEvent").
9. Set Acknowledgement Required to On or leave as Off.
10. Select or add a Notification Channel.
11. Click Create to finalize the alert policy and return to the Alert Policies list.

Notes:
- Event type alerts require manual clearing.
- For more details, see Alert Policies.