UPS SNMP Events Not Triggering Incident Flow – Severity Missing / Event Rule Not Firing

[markdeloy]

Hi everyone,

I’m working on an Event Management setup where SNMP traps from APC UPS devices are being ingested into ServiceNow via the MID Server. The goal is to automatically create incidents when certain UPS alarms (like “Low Battery,” “On Battery,” etc.) are received.

Here’s what’s happening:

• The traps appear to reach the MID Server (I can see activity in the logs), but no events are being created, or the events that do get created are missing the Severity field.

• Because of that, my Event Rule (“Create Incident from Alert” subflow) never fires — the rule conditions depend on severity (e.g., Severity 2–4).

• I’ve already verified that my Alert Rule and Subflow are active and working when manually tested.

Here’s what I’ve checked so far:

• The UPS SNMP trap source is configured under Event Sources.

• My Event Field Mapping includes severity, node, type, and description.

• MID Server is up, validated, and listening on the correct UDP port.

• No errors in agent0.log.

• I’ve tried using default OIDs from the APC MIB to test.

---

Questions:

1. What’s the best way to confirm whether the SNMP trap is being parsed correctly and mapped into the Event table?

2. If the trap doesn’t include a severity, can I set a default severity in the Transform Map or Field Mapping script (and if so, where’s the best place to do that)?

3. Is there a way to debug pattern-based or SNMP-based Event inputs before they reach the Event table?

---

Environment:

• ServiceNow: Zürich release

• MID Server: Windows 2019

• Event Management: Standard setup with custom SNMP trap listener

• Goal: UPS alerts create incidents automatically

Any insights or examples (especially if someone’s done UPS or APC SNMP integrations before) would be greatly appreciated!

Thanks,
Mark