How to Identify MID Server for SNMP Events and CaptureMID Name in em_event Table

[VUTHUYDANN]

We have implemented an AWS Load Balancer in front of two MID Servers. When the load balancer receives SNMP traps, it forwards each trap to one of the MID Servers, which then processes the trap and inserts the corresponding event into the em_event table in ServiceNow.

In this setup, how can we determine which MID Server processed a given event? Also, is there any way to capture and add the MID Server name to the event payload before the record is inserted into em_event?

[pr8172510]

Hi @VUTHUYDANN,

The em_event table does not store the MID Server name out of the box for SNMP Trap events.

• When multiple MID Servers are behind a Load Balancer, any MID Server can process the incoming trap.
• The MID Server identity is generally available in MID Server logs (agent0.log) but is not persisted on the resulting em_event record.
• There is no OOB field in em_event that identifies the MID Server that processed the trap.

 Approach

• Create a custom field (for example, u_mid_server) on em_event.
• Customize the SNMP Trap processing/Event Rule pipeline to enrich the event payload with the MID Server name before the event is inserted.
• Alternatively, use MID Server logs for troubleshooting and audit purposes.

So, if MID-level traceability is required on the event record itself, a custom enrichment solution is required, as this capability is not available out of the box.

[VUTHUYDANN]

Thanks a lot for the reply.

Can you show me how to or where in ServiceNow to customize the SNMP Trap processingto enrich the event payload with the MID Server name before the event is inserted?

Thanks