SNMP events from the same node showing different Source values in Event Management

[PVSB]

Hi all,

We are currently testing SNMP trap integration in **ServiceNow Event Management for a Cisco MDS switch. While testing, we observed that events from the same node (same IP address/device) are being received with different Source values.

Examples of Source values we are seeing for events coming from the same device:

• SNMPv2 Generic Trap
• Trap From Enterprise 9
• iso.org.dod.internet.experimental.fcmgmt.0.6

Even though the node/IP address is the same, the Source field varies across the events.

Configuration / Steps performed

• Created SNMPv2 credentials in ServiceNow.
• Configured SNMP Trap listener using the MID Server.

Observation

For the same node, multiple events are generated but the Source field differs depending on the trap received.

link : Events | ServiceNow

Thanks and Regards
P V S Bhoomika

[amit_bt]

In ServiceNow Event Management, the Source field for SNMP traps is typically populated by the SNMP OID or the Trap Type defined in the trap PDU, rather than the device name or IP.

Here is why you are seeing those specific values:

SNMPv2 Generic Trap: This appears when the trap is a standard generic trap (like a linkUp/linkDown) defined in the basic SNMP protocol.
Trap From Enterprise 9: "9" is the IANA enterprise number for Cisco. ServiceNow defaults to this label when it recognizes the enterprise ID but doesn't have a specific mapping for the sub-identifier.

iso.org.dod...: This is the literal translation of the OID path. This happens when the MID Server receives a trap for which it doesn't have a loaded MIB file to resolve the OID into a human-readable name.

How to standardize the Source

If you want these events to share the same Source for easier correlation or filtering, you have two main options:

Event Rules (Recommended): Create an Event Rule for this specific Node/IP. Use the Transform tab to hardcode the "Source" field to a single value (e.g., "Cisco MDS") regardless of what the trap sends.

Load MIBs: Upload the relevant Cisco MDS MIBs to your ServiceNow instance. This won't make the sources identical, but it will turn the "iso.org.dod..." strings into readable names like fcOTis2Notifications.