Some SNMP Traps are not being received by ServiceNow

[Lorenzo10]

Hello Community,

We are facing a problem in which we have been struggling for the past few weeks. Hope you can help us because this is having a critical impact on our instance.

We have configured different SNMP Trap Collectors that are continuously sending traps, some of them send to our preproduction and production instances, and others only to our production instance. 

The problem is that we are losing traps. We know this because some of the sent traps are not being received in our production instance, so the events are not created in ServiceNow. I have already checked the mid server logs by setting the property "mid.log.level" to debug but I could not find any register or evidence related to these lost traps, nor any "Authentication failure" warning. 

Moreover, there are certain events coming from the same SNMP Trap source that are properly received and processed in our preproduction instance but are not being received in the production instance. For this reason, I have compared the mid servers configuration in both instances and they seem to be both exactly the same except for the property "mid.snmp.session.timeout" which is set to 2000 in prod. 

Does anyone have an idea or guess why this might be happening?

Thank you very much for any help you can give us.

Regards

Lorenzo

[Raj_Esh]

Hi Lorenzo,

Quick thing to check:

When you say the traps are received in preproduction and not in production.

Are Preproduction and Production are in the same Domain and vLAN? My guess is that the Preproduction has a different set of devices and in production, it will be a different set of devices.

Is the source IP for Preproduction and production is same? 

Thanks,

Raj

[Lorenzo10]

H Raj,

Thank you so much for your answer.

I give you an example so you can understand better our problem. We send the same SNMPv3 traps from CyberArk to preproduction and production instance. While in preproduction we are properly receiving all the traps sent, in the production instance we just receive some of them or even sometimes any of them. 

I checked and the preproduction and production mid servers are in the same Domain: "Global" but in different IP Addresses. 

Thank you again in advance,

Regards

Lorenzo

[Henrik Jutterst]

Same issue here.

Some trap messages are not received in ServiceNow via the MID server. Trap messages are sent from cOracle Enterprice Manager (OEM) and some tablespaces are received - some are not. I haven't fully confirmed, but I think it's the same tablespaces that are missing all the time.

However, there is no way for us to trigger just the missing ones. Trap will send all failing at once and we can see in OEM that they are created and sent.

Traps are from same host and everything.

I've created a case to SN-Support, but without any luck. Nothing in the logs that tell me what is wrong. Atleast not what me or SN-Support have found. OEM Trap is and SN Connector is using SNMP v1.

Any luck on your side resolving this issue @Lorenzo10 ?