Part of the most important components of a complete IT management solution is a fault management system. This may range from a small process running in the background to a complex number of receivers spread over a large topology, forwarding messages to a core trap manager. These messages are called ?SNMP Traps?. With fault management, the manager of managers (also known as MOM) is capable of detecting information occurring in real-time throughout your network infrastructure. This information, in the form of snmp traps, basically comes for free, a benefit of the passive push model of network management (i.e. they are sent to the manager without a prior request), requiring no additional effort on the part of the management station. This data provides a clear and current view of what is happening in the network infrastructure, alerting you to potential outages and events that may be affecting your users, network, and even your business.



Types of information that are sent via snmp traps consist of generic information in the way of a SNMPv1 trap message (i.e. did a machine come up, go down, a user come online?), ranging all the way to information about rooms overheating , fans and power supplies failing, or disk drives being full.

With a fault management system, SNMP Traps that come into a system will first be queued and then matched to event filters. The management system decodes the snmp trap message and then the event filters can match and determine the type of trap based on information contained in the message, either in the Trap or Notification OID, or from the payload of the message called the ?varbinds?. Once the type of filter has been determined, the system can take an appropriate action based on the type of event filter it matched. Advanced systems can perform event correlation and determine, based on different event occurring in the network, what thing or group of things may be the root cause. These systems are also capable of predicting which devices and/or services will be adversely affected. The most sophisticated systems perform this prediction and then perform corrective action automatically using different means of notification, execution of scripts, and spawning processes.

There are disadvantages to relying solely on information from SNMP TRAPS. These messages are sent best-effort using the UDP protocol over an IP network. What this means is that the arrival of these messages is not guaranteed, and the manager may not be notified in the event of a complete network outage or some other type of event. Also, if a system goes down, it may not be able to send the trap in time before the shutdown occurs.

Of the different types of traps using the SNMPv2c protocol, there is also one called an Inform. Like a Notification, an Inform is a SNMP Trap that is sent over the network to the manager that is meant to inform the manager about a certain event, but there is something special about the Inform ? it expects a response back! The manager must respond to the Inform, and if it does not, the sending agent assumes that the message has not been received and it will continue to send traps in the Inform format until a response is received. It is in this way the SNMPv2c protocol attempts to overcome the ?best-effort? nature of the underlying transmission protocol, UDP.

Another way to provide reliable snmp trap delivery is to use TCP rather than UDP for transmission of messages. This ensures that there will be a TCP connection based session, and traffic will not be best-effort but instead, the sender will be able to basically rely on delivery of the trap. But again, the use of TCP as a delivery mechanism is rarely seen and is usually found in custom solutions built by third parties using only one type of equipment or fault management forwarding mechanisms.

Because of the unreliability of these SNMP traps, it underscores the importance that your system also practices proactive polling and device status checks. Fault management is just one important piece of a total network monitoring and management solution.