Integrating Foglight by Sending SNMP Traps
Foglight can forward alarm information to an external network management system by sending Simple Network Management Protocol (SNMP) traps. This lets you integrate Foglight alarms into an existing monitoring or ticketing platform that receives SNMP notifications.
When an alarm fires or clears in Foglight, a Send SNMP Trap action can send a trap message that contains the alarm details to one or more SNMP trap receivers. This section explains what information is included in the trap, how to distinguish alarm events, how to add custom values, and how alarm severity is represented.
This section covers the following key areas:
- Configuring a Send SNMP Trap action
- Information included in the trap message
- Distinguishing Fire and Clear alarm events
- Adding custom values to the trap message
- Understanding alarm severity levels
Configuring a Send SNMP Trap action
You send SNMP traps by creating a rule (or editing an existing rule) that runs a Send SNMP Trap action when the alarm condition is met. The action specifies the trap receiver (host and port), the SNMP community string or version-specific credentials, and the payload that is sent with the trap.
To configure a trap action, use the Configure Trap Actions and Send SNMP Trap Actions capabilities in the Administration area. For detailed step-by-step configuration, refer to the Administration and Configuration Help / Administration Guide.
Foglight provides a Management Information Base (MIB) file that defines the trap objects and their structure. Import this MIB into your SNMP trap receiver so that it can decode and display the trap fields with meaningful names instead of raw object identifiers (OIDs).
Information included in the trap message
Each SNMP trap that Foglight sends already contains the core details of the alarm, so in most cases you do not need to add anything to identify the alarm. A typical trap includes:
| Field | Description |
|---|---|
| Alarm ID | The unique identifier of the alarm instance. |
| Severity | The severity of the alarm, represented as a numeric level (see Understanding alarm severity levels). |
| Alarm message | The text of the alarm as generated by the rule. |
| Source / monitored object | The topology object (for example, host, agent, or database instance) that the alarm is associated with. |
| Rule name | The name of the rule that generated the alarm. |
| Time | The timestamp when the alarm fired or cleared. |
Because these values are part of the standard trap payload, the receiving system can act on the alarm without any additional configuration.
Distinguishing Fire and Clear alarm events
Foglight sends a trap both when an alarm fires and when the same alarm clears. These two events are sent as two different trap types, which appear in the Foglight MIB as:
fgAlertTrap— sent when an alarm fires (the condition becomes true).fgClearTrap— sent when an alarm clears (the condition returns to normal).
Your SNMP trap receiver can use the trap type (OID) to distinguish between the two events—for example, to open an incident when it receives an fgAlertTrap and to automatically close the corresponding incident when it receives an fgClearTrap.
Match the fire and clear events by the Alarm ID field. Both fgAlertTrap and fgClearTrap for the same alarm instance carry the same Alarm ID, which lets your receiver correlate the clear event with the original fire event.
Adding custom values to the trap message
In addition to the standard alarm details, you can include your own custom values in the trap message by populating the variable bindings (VarBinds) that the Foglight MIB defines for this purpose (for example, VarBind1, VarBind2, and so on).
Use custom VarBind values when you want to pass extra context to the receiving system, such as an environment name, a team or service owner, a routing key, or any other value your downstream tooling expects. Set the desired text or expression in the corresponding VarBind field of the Send SNMP Trap action, and it will be sent as part of the trap payload.
The custom VarBind* values are defined in the Foglight MIB but are not exposed as standard action parameters in the user interface labels. When configuring the trap action, populate the VarBind fields with the values you want to forward, and ensure your trap receiver reads the matching VarBind OIDs.
Understanding alarm severity levels
The severity of an alarm is sent in the trap as a numeric value. Map these numbers to Foglight’s alarm states as follows:
| Numeric value | Alarm state |
|---|---|
| 1 | Normal |
| 2 | Warning |
| 3 | Critical |
| 4 | Fatal |
Use this mapping in your SNMP trap receiver to translate the numeric severity in the trap into a human-readable state (Warning, Critical, or Fatal) and to drive severity-based routing or escalation.
The numeric severity mapping is also documented in the AlarmSystemEvent properties reference. If your integration processes other alarm system events, use the same mapping for consistency.
