Understanding SNMP Traps in Enterprise Monitoring

SNMP (Simple Network Management Protocol) traps are unsolicited notifications sent by network devices to a monitoring system when a significant event occurs. Unlike polling, where the monitoring system periodically queries devices, traps are event-driven and provide real-time alerting.

How SNMP Traps Work

When a device detects a condition that meets a defined threshold — such as a CPU spike, interface failure, or temperature alarm — it sends a trap message to a pre-configured trap receiver. The receiver logs the event and can trigger alerts or automated responses.

Common SNMP Trap Types

• coldStart: Device has reinitialized and configuration may have changed
• warmStart: Device has reinitialized without configuration change
• linkDown: A network interface has gone down
• linkUp: A network interface has come back up
• authenticationFailure: An SNMP request used an incorrect community string

Best Practices

• Use SNMPv3 for encrypted, authenticated trap delivery
• Configure trap receivers on at least two monitoring hosts for redundancy
• Filter and deduplicate traps at the receiver to reduce alert noise
• Document OID mappings for vendor-specific enterprise traps

Integration with LogicMonitor

LogicMonitor can receive SNMP traps and correlate them with polled metric data to provide enriched alert context. Traps appear as events in the LogicMonitor console and can be used to trigger alert rules or enrich existing incidents.

Last updated: February 2026 | IT Operations Knowledge Base