Trap Threshold in a Event Policy

Hello Ismael,

You cannot configure thresholds within the event policy itself, regardless of the event source. For dynamic apps, the threshold is configured in the dynamic app to compare against when data is collected. If the collected data violates the threshold, then SL1 will create a device log message that it will use to match with an event policy. If an event policy is matched, then the event is created. This is regardless of what the actual collected value is.

Same goes with traps. When the trap is received, the trap OID is used to match to an event policy. If there is a match, then the event is generated. This is regardless of what the trap message is. If you only want to generate an event when there is a specific value in the trap message, then you will need to create a regular expression in the event policy that only triggers the event when the regular expression matches that trap message.

Antonio Andres

Principal Technical Support Engineer | ScienceLogic