I followed you write up and it wasn't working for me. The clearing traps were being processed by the first even action, it seems like the filter script was not seeing the "critical, major, minor, warning" text as you originally had it. I needed to change it back to the numbers included in the trap. Seems like the transform script wasn't updating the field correctly or something. Either way using your guidance I got this to work with the settings in the pictures. This accomplished what I needed it to and I should be able to apply this same logic to other vendors.
Transform:
switch ($event->parameters[5])
{
case "1":
$event->setSeverity(4);
SetEventParameter($event, "4", "critical");
break;
case "2":
$event->setSeverity(3);
SetEventParameter($event, "4", "major");
break;
case "3":
$event->setSeverity(2);
SetEventParameter($event, "4", "minor");
break;
case "4":
$event->setSeverity(1);
SetEventParameter($event, "4", "warning");
break;
case "5":
$event->setSeverity(0);
SetEventParameter($event, "4", "cleared");
break;
case "6":
$event->setSeverity(0);
SetEventParameter($event, "4", "information");
break;
default:
$event->setSeverity(5);
SetEventParameter($event, "4", "unknown");
}
return;
Event Policy:
// Adjust the severity of the current event to reflect the value passed from the trap
// Drop events with severity != critical/major/minor/warning
switch ($event->parameters[5])
{
case "1":
$event->setSeverity(4);
return true;
case "2":
$event->setSeverity(3);
return true;
case "3":
$event->setSeverity(2);
return true;
case "4":
$event->setSeverity(1);
return true;
default:
return false;
}
[image: WORKING Event Processing.png]
[image: WORKING Event Template.png]
[image: WORKING SNMP parameters.png]
[image: WORKING Transform.png]
