Set up SNMP Traps as an ingest method
Step 1 - Create an SNMP Trap ingest token
Why? Ingest tokens authenticate and authorize SNMP Trap sources to send data to your repository. They control which parsers can be used and what fields can be populated from trap data.
Detailed steps:
Sign in to Falcon LogScale, and browse to your repository.
Click Settings, Ingest Tokens.
Click Add token.
Type in a descriptive name (for example, snmp-traps-network-devices).
Set the appropriate permissions:
Assign parser to allow automatic parser selection based on trap data
Assign fields to enable field creation from trap metadata and data
Click Create token to save the token and securely store the generated string - you'll need this when configuring SNMP Trap receivers.
Step 2 - Configure SNMP Trap receiver in LogScale
Why? Proper configuration of the SNMP Trap receiver ensures that LogScale can receive and process traps from your network devices and applications.
Detailed steps:
Navigate to Settings, Ingest Feeds in Falcon LogScale.
Click New ingest feed.
Select SNMP Traps from the dropdown.
Configure the SNMP Trap receiver:
Protocol: UDP or TCP (default: UDP)
Port: Default SNMP Trap port (161 or 162)
Community String: Optional for authentication
Token: Enter the ingest token created earlier
Step 3 - Configure devices to send SNMP Traps
Why? Devices and applications must be configured to send SNMP Traps to the LogScale SNMP Trap receiver for log collection to occur.
Detailed steps:
Identify devices to configure:
Network devices (routers, switches, firewalls)
Servers and applications
Configure SNMP Trap destinations:
Set the SNMP Trap receiver IP address and port
Configure community string or authentication settings if required
Step 4 - Test and verify
Why? Testing confirms that SNMP Traps are being successfully received and processed by LogScale.
Detailed steps:
Trigger test SNMP Traps from devices or applications:
Use SNMP tools or device simulators
Verify traps are received by LogScale
In LogScale, browse to your repository and verify that:
Events are appearing with correct timestamps
Fields are parsed correctly according to your parser
Step 5 - Monitoring and maintenance
Why? Ongoing monitoring ensures the reliability and performance of your SNMP Trap ingestion pipeline.
What you should do:
Monitor SNMP Trap receipt and processing rates
Verify trap data quality and accuracy
Review and adjust trap filtering and parsing configurations