Would anyone know of a rule that can be created in Trap Viewer that will suppress or discard duplicate traps sent within a specified period of time, and only for a unique device?
Example, we have three UPS devices that need battery replacements, each sending traps every two minutes, three traps in all. For the UPS traps, we would like to see something like one trap per day for each specific MIB and source device pairing while discarding the rest. Our hope is that we can create just one or two rules that would allow for the generation of a total of three emails (one from each UPS) and discard the duplicate traps over a 24hr period.
This is sort of what we are looking for:
If host X matches Trap Detail Pattern "PowerNet-MIB:apc.0.80" more than 1 time within 24hrs, discard.
If host X matches Trap Detail Pattern "PowerNet-MIB:apc.0.80" send email.
Please also keep in mind that if a different device comes in reporting the same trap we also would want to be alerted on it too. We understand that this is all possible by creating very specific rules, but in actuality, we have hundreds of devices and specific rules for each device is not an option.
Many thanks in advance to anyone who can help with this!