SNMP Trap is repeated every 5 minutes

Products

• VMware vCenter Server
• VMware vSphere ESXi

Issue/Introduction

Symptoms:

• A Simple Network Management Protocol (SNMP) trap is repeated every five minutes.
• You see output similar to:
  
  1.3.6.1.4.1.6876.4.90.0.401 1.3.6.1.4.1.6876.4.190.0.401

Environment

VMware vCenter Server 6.7.x
VMware vCenter Server 5.1.x
VMware vCenter Server 5.5.x
VMware vSphere ESXi 5.5
VMware vSphere ESXi 6.5
VMware vCenter Server 5.0.x
VMware vCenter Server 6.0.x
VMware vSphere ESXi 5.1
VMware vCenter Server 6.5.x
VMware vSphere ESXi 5.0
VMware vSphere ESXi 6.0
VMware vSphere ESXi 6.7

Cause

The SNMP trap is a CIM heartbeat notification and is expected behavior. This issue occurs when third party management systems do not use SNMP GET to poll the ESXi system on a regular basis. The SNMP trap provides a reverse poll, a way for a management system to generate an alarm when the ESXi system is not responding or is not reachable. An alarm should be generated indicating that the ESXi system is either slow or not responding when this particular trap is not received after twice the default sending period. For example, with 5 minute per trap an alarm would be raised when nothing is heard from an ESXi system within 10 minutes.

Resolution

To resolve this issue, perform one of these options:

• Change the default sending period of the SNMP trap when you want to see fewer occurrences of the same trap.
• Mask out the trap when you want to prevent the traps from appearing.

Change the default sending period of the SNMP trap on the ESXi host and/or on vCenter Server

To change the default sending period on the ESXi host:
 

1. As a root user, open a SSH session to the ESXi console.
2. Back up the /etc/sfcb/sfcb.cfg file.
3. Open the /etc/sfcb/sfcb.cfg file in a text editor.
4. Add or update the key heartbeatInterval key to the duration requested in seconds. For example, to change the reverse poll to occur every 10 minutes:
   
   heartbeatInterval: 600
    
5. Save and Close the sfcb.cfg file.
6. Restart the sfcbd service for the changes to take effect, using the command:
   
   /etc/init.d/sfcbd-watchdog restart
    

To change the default sending period on vCenter Server:

1. Take a backup of the vpxd.cfg file. This file is located by default at:
   
   vCenter Server Appliance: /etc/vmware-vpx/vpxd.cfg for vCenter Server Applicace.
   Windows 2008: C:\ProgramData\VMware\VMware VirtualCenter\vpxd.cfg for Windows 2008.
   Windows 2003: C:\Documents and Settings\All Users\Application Data\VMware\VMware VirtualCenter\vpxd.cfg for Windows 2003.
    
2. As an administrator, open the vpxd.cfg file using a text editor.
3. Within the <config> </config> tags, add or update this SNMP configuration:
   
   <config>

   ...

   <snmp>

   <testTrap>

   <periodic>

   <enable>true</enable>

   <period>300</period>

   </periodic>

   </testTrap>

   </snmp>

   ...

   </config>

    

   Note: The <period> value is in seconds. If no SNMP <period> element is defined then it default to 5 minutes (300 seconds).

4. For the changes to take effect, restart the VMware VirtualCenter Server service:
   
   On the vCenter Server, restart the VMware VirtualCenter Server service in the Server manager. For more information, see Stopping, starting, or restarting vCenter services (1003895).
   
   Run this command on the vCenter Server Appliance: /etc/init.d/vmware-vpxd restart.

Mask out the SNMP trap

When your system is using SNMP GET, the trap can be masked out with the --notrap option:
 

1. Check for other configured traps and run the command:
   
   esxcli system snmp get
    
2. When you want to filter these out, run the command:
   
   esxcli system snmp set --notraps 1.3.6.1 .4.1.6876.4.90.0.401

Additional Information

For more information, see SNMP configuration steps for VI3, vSphere 4.0 and 4.1 (2003845).How to stop, start, or restart vCenter Server services
SNMP configuration steps for VI3, vSphere 4.0 and 4.1
SNMP 陷阱每 5 分钟重复一次