SNMP Trap is repeated every 5 minutes

Products

• VMware vCenter Server
• VMware vSphere ESXi

Issue/Introduction

• A Simple Network Management Protocol (SNMP) trap is repeated every five minutes.
• Example output:
  
  1.3.6.1.4.1.6876.4.90.0.401 1.3.6.1.4.1.6876.4.190.0.401

Environment

VMware vSphere ESXi 7.x
VMware vSphere ESXi 6.x
VMware vCenter Server 7.x
VMware vCenter Server 6.x

Cause

The SNMP trap is a CIM heartbeat notification and is expected behavior.

 

This behavior occurs when third party management systems do not use SNMP GET to poll the ESXi system on a regular basis. The SNMP trap provides a reverse poll, a way for a management system to generate an alarm when the ESXi system is not responding or is not reachable. An alarm should be generated indicating that the ESXi system is either slow or not responding when this particular trap is not received after twice the default sending period.

For example, with 5 minute per trap, an alarm would be raised when nothing is heard from an ESXi system within 10 minutes.

Resolution

Change the default sending period of the SNMP trap on the ESXi host and/or on vCenter Server

To change the default sending period on the ESXi host: 

1. As a root user, open a SSH session to the ESXi console.

2. Back up the /etc/sfcb/sfcb.cfg file.

3. Open the /etc/sfcb/sfcb.cfg file in a text editor.

4. Add or update the key heartbeatInterval key to the duration requested in seconds.
   
   For example, to change the reverse poll to occur every 10 minutes:
   
   heartbeatInterval: 600

5. Save and Close the sfcb.cfg file.

6. Restart the sfcbd service for the changes to take effect:
   
   /etc/init.d/sfcbd-watchdog restart

To change the default sending period on vCenter Server:

1. Take a backup of the vpxd.cfg file located at /etc/vmware-vpx/vpxd.cfg
    
2. As an administrator, open the vpxd.cfg file using a text editor.
3. Within the <config> </config> tags, add or update this SNMP configuration:
   

   <config>
...
<snmp>
<testTrap>
<periodic>
<enable>true</enable>
<period>300</period>
</periodic>
</testTrap>
</snmp>
...
</config>

   Note: The <period> value is in seconds. If no SNMP <period> element is defined, then it default to 5 minutes (300 seconds).

4. For the changes to take effect, restart the vpxd service.
   
   /etc/init.d/vmware-vpxd restart

Mask out the SNMP trap

When the system is using SNMP GET, the trap can be masked out with the --notrap option:

1. Check for other configured traps and run the command:
   
   esxcli system snmp get
    
2. To filter these out, run the command:
   
   esxcli system snmp set --notraps 1.3.6.1 .4.1.6876.4.90.0.401