When to use snmp trap - when to use syslog

[thorsten.steffen]

Hi,

it would be fine if somebody could give any more input to the following conversation:

http://forum.cisco.com/eforum/servlet/NetProf?page=netprof&forum=Network%20Infrastructure&topic=LAN%2C%20Switching%20and%20Routing&CommCmd=MB%3Fcmd%3Dpass_through%26location%3Doutline%40%5E1%40.1ddf160e

Many thanks

Thorsten

[David Stanford]

I think they covered most points in the thread, the only things I would add are:

1) syslog and snmp don't always cover the same content -- there are some syslogs that aren't available as traps. However, if you enable snmp syslog traps you should get everything

2) snmp is more of a real time tool than syslog

[GERARD PUOPLO]

First the info from traps and syslog don't fully overlap. Traps for example are easier to parse for events like link down because you get the iftype and ifname in the trap to filter on. Where as syslog is useful for events where there is no corresponding trap.

There is no equivalent syslog msg that I know of for SNMP traps but there are in the cases of routers and switches syslog traps. With EEM you could set up whatever you want but probably for only a limited subset of devices.

In my many years of doing this I say you should use both otherwise you will miss some notifications. Many event managers like Netcool will allow you to setup deduplication too if you don't want the same incident annunciated more than once.

Jerry