# SNMP trap collector health alerts.
# These templates fire on per-job self-metrics emitted by the snmp_traps plugin.

# Severity-rate alerts. Notice, info, and debug do not alert by default.
 template: snmp_trap_emergency_events
       on: snmp.trap.severity
    class: Errors
     type: NetworkDevice
component: SNMP traps
   lookup: average -5m unaligned of emerg
    units: events/s
    every: 1m
     crit: $this > 0
    delay: down 5m multiplier 1.5 max 1h
  summary: Emergency SNMP traps received
     info: The SNMP trap listener ${label:job_name} is receiving emergency-severity traps. At least one device reports a system-unusable state.
       to: sysadmin

 template: snmp_trap_alert_events
       on: snmp.trap.severity
    class: Errors
     type: NetworkDevice
component: SNMP traps
   lookup: average -5m unaligned of alert
    units: events/s
    every: 1m
     warn: $this > 0
     crit: $this > 5
    delay: up 1m down 5m multiplier 1.5 max 1h
  summary: Alert-severity SNMP traps received
     info: The SNMP trap listener ${label:job_name} is receiving alert-severity traps that require immediate attention on the sending device.
       to: sysadmin

 template: snmp_trap_critical_events
       on: snmp.trap.severity
    class: Errors
     type: NetworkDevice
component: SNMP traps
   lookup: average -5m unaligned of crit
    units: events/s
    every: 1m
     warn: $this > 0
     crit: $this > 10
    delay: up 1m down 5m multiplier 1.5 max 1h
  summary: Critical SNMP traps received
     info: The SNMP trap listener ${label:job_name} is receiving critical-severity traps.
       to: sysadmin

 template: snmp_trap_error_events
       on: snmp.trap.severity
    class: Errors
     type: NetworkDevice
component: SNMP traps
   lookup: average -5m unaligned of err
    units: events/s
    every: 1m
     warn: $this > 10
     crit: $this > 100
    delay: up 5m down 10m multiplier 1.5 max 1h
  summary: High rate of error-severity SNMP traps
     info: The SNMP trap listener ${label:job_name} is receiving error-severity traps at high rate.
       to: sysadmin

 template: snmp_trap_warning_event_storm
       on: snmp.trap.severity
    class: Errors
     type: NetworkDevice
component: SNMP traps
   lookup: average -10m unaligned of warning
    units: events/s
    every: 1m
     warn: $this > 100
     crit: $this > 1000
    delay: up 10m down 10m multiplier 1.5 max 1h
  summary: High rate of warning-severity SNMP traps
     info: The SNMP trap listener ${label:job_name} is receiving warning-severity traps at storm-level rate.
       to: sysadmin

# Processing error alerts. Unknown OIDs remain available as a metric but do not
# alert by default because uncovered vendor traps are common on heterogeneous networks.
 template: snmp_trap_decode_errors
       on: snmp.trap.errors
    class: Errors
     type: NetworkDevice
component: SNMP traps
   lookup: average -10m unaligned of decode_failed
    units: errors/s
    every: 1m
     warn: $this > 0
    delay: down 10m multiplier 1.5 max 1h
  summary: SNMP trap decode errors detected
     info: The SNMP trap listener ${label:job_name} has decode errors. Check that SNMP versions, communities, and USM users match sender configuration.
       to: sysadmin

 template: snmp_trap_template_unresolved
       on: snmp.trap.errors
    class: Errors
     type: NetworkDevice
component: SNMP traps
   lookup: average -10m unaligned of template_unresolved
    units: errors/s
    every: 1m
     warn: $this > 0
    delay: down 10m multiplier 1.5 max 1h
  summary: SNMP trap profile templates unresolved
     info: The SNMP trap listener ${label:job_name} received traps whose profile templates referenced missing varbinds or fields.
       to: sysadmin

 template: snmp_trap_malformed_pdus
       on: snmp.trap.errors
    class: Errors
     type: NetworkDevice
component: SNMP traps
   lookup: average -10m unaligned of malformed_pdu
    units: errors/s
    every: 1m
     warn: $this > 0
    delay: down 10m multiplier 1.5 max 1h
  summary: Malformed SNMP trap PDUs received
     info: The SNMP trap listener ${label:job_name} is receiving structurally invalid trap PDUs.
       to: sysadmin

 template: snmp_trap_allowlist_drops
       on: snmp.trap.errors
    class: Errors
     type: NetworkDevice
component: SNMP traps
   lookup: average -10m unaligned of dropped_allowlist
    units: errors/s
    every: 1m
     warn: $this > 10
     crit: $this > 100
    delay: up 10m down 10m multiplier 1.5 max 1h
  summary: SNMP traps dropped by source allowlist
     info: The SNMP trap listener ${label:job_name} is dropping traps because the sender IP is outside the configured allowlist.
       to: sysadmin

 template: snmp_trap_rate_limited
       on: snmp.trap.errors
    class: Errors
     type: NetworkDevice
component: SNMP traps
   lookup: average -10m unaligned of rate_limited
    units: errors/s
    every: 1m
     warn: $this > 10
     crit: $this > 100
    delay: up 10m down 10m multiplier 1.5 max 1h
  summary: SNMP traps are being rate limited
     info: The SNMP trap listener ${label:job_name} is receiving traps above the configured per-source rate limit.
       to: sysadmin

 template: snmp_trap_auth_failures
       on: snmp.trap.errors
    class: Errors
     type: NetworkDevice
component: SNMP traps
   lookup: average -10m unaligned of auth_failures
    units: errors/s
    every: 1m
     warn: $this > 0
    delay: down 10m multiplier 1.5 max 1h
  summary: SNMP trap authentication failures
     info: The SNMP trap listener ${label:job_name} has authentication failures. Verify sender communities or SNMPv3 user configuration.
       to: sysadmin

 template: snmp_trap_usm_failures
       on: snmp.trap.errors
    class: Errors
     type: NetworkDevice
component: SNMP traps
   lookup: average -10m unaligned of usm_failures
    units: errors/s
    every: 1m
     warn: $this > 0
    delay: down 10m multiplier 1.5 max 1h
  summary: SNMPv3 USM authentication or decryption failures
     info: The SNMP trap listener ${label:job_name} has USM failures. Verify auth and privacy protocols and keys match the sender USM configuration.
       to: sysadmin

 template: snmp_trap_unknown_engine_id
       on: snmp.trap.errors
    class: Errors
     type: NetworkDevice
component: SNMP traps
   lookup: average -10m unaligned of unknown_engine_id
    units: errors/s
    every: 1m
     warn: $this > 0
    delay: down 10m multiplier 1.5 max 1h
  summary: SNMPv3 traps from unknown or newly discovered engine IDs
     info: The SNMP trap listener ${label:job_name} is receiving v3 traps from engine IDs outside the static whitelist. In dynamic_engine_id_discovery mode, the first accepted (engineID, username) pair increments this once as visibility; repeated or rejected increments usually mean cap exhaustion, invalid sender state, or an unauthorized sender.
       to: sysadmin

 template: snmp_trap_inform_response_failures
       on: snmp.trap.errors
    class: Errors
     type: NetworkDevice
component: SNMP traps
   lookup: average -10m unaligned of inform_response_failed
    units: errors/s
    every: 1m
     warn: $this > 0
    delay: down 10m multiplier 1.5 max 1h
  summary: SNMP INFORM response failures
     info: The SNMP trap listener ${label:job_name} failed to send INFORM acknowledgements back to senders.
       to: sysadmin

 template: snmp_trap_binary_encoded_fields
       on: snmp.trap.errors
    class: Errors
     type: NetworkDevice
component: SNMP traps
   lookup: average -10m unaligned of binary_encoded
    units: errors/s
    every: 1m
     warn: $this > 0
    delay: down 10m multiplier 1.5 max 1h
  summary: SNMP trap structured fields written with binary journal encoding
     info: The SNMP trap listener ${label:job_name} wrote structured fields with binary journal encoding before writing to the journal. Check profile labels and rendered varbind values for control characters, unsupported field names, or oversized values.
       to: sysadmin

 template: snmp_trap_profile_load_failures
       on: snmp.trap.errors
    class: Errors
     type: NetworkDevice
component: SNMP traps
   lookup: average -10m unaligned of profile_load_failed
    units: errors/s
    every: 1m
     warn: $this > 0
    delay: down 10m multiplier 1.5 max 1h
  summary: SNMP trap profile load failures
     info: The SNMP trap listener ${label:job_name} failed to load trap profiles. Check custom profile YAML syntax and profile directories, then restart or recreate the job after correcting them.
       to: sysadmin

 template: snmp_trap_journal_write_failures
       on: snmp.trap.errors
    class: Errors
     type: NetworkDevice
component: SNMP traps
   lookup: average -5m unaligned of journal_write_failed
    units: errors/s
    every: 1m
     warn: $this > 0
     crit: $this > 1
    delay: down 5m multiplier 1.5 max 1h
  summary: SNMP trap journal write failures
     info: The SNMP trap listener ${label:job_name} failed to write traps to the systemd-journal. Check disk space and filesystem permissions at the per-job journal directory.
       to: sysadmin

 template: snmp_trap_otlp_export_failures
       on: snmp.trap.errors
    class: Errors
     type: NetworkDevice
component: SNMP traps
   lookup: average -10m unaligned of otlp_export_failed
    units: errors/s
    every: 1m
     warn: $this > 0
    delay: down 10m multiplier 1.5 max 1h
  summary: SNMP trap OTLP export failures
     info: The SNMP trap listener ${label:job_name} failed to export traps through OTLP. Check the configured OTLP endpoint, credentials, and network path.
       to: sysadmin

 template: snmp_trap_listener_read_failures
       on: snmp.trap.errors
    class: Errors
     type: NetworkDevice
component: SNMP traps
   lookup: average -10m unaligned of listener_read_failed
    units: errors/s
    every: 1m
     warn: $this > 0
    delay: down 10m multiplier 1.5 max 1h
  summary: SNMP trap listener socket read failures
     info: The SNMP trap listener ${label:job_name} failed to read UDP packets from a bound socket. Check for operating-system socket errors or listener lifecycle problems.
       to: sysadmin

# Dedup suppression rate alert.
 template: snmp_trap_high_dedup_suppression
       on: snmp.trap.dedup_suppressed
    class: Errors
     type: NetworkDevice
component: SNMP traps
   lookup: average -10m unaligned of suppressed
    units: events/s
    every: 1m
     warn: $this > 1000
     crit: $this > 10000
    delay: up 10m down 10m multiplier 1.5 max 1h
  summary: High SNMP trap deduplication suppression rate
     info: The SNMP trap listener ${label:job_name} is suppressing a high volume of duplicate traps. Consider checking whether a trap storm is in progress.
       to: sysadmin
