Platform Event Trap: Cisco SNMP Guide & Syslog vs Trap

A complete guide to platform event traps(PET): what they are, how they work, step-by-step configuration on Cisco Catalyst, Nexus, and UCS devices, and integration with network monitoring tools.

What is a Platform Event Trap?

A platform event trap is a type of SNMP (Simple Network Management Protocol) trap generated by network devices to instantly report hardware or environmental events to a centralized monitoring system.
Typical platform event traps notify administrators about issues such as power supply failures, temperature alarms, fan malfunctions, or physical module changes.

Unlike syslog, which logs messages locally or forwards them for later review, platform event traps proactively push alerts in real time to the configured network management system (NMS), enabling faster response and minimizing downtime.

How Does a Platform Event Trap Work?

When a monitored component (e.g., fan, power module, temperature sensor) detects a critical change or error, the device immediately creates a platform event trap and sends it via SNMP to one or more management stations.

Key characteristics:

• Event-driven: The trap is triggered automatically by hardware status changes.
• Real-time: Notification is sent instantly, not buffered.
• Structured Data: Traps include OIDs (Object Identifiers) from relevant MIBs, allowing precise identification.

Example Events:

• Power supply removed or failed
• High temperature threshold exceeded
• Fan speed abnormality
• Supervisor/module insertion or removal

Platform Event Trap vs. Syslog: What’s the Difference?

Bottom line:
Use platform event traps for real-time hardware and environmental alerts. Use syslog for comprehensive event logging and compliance.

Supported Devices & Platforms

Platform event traps are widely supported across Cisco’s portfolio, including:

• Cisco Catalyst (e.g., 9300, 9500 series)
• Cisco Nexus (e.g., 3000, 9000 series)
• Cisco UCS Servers (Unified Computing System)
• Cisco ISR/ASR Routers
• Other major vendors (check device SNMP support)

Always check the device documentation for supported trap types and MIB compatibility.

How to Configure Platform Event Trap on Cisco Devices

1. Catalyst/Nexus Switches (IOS/IOS XE/NX-OS)

Step-by-Step Example (IOS XE):

configure terminal
snmp-server community public RO
snmp-server enable traps
snmp-server enable traps entity
snmp-server enable traps envmon
snmp-server host 192.168.1.100 version 2c public
end

• entity traps: hardware events (module, fan, power)
• envmon traps: environmental (temperature, voltage)

NX-OS Example:

feature snmp
snmp-server community public
snmp-server host 192.168.1.100 traps version 2c public
snmp-server enable traps entity
snmp-server enable traps environment

2. Cisco UCS Servers / CIMC

Cisco UCS servers use a web-based interface (CIMC) or CLI to enable platform event filtering (PEF) and trap notifications.

CLI Example:

scope monitoring
set snmp-trap-destination 192.168.1.100
set snmp-community public
set platform-event-filter default
commit

GUI Example:

• Login to CIMC
• Navigate to Admin > Platform Event Filters
• Select or customize event classes (power, temperature, storage, etc.)
• Set trap destination and community string
• Save and commit configuration

Best Practice:
Test configuration using SNMP trap simulators or force a hardware event (e.g., pull redundant power).

Interpreting Trap Messages: MIB and OID Reference

Platform event traps use MIBs (Management Information Bases) to define alert types. Common Cisco MIBs:

• ENTITY-MIB (entConfigChange, entStateOper): Module, supervisor, fan, power supply status
• CISCO-ENTITY-SENSOR-MIB (entSensorAlarm): Temperature, voltage, sensor alarms
• CISCO-STACKWISE-MIB: Stack events
• CISCO-PLATFORM-EVENT-MIB: UCS/CIMC events

Sample Trap OID (ENTITY-MIB):

SNMPv2-SMI::enterprises.9.9.13.3.1.3.1.3 = INTEGER: critical(4)
ENTITY-MIB::entConfigChange
ENTITY-MIB::entStateOper

For a complete list, use Cisco’s SNMP Object Navigator.

Integration with NMS & Monitoring Tools

Most modern network monitoring platforms natively support Cisco platform event traps, including:

• Zabbix: SNMP trap template, auto-discovery, alerting
• SolarWinds: Built-in Cisco MIB support, trap receiver
• PRTG: SNMP Trap Receiver sensor, OID filtering
• Nagios: SNMP trap handler (snmptt, check_snmp)

Integration Tips:

• Only enable essential traps to avoid alert overload.
• Use SNMPv3 where possible for better security.
• Test traps by simulating events or using SNMP tools.

Best Practices & Troubleshooting

• Regularly review trap destinations and SNMP communities for security.
• Correlate traps with syslog and device logs for deeper insight.
• Document OID-to-event mapping for easier NOC response.
• Implement incident workflows for auto-ticketing or automated recovery.
• Periodically test by simulating hardware events or using lab devices.

FAQ