Technical Tip: Understanding the log message 'SNMP Trap Sent'
| Description | This article describes the typical circumstances behind the 'Logs outbound SNMP trap notifications'. |
| Scope | FortiAuthenticator. |
| Solution | Event ID 31001 refers to an event log entry related to FortiAuthenticator sending SNMP trap messages to the SNMP monitoring server.
SNMP is a standard protocol used for monitoring and managing devices on a network. It allows administrators to collect information about network performance and detect faults in the FortiAuthenticator
The sample system event message will look like below:
HA cluster member not sync:
date=2025-11-04 time=20:13:33+0000 oid=8888 logid=31001 cat="Event" subcat="System" level="information" nas="" action="" status="" msg="SNMP Trap (HA sync events are below normal range) sent to configured recipients" user=""
HA cluster status changed:
date=2025-11-04 time=20:13:33+0000 oid=8888 logid=31001 cat="Event" subcat="System" level="information" nas="" action="" status="" msg="SNMP Trap (HA status has changed) sent to configured recipients" user=""
High CPU:
date=2025-11-04 time=20:13:33+0000 oid=88881 logid=31001 cat="Event" subcat="System" level="information" nas="" action="" status="" msg="SNMP Trap (CPU usage is high) sent to configured recipients" user=""
High Memory:
date=2025-11-04 time=20:13:33+0000 oid=8888 logid=31001 cat="Event" subcat="System" level="information" nas="" action="" status="" msg="SNMP Trap (Memory is low) sent to configured recipients" user=""
Power Supply failure:
date=2025-11-04 time=20:13:33+0000 oid=8888 logid=31001 cat="Event" subcat="System" level="information" nas="" action="" status="" msg="SNMP Trap (Power supply failure detected) sent to configured recipients" user=""
IP lockout:
date=2025-11-04 time=20:13:33+0000 oid=8888 logid=31001 cat="Event" subcat="System" level="information" nas="" action="" status="" msg="SNMP Trap (IP lockout detected) sent to configured recipients" user=""
User lockout:
date=2025-11-04 time=20:13:33+0000 oid=8888 logid=31001 cat="Event" subcat="System" level="information" nas="" action="" status="" msg="SNMP Trap (User lockout detected) sent to configured recipients" user=""
Max authentication event threshold reached:
date=2025-11-04 time=20:13:33+0000 oid=8888 logid=31001 cat="Event" subcat="System" level="information" nas="" action="" status="" msg="SNMP Trap (Auth event rate threshold exceeded) sent to configured recipients" user=""
These logs can be viewed under Log Access -> Logs -> filter '31001' |