Sending Notifications to Syslog and SNMP Destinations

When configuring Logger to send alerts to SNMP and Syslog destinations, you should be familiar with this information:

Unlike an email alert, a trigger alert is sent separately from the alert that contains the matched (base) events that triggered the alert.
All SNMP alerts are sent as SNMP traps; therefore, trigger alerts and their associated matched (base) events are received as SNMP traps on an SNMP destination. The SNMP trap includes the trigger event, but it does not include the events that caused the alert to trigger (matched events). The trigger event does include the event IDs of all the matched events. You can use the event IDs in the trigger alert to identify the associated matched events.

Note: Non-CEF events do not contain event IDs. If you need to associate such base events with their trigger alert, send such events to Logger through a connector.
SNMP uses UDP to send packets. As a result, the order in which alerts arrive at an SNMP destination is not guaranteed.
When Syslog events are sent using UDP, the order in which the trigger alert and matched events arrive is not guaranteed.
Avoid sending alerts to SNMP using non-ASCII characters in the community field as the trap displays "??" characters. However, this does not impact SNMP authentication to Logger.