This article applies as of PRTG 22

How can I make sure that my SNMP Trap Receiver, Syslog Receiver, or Event Log sensors stay in the Down status for longer than one scanning interval, even if the issue isn't ongoing?

Using notification triggers to modify the status of a sensor

By default, PRTG will only change the sensor status for one single scanning interval. If the next scan results in a different status, the status will change accordingly.

There is a workaround that applies to these sensor types:

• SNMP Trap Receiver
• Syslog Receiver
• WMI Event Log
• Event Log (Windows API)

Steps to follow

1. Open the channel settingsof
   • the New Records channel of the Event Log sensors, or
   • the Errors channel of the Syslog Receiver, or SNMP Trap Receiver sensor.
2. Enter the value 0,00000001 into the Upper Error Limit (#/s) field. This makes sure that the sensor status will immediately change as soon as an alarm occurs and the limit is exceeded.
   Note: This is the default setting for the Syslog and Trap Receiver sensors.
   
   
3. This setting sets the sensor to the Downstatus as soon as a message that matches the sensor filter rules arrives.
4. Click the Notification Triggers tab of the sensor and configure it as follows:
   
   
   

This will immediately trigger a message and inform you about the issue.

Advanced steps

We would also like to provide you with information that will allow you to display the Down status in PRTG until it is resolved. Therefore, follow these steps to set up the required API calls as well as the settings in PRTG:

1. Create a device with a Green IT sensor.
2. Create a new notification template and select Execute HTTP Action. This is where the PRTG API comes into play:
   
   
3. Enter this code and fill in the data you need:  http(s)://YourServerIP/api/simulate.htm?id=objectid&action=1&username=YourUserAccount&Passhash=YourPasshash 

• You can find the passhash under Setup | System Administration | User Accounts.
• You can find the correct object ID of the newly created Green IT sensor on its Overview tab:
  
  
  
• You can clear the simulated error status by right-clicking the sensor's name and by clicking Resume.

Result

Following this guide will allow you to quickly change the status of one sensor, based on a speed trigger or limit assigned to a particular sensor based on #/s results and to get a persistent overview of previous events. 

When assigning the Object ID from the Green IT sensor's Overview tab for notifications, it's crucial to note that notifications themselves don't contain a field named 'objectid.' However, when setting up a new notification, you can incorporate this Object ID into the configuration.

The Green IT sensor can indeed be added to an existing device. Once added, you can create a new notification and choose "Execute HTTP Action." In this notification setup, you'll input the Object ID into a webhook.

Here's an example webhook format:

http(s):YourServerIP/api/simulate.htm?id=objectid&action=1&username=YourUserAccount&Passhash=YourPasshash

For instance, if the ID of the sensor is 9000, the webhook would appear as follows:

http(s):YourServerIP/api/simulate.htm?id=9000&action=1&username=YourUserAccount&Passhash=YourPasshash

This configuration implies that the Object ID should be integrated into the webhook URL within the notification setup, rather than in the account settings.

More

• My Event Log sensor ignores changes in the event log. What can I do?