Passive monitors overview

Passive monitors are the WhatsUp Gold feature responsible for listening for device events. As active monitors actively query or poll devices for data, passive monitors passively listen for device events. Because passive monitors do not poll devices, they use less network bandwidth than active monitors.

Passive monitors are useful because they gather information that goes beyond simple Up or Down service and device states by listening for a variety of events. For example, if you want to know when someone with improper credentials tries to access one of your SNMP-enabled devices, you can assign the default Authentication Failure passive monitor. The monitor listens for an authentication failure trap on the SNMP device, and logs these events to the SNMP Trap Log. If you assign an action to the monitor, every time the authentication failure trap is received, you are notified as soon as it happens.

Although passive monitors are useful, you should not rely on them solely to monitor a device or service—passive monitors should be used in conjunction with active monitors. When used together, active and passive monitors make up a powerful and crucial component of 360-degree network management.

Passive monitor types are specific configurations of SNMP traps, Windows Log Events, and Syslog Events.

The SNMP Trap monitor listens for any (all) or specific SNMP traps. SNMP traps enable an SNMP device agent to notify on significant events through unsolicited SNMP messages, or traps. For more information, see Cisco's Understanding SNMP Traps.
The Windows Event Log monitor listens for any (all) or specific event messages. Windows event logs record events that happen on devices. For more information about the information the type of information that is gathered and reported in Windows logs, see the Microsoft support site.
The Syslog monitor listens for any (all) or specific Syslog event messages. Syslog messages refer to a facility (the type of program that logged the message) and are assigned a severity by the sender of the message. For more information about Syslog facilities and levels of severity, see RFC5424 (page 9 for facilities and page 10 for levels of severity).

After the monitor types are configured, you can associate them to devices on the Passive Monitors section of Device Properties dialog. For more information, see Assigning passive monitors.

Passive Monitors are configured and stored in the Passive Monitor Library. Using the Passive Monitor Library, you can:

Click New to create a new passive monitor.
Select a monitor type in the list, then click Edit to change the settings.
Select a monitor type in the list, then click Copy to create a new monitor type based on the selected type.
Select a monitor type, then click Delete to remove it from the list.

For more information, see Configuring passive monitors.

Successful passive monitors

Creating a successful passive monitor requires that you take several steps:

Important: Before you attempt to create a passive monitor, you should know the specific traps (and coinciding MIBs) for which you want WhatsUp Gold to listen—this makes the process much easier.

Turn on traps on the device from which you want to receive logs, entries, and/or alerts.
Point the traps on that device to the WhatsUp Gold machine.
Enable the WhatsUp Gold Passive Monitor Listeners.
Create a passive monitor for each of the traps for which you want WhatsUp Gold to listen.
Assign the passive monitor to the device on which you want to listen for traps.

Additionally, after you create a passive monitor, you can configure alerts to notify you when a particular trap is received. For more information, see Actions overview.