SMS: How the SNMP Trap ID Relates to a Windows NT Event

This article is intended to allow a Systems Management Server administrator to better understand how an SNMP Specific Trap ID relates to the Windows NT event ID that is initially generated on a client computer running Windows NT.

The SNMP Specific Trap ID is a 32-bit representation of the Windows NT event ID (normally displayed in the Windows NT event log). The first sixteen bits of the specific trap ID are actually the Windows NT event ID displayed within the Windows NT event log. Bits 31 and 32 of the 32-bit event ID are the default severity of the error, normally displayed either as an icon representation in the Windows NT event log, or as the Type entry when viewing an event in detail.

The following is an example: The Windows NT Event ID is therefore: 1111101001111, which is equivalent to 8015 in a decimal format.

Therefore, this SNMP Specific Trap ID represents Windows NT event 8015. The event detail for this event can be displayed using the Systems Management Server utility Error32.exe, which can be found in the Psstools directory (in Systems Management Server version 1.0 or 1.1) or the Support directory (in Systems Management Server 1.2) of the Systems Management Server compact disc. The following is the Error32 command line for event 8015: NOTE: The syntax of the Error32.exe utility can be displayed by simply running the application with no parameters.

The top two bits of the Specific Trap ID dictate the default severity type: From the example above, you can determine that Windows NT Event 8015 is classified as Informational.

This information can also be obtained using the Error32 utility, by adding an asterisk to the command line shown above.