@oneuptime/common 11.4.1 → 11.5.1

package/Server/Utils/LLM/LLMService.ts

@@ -41,6 +41,7 @@ export interface LLMCompletionRequest {
   messages: Array<LLMMessage>;
   temperature?: number | undefined;
   maxTokens?: number | undefined;
+  additionalParams?: JSONObject | undefined;
   tools?: Array<LLMToolDefinition> | undefined;
   llmProviderConfig: LLMProviderConfig;
 }
@@ -226,6 +227,26 @@ export default class LLMService {
       data["tools"] = this.toOpenAITools(request.tools);
     }
 
+    // Provider-configured overrides are applied last so they win over defaults.
+    if (request.additionalParams) {
+      Object.assign(data, request.additionalParams);
+    }
+
+    /*
+     * OpenAI's newer model families (gpt-5, o1, o3, ...) reject the legacy
+     * `max_tokens` parameter and require `max_completion_tokens` instead; the
+     * two are mutually exclusive. When a provider opts into
+     * `max_completion_tokens` via additionalParams, drop the default
+     * `max_tokens` so the request is accepted. Legacy OpenAI-compatible
+     * backends (Ollama, vLLM, LocalAI, ...) keep receiving `max_tokens`.
+     */
+    if (
+      data["max_completion_tokens"] !== undefined &&
+      data["max_tokens"] !== undefined
+    ) {
+      delete data["max_tokens"];
+    }
+
     return data;
   }
 

package/Server/Utils/Monitor/Criteria/SnmpMonitorCriteria.ts

@@ -5,9 +5,11 @@ import {
   CriteriaFilter,
   FilterType,
 } from "../../../../Types/Monitor/CriteriaFilter";
+import SnmpInterface from "../../../../Types/Monitor/SnmpMonitor/SnmpInterface";
 import SnmpMonitorResponse, {
   SnmpOidResponse,
 } from "../../../../Types/Monitor/SnmpMonitor/SnmpMonitorResponse";
+import SnmpTrap from "../../../../Types/Monitor/SnmpMonitor/SnmpTrap";
 import ProbeMonitorResponse from "../../../../Types/Probe/ProbeMonitorResponse";
 import EvaluateOverTime from "./EvaluateOverTime";
 import CaptureSpan from "../../Telemetry/CaptureSpan";
@@ -28,6 +30,63 @@ export default class SnmpMonitorCriteria {
     const snmpResponse: SnmpMonitorResponse | undefined =
       dataToProcess.snmpResponse;
 
+    /*
+     * Event/check separation. Trap responses are evaluated ONLY against
+     * trap criteria; polled check responses never match trap criteria.
+     * This keeps a trap from misfiring "is online" style filters (it has
+     * no check data) and keeps every poll from re-firing trap criteria.
+     */
+    const snmpTrap: SnmpTrap | undefined = dataToProcess.snmpTrapResponse;
+
+    if (input.criteriaFilter.checkOn === CheckOn.SnmpTrapReceived) {
+      if (!snmpTrap) {
+        return null;
+      }
+
+      const expectedOid: string = String(threshold || "").trim();
+
+      if (!expectedOid) {
+        return null;
+      }
+
+      const trapOid: string = snmpTrap.trapOid;
+      let isMatch: boolean = false;
+
+      switch (input.criteriaFilter.filterType) {
+        case FilterType.EqualTo:
+          isMatch = trapOid === expectedOid;
+          break;
+        case FilterType.NotEqualTo:
+          isMatch = trapOid !== expectedOid;
+          break;
+        case FilterType.Contains:
+          isMatch = trapOid.includes(expectedOid);
+          break;
+        case FilterType.NotContains:
+          isMatch = !trapOid.includes(expectedOid);
+          break;
+        case FilterType.StartsWith:
+          isMatch = trapOid.startsWith(expectedOid);
+          break;
+        case FilterType.EndsWith:
+          isMatch = trapOid.endsWith(expectedOid);
+          break;
+        default:
+          isMatch = false;
+      }
+
+      if (isMatch) {
+        return `SNMP trap ${trapOid} received from ${snmpTrap.sourceIpAddress}.`;
+      }
+
+      return null;
+    }
+
+    if (snmpTrap) {
+      // Trap events never evaluate check-based criteria.
+      return null;
+    }
+
     let overTimeValue: Array<number | boolean> | number | boolean | undefined =
       undefined;
 
@@ -91,6 +150,108 @@ export default class SnmpMonitorCriteria {
       });
     }
 
+    // Check if any monitored interface is down (admin-up but oper-down)
+    if (input.criteriaFilter.checkOn === CheckOn.SnmpInterfaceIsDown) {
+      const interfaces: Array<SnmpInterface> | undefined =
+        snmpResponse?.interfaces;
+
+      if (!interfaces || interfaces.length === 0) {
+        return null;
+      }
+
+      /*
+       * Administratively disabled interfaces are intentionally down and
+       * never count as failures.
+       */
+      const downInterfaces: Array<SnmpInterface> = interfaces.filter(
+        (snmpInterface: SnmpInterface) => {
+          return (
+            snmpInterface.isAdministrativelyUp &&
+            !snmpInterface.isOperationallyUp
+          );
+        },
+      );
+
+      const isTrueFilter: boolean =
+        input.criteriaFilter.filterType === FilterType.True;
+      const isFalseFilter: boolean =
+        input.criteriaFilter.filterType === FilterType.False;
+
+      if (downInterfaces.length > 0 && isTrueFilter) {
+        const names: string = downInterfaces
+          .slice(0, 5)
+          .map((snmpInterface: SnmpInterface) => {
+            return snmpInterface.name;
+          })
+          .join(", ");
+        return `${downInterfaces.length} interface(s) down: ${names}${
+          downInterfaces.length > 5 ? ", …" : ""
+        }.`;
+      }
+
+      if (downInterfaces.length === 0 && isFalseFilter) {
+        return "All administratively enabled interfaces are up.";
+      }
+
+      return null;
+    }
+
+    // Check the busiest interface's utilization
+    if (
+      input.criteriaFilter.checkOn === CheckOn.SnmpInterfaceUtilizationPercent
+    ) {
+      threshold = CompareCriteria.convertToNumber(threshold);
+
+      if (threshold === null || threshold === undefined) {
+        return null;
+      }
+
+      const utilizations: Array<number> = (snmpResponse?.interfaces || [])
+        .map((snmpInterface: SnmpInterface) => {
+          return snmpInterface.utilizationPercent;
+        })
+        .filter((value: number | undefined): value is number => {
+          return typeof value === "number";
+        });
+
+      if (utilizations.length === 0) {
+        return null;
+      }
+
+      return CompareCriteria.compareCriteriaNumbers({
+        value: Math.max(...utilizations),
+        threshold: threshold as number,
+        criteriaFilter: input.criteriaFilter,
+      });
+    }
+
+    // Check the worst interface's error rate
+    if (input.criteriaFilter.checkOn === CheckOn.SnmpInterfaceErrorsPerSecond) {
+      threshold = CompareCriteria.convertToNumber(threshold);
+
+      if (threshold === null || threshold === undefined) {
+        return null;
+      }
+
+      const errorRates: Array<number> = (snmpResponse?.interfaces || [])
+        .map((snmpInterface: SnmpInterface) => {
+          return snmpInterface.errorsPerSecond;
+        })
+        .filter((value: number | undefined): value is number => {
+          return typeof value === "number";
+        });
+
+      if (errorRates.length === 0) {
+        return null;
+      }
+
+      return CompareCriteria.compareCriteriaNumbers({
+        value: Math.max(...errorRates),
+        threshold: threshold as number,
+        criteriaFilter: input.criteriaFilter,
+      });
+    }
+
     // Check if a specific OID exists (returns a value)
     if (input.criteriaFilter.checkOn === CheckOn.SnmpOidExists) {
       const oid: string | undefined =
@@ -145,8 +306,15 @@ export default class SnmpMonitorCriteria {
 
       const oidValue: string | number = oidResponse.value;
 
-      // Numeric comparison
-      if (typeof oidValue === "number" || !isNaN(Number(oidValue))) {
+      /*
+       * Numeric comparison — only when the value is genuinely numeric. Guard
+       * against empty/whitespace OctetStrings, which Number("") coerces to 0
+       * and would spuriously satisfy a "== 0" criterion.
+       */
+      const isNumeric: boolean =
+        typeof oidValue === "number" ||
+        (String(oidValue).trim() !== "" && !isNaN(Number(oidValue)));
+      if (isNumeric) {
         const numericValue: number =
           typeof oidValue === "number" ? oidValue : Number(oidValue);
         const numericThreshold: number | null =

package/Server/Utils/Monitor/IoTDeviceAbsenceSeries.ts

@@ -0,0 +1,101 @@
+import AggregatedResult from "../../../Types/BaseDatabase/AggregatedResult";
+import { JSONObject } from "../../../Types/JSON";
+import MetricSeriesResult from "../../../Types/Monitor/MetricMonitor/MetricSeriesResult";
+import MetricSeriesFingerprint from "../../../Utils/Metrics/MetricSeriesFingerprint";
+
+/*
+ * Pure helpers backing per-device "went silent" detection for IoT
+ * Device monitors — the IoT analogue of HostAbsenceSeries (which also
+ * supplies the shared monitorStepOptsIntoNoDataDetection and
+ * queriesScopeHostSubset gates; both are entity-agnostic).
+ *
+ * A group-by-device metric query only returns a series for devices
+ * that emitted rows in the evaluation window — a device that stopped
+ * reporting simply has no row, so its absence is invisible to the
+ * criteria evaluator. These helpers synthesize an empty "no data"
+ * series for every REGISTERED device (IoTDeviceCredential) missing
+ * from the current window, so the per-series NoDataPolicy path fires
+ * one correctly-labeled alert per silent device. Kept pure (no DB) so
+ * the gating and series construction are unit-testable; the worker
+ * supplies the expected-device list.
+ *
+ * Unlike hosts there is NO recency aging: registration is an explicit
+ * expected-list, so a registered-but-silent device alerts until its
+ * credential is disabled or deleted — that is the designed semantic.
+ *
+ * Device ids are handled VERBATIM: device.id datapoint labels are
+ * stored byte-exact (unlike host.name, which is canonicalized at
+ * ingest), so canonicalizing here would fork the fingerprint from the
+ * device's real series and break incident dedupe/auto-resolve.
+ */
+
+// The datapoint label that identifies a device within a fleet.
+export const IOT_DEVICE_ID_ATTRIBUTE_KEY: string = "device.id";
+
+/**
+ * If the monitor is grouped by exactly the device-id label, return
+ * that group-by key; otherwise null. Absent-device synthesis only
+ * makes sense for a pure per-device group-by.
+ */
+export function getIoTDeviceAbsenceGroupByKey(
+  groupByAttributeKeys: Array<string>,
+): string | null {
+  if (!groupByAttributeKeys || groupByAttributeKeys.length !== 1) {
+    return null;
+  }
+  const key: string = groupByAttributeKeys[0]!;
+  return key === IOT_DEVICE_ID_ATTRIBUTE_KEY ? key : null;
+}
+
+/**
+ * Build synthetic "no data" series for every registered device absent
+ * from the current window's series breakdown. Each synthetic series
+ * has empty aggregated-result slots (one per query + formula,
+ * matching how present series are shaped) so the criteria evaluator's
+ * NoDataPolicy path fires for it, and labels/fingerprint identical to
+ * what the device's present series would carry so the resulting
+ * incident dedupes and auto-resolves when the device returns.
+ */
+export function buildAbsentIoTDeviceSeries(input: {
+  presentSeries: Array<MetricSeriesResult>;
+  expectedDeviceExternalIds: Array<string>;
+  deviceKey: string;
+  slotCount: number;
+}): Array<MetricSeriesResult> {
+  const presentDevices: Set<string> = new Set<string>();
+  for (const series of input.presentSeries) {
+    const raw: unknown = series.labels?.[input.deviceKey];
+    if (raw === undefined || raw === null || String(raw) === "") {
+      continue;
+    }
+    presentDevices.add(String(raw));
+  }
+
+  const slotCount: number = Math.max(input.slotCount, 1);
+  const seen: Set<string> = new Set<string>();
+  const absentSeries: Array<MetricSeriesResult> = [];
+
+  for (const externalId of input.expectedDeviceExternalIds) {
+    const identifier: string = String(externalId);
+    if (!identifier || presentDevices.has(identifier) || seen.has(identifier)) {
+      continue;
+    }
+    seen.add(identifier);
+
+    const labels: JSONObject = { [input.deviceKey]: identifier };
+    const aggregatedResults: Array<AggregatedResult> = Array.from(
+      { length: slotCount },
+      (): AggregatedResult => {
+        return { data: [] };
+      },
+    );
+
+    absentSeries.push({
+      fingerprint: MetricSeriesFingerprint.computeFingerprint(labels),
+      labels,
+      aggregatedResults,
+    });
+  }
+
+  return absentSeries;
+}

package/Server/Utils/Monitor/MonitorAlert.ts

@@ -749,9 +749,21 @@ export default class MonitorAlert {
       input.breachingSeriesFingerprints !== undefined &&
       openSeriesFingerprint
     ) {
-      const stillBreaching: boolean = input.breachingSeriesFingerprints.has(
-        openSeriesFingerprint,
-      );
+      /*
+       * The breaching set is the matched criteria's per-series matches.
+       * On a recovery tick the matched criteria is the RECOVERY criteria
+       * and its matches are healthy series, not breaches; counting them
+       * would pin the open offline alert open forever. Membership only
+       * counts as still-breaching when the matched criteria actually
+       * creates alerts (createAlerts=false recovery criteria contributes
+       * no breaches, letting the per-series alert auto-resolve).
+       */
+      const matchedCriteriaCreatesAlerts: boolean =
+        input.criteriaInstance?.data?.createAlerts === true;
+
+      const stillBreaching: boolean =
+        matchedCriteriaCreatesAlerts &&
+        input.breachingSeriesFingerprints.has(openSeriesFingerprint);
 
       if (stillBreaching) {
         return false;

package/Server/Utils/Monitor/MonitorCriteriaEvaluator.ts

@@ -775,7 +775,7 @@ ${contextBlock}
       }
     }
 
-    if (input.monitor.monitorType === MonitorType.SNMP) {
+    if (input.monitor.monitorType === MonitorType.NetworkDevice) {
       const snmpMonitorResult: string | null =
         await SnmpMonitorCriteria.isMonitorInstanceCriteriaFilterMet({
           dataToProcess: input.dataToProcess,

package/Server/Utils/Monitor/MonitorIncident.ts

@@ -1141,9 +1141,25 @@ export default class MonitorIncident {
       input.breachingSeriesFingerprints !== undefined &&
       openSeriesFingerprint
     ) {
-      const stillBreaching: boolean = input.breachingSeriesFingerprints.has(
-        openSeriesFingerprint,
-      );
+      /*
+       * The breaching set is the matched criteria's per-series matches.
+       * Only ONE criteria wins per evaluation tick, so on a recovery
+       * tick the matched criteria is the RECOVERY criteria (e.g.
+       * Min(iot_device_up) >= 1) and its "matches" are healthy series —
+       * NOT breaches. Treating them as breaching would leave the open
+       * offline incident's fingerprint in the set and pin it open
+       * forever once no other series is down. So membership only counts
+       * as still-breaching when the matched criteria actually creates
+       * incidents (an offline/breach criteria); a recovery criteria
+       * (createIncidents=false) contributes no breaches and lets the
+       * per-series incident auto-resolve.
+       */
+      const matchedCriteriaCreatesIncidents: boolean =
+        input.criteriaInstance?.data?.createIncidents === true;
+
+      const stillBreaching: boolean =
+        matchedCriteriaCreatesIncidents &&
+        input.breachingSeriesFingerprints.has(openSeriesFingerprint);
 
       if (stillBreaching) {
         return false;

package/Server/Utils/Monitor/MonitorMetricUtil.ts

@@ -17,6 +17,7 @@ import CapturedMetric from "../../../Types/Monitor/CustomCodeMonitor/CapturedMet
 import HttpPhaseTimings from "../../../Types/Monitor/HttpPhaseTimings";
 import MonitorMetricType from "../../../Types/Monitor/MonitorMetricType";
 import PingMonitorResponse from "../../../Types/Monitor/PingMonitor/PingMonitorResponse";
+import SnmpInterface from "../../../Types/Monitor/SnmpMonitor/SnmpInterface";
 import ProbeMonitorResponse from "../../../Types/Probe/ProbeMonitorResponse";
 import ServerMonitorResponse from "../../../Types/Monitor/ServerMonitor/ServerMonitorResponse";
 import SyntheticMonitorResponse from "../../../Types/Monitor/SyntheticMonitors/SyntheticMonitorResponse";
@@ -889,6 +890,92 @@ export default class MonitorMetricUtil {
       metricNameServiceNameMap[MonitorMetricType.ResponseTime] = metricType;
     }
 
+    const snmpInterfaces: Array<SnmpInterface> | undefined = (
+      data.dataToProcess as ProbeMonitorResponse
+    ).snmpResponse?.interfaces;
+
+    if (snmpInterfaces && snmpInterfaces.length > 0) {
+      /*
+       * Cap per-check interface series to keep a single check from writing
+       * unbounded rows (large routers can expose thousands of
+       * subinterfaces). Same approach as the custom-metric cap below.
+       */
+      const interfacesToEmit: Array<SnmpInterface> = snmpInterfaces.slice(
+        0,
+        200,
+      );
+
+      if (interfacesToEmit.length < snmpInterfaces.length) {
+        logger.warn(
+          `Monitor ${data.monitorId.toString()}: emitting metrics for first ${interfacesToEmit.length} of ${snmpInterfaces.length} SNMP interfaces`,
+        );
+      }
+
+      for (const snmpInterface of interfacesToEmit) {
+        const extraAttributes: JSONObject = {
+          probeId: (
+            data.dataToProcess as ProbeMonitorResponse
+          ).probeId.toString(),
+          interfaceName: snmpInterface.name,
+          interfaceIndex: snmpInterface.interfaceIndex.toString(),
+        };
+
+        const interfaceMetrics: Array<{
+          metricName: MonitorMetricType;
+          value: number | undefined;
+          description: string;
+          unit: string;
+        }> = [
+          {
+            metricName: MonitorMetricType.SnmpInterfaceOperStatus,
+            value: snmpInterface.isOperationallyUp ? 1 : 0,
+            description: "SNMP interface operational status (1 up, 0 down)",
+            unit: "",
+          },
+          {
+            metricName: MonitorMetricType.SnmpInterfaceInBitsPerSecond,
+            value: snmpInterface.inBitsPerSecond,
+            description: "SNMP interface inbound bandwidth",
+            unit: "bps",
+          },
+          {
+            metricName: MonitorMetricType.SnmpInterfaceOutBitsPerSecond,
+            value: snmpInterface.outBitsPerSecond,
+            description: "SNMP interface outbound bandwidth",
+            unit: "bps",
+          },
+          {
+            metricName: MonitorMetricType.SnmpInterfaceUtilizationPercent,
+            value: snmpInterface.utilizationPercent,
+            description: "SNMP interface utilization",
+            unit: "%",
+          },
+          {
+            metricName: MonitorMetricType.SnmpInterfaceErrorsPerSecond,
+            value: snmpInterface.errorsPerSecond,
+            description: "SNMP interface errors per second",
+            unit: "errors/s",
+          },
+        ];
+
+        for (const interfaceMetric of interfaceMetrics) {
+          await this.pushMonitorMetric({
+            projectId: data.projectId,
+            monitorId: data.monitorId,
+            monitorName: data.monitorName,
+            probeName: data.probeName,
+            metricName: interfaceMetric.metricName,
+            value: interfaceMetric.value,
+            description: interfaceMetric.description,
+            unit: interfaceMetric.unit,
+            extraAttributes: extraAttributes,
+            metricRows: metricRows,
+            metricNameServiceNameMap: metricNameServiceNameMap,
+          });
+        }
+      }
+    }
+
     if ((data.dataToProcess as ProbeMonitorResponse).httpTimings) {
       const httpTimings: HttpPhaseTimings = (
         data.dataToProcess as ProbeMonitorResponse

package/Server/Utils/Monitor/MonitorResource.ts

@@ -5,10 +5,13 @@ import logger from "../Logger";
 import MonitorCriteriaEvaluator from "./MonitorCriteriaEvaluator";
 import MonitorLogUtil from "./MonitorLogUtil";
 import MonitorMetricUtil from "./MonitorMetricUtil";
+import NetworkInventoryUtil from "./NetworkInventoryUtil";
+import SnmpInterfaceRateUtil from "./SnmpInterfaceRateUtil";
 import DataToProcess from "./DataToProcess";
 import SortOrder from "../../../Types/BaseDatabase/SortOrder";
 import Dictionary from "../../../Types/Dictionary";
 import BadDataException from "../../../Types/Exception/BadDataException";
+import { JSONObject } from "../../../Types/JSON";
 import Semaphore, { SemaphoreMutex } from "../../Infrastructure/Semaphore";
 import IncomingMonitorRequest from "../../../Types/Monitor/IncomingMonitor/IncomingMonitorRequest";
 import MonitorCriteria from "../../../Types/Monitor/MonitorCriteria";
@@ -237,6 +240,16 @@ export default class MonitorResourceUtil {
       let probeName: string | undefined = undefined;
       const monitorName: string | undefined = monitor.name || undefined;
 
+      /*
+       * SNMP trap responses are event-driven, not check results. They are
+       * evaluated ONLY against trap criteria; they must not overwrite the
+       * last check's counters, participate in probe agreement, or reset the
+       * monitor to its default status when no criteria matches.
+       */
+      const isSnmpTrapEvent: boolean = Boolean(
+        (dataToProcess as ProbeMonitorResponse).snmpTrapResponse,
+      );
+
       // save the last log to MonitorProbe.
 
       // get last log. We do this because there are many monitoring steps and we need to store those.
@@ -275,26 +288,58 @@ export default class MonitorResourceUtil {
 
           probeName = monitorProbe.probe?.name || undefined;
 
-          await MonitorProbeService.updateOneBy({
-            query: {
-              monitorId: monitor.id!,
-              probeId: (dataToProcess as ProbeMonitorResponse).probeId!,
-            },
-            data: {
-              lastMonitoringLog: {
-                ...(monitorProbe.lastMonitoringLog || {}),
-                [(
-                  dataToProcess as ProbeMonitorResponse
-                ).monitorStepId.toString()]: {
-                  ...JSON.parse(JSON.stringify(dataToProcess)),
-                  monitoredAt: OneUptimeDate.getCurrentDate(),
-                },
-              } as any,
-            },
-            props: {
-              isRoot: true,
-            },
-          });
+          /*
+           * SNMP interface rates (bandwidth, utilization, errors/sec) are
+           * deltas against the previous check's counters — computed here,
+           * while the previous log is still available, so the computed
+           * values flow into metrics, criteria, and the stored log below.
+           */
+          if (monitor.monitorType === MonitorType.NetworkDevice) {
+            SnmpInterfaceRateUtil.attachInterfaceRates({
+              probeMonitorResponse: dataToProcess as ProbeMonitorResponse,
+              previousStepLog: (
+                monitorProbe.lastMonitoringLog as JSONObject | undefined
+              )?.[
+                (dataToProcess as ProbeMonitorResponse).monitorStepId.toString()
+              ] as JSONObject | undefined,
+            });
+
+            /*
+             * Sync the NetworkDevice/NetworkInterface inventory from the
+             * walk, then prune the response to monitored interfaces so
+             * criteria and metrics ignore muted ports. Trap events carry
+             * no walk data — nothing to sync.
+             */
+            if (!isSnmpTrapEvent) {
+              await NetworkInventoryUtil.updateFromWalk({
+                monitor: monitor,
+                dataToProcess: dataToProcess as ProbeMonitorResponse,
+              });
+            }
+          }
+
+          if (!isSnmpTrapEvent) {
+            await MonitorProbeService.updateOneBy({
+              query: {
+                monitorId: monitor.id!,
+                probeId: (dataToProcess as ProbeMonitorResponse).probeId!,
+              },
+              data: {
+                lastMonitoringLog: {
+                  ...(monitorProbe.lastMonitoringLog || {}),
+                  [(
+                    dataToProcess as ProbeMonitorResponse
+                  ).monitorStepId.toString()]: {
+                    ...JSON.parse(JSON.stringify(dataToProcess)),
+                    monitoredAt: OneUptimeDate.getCurrentDate(),
+                  },
+                } as any,
+              },
+              props: {
+                isRoot: true,
+              },
+            });
+          }
         }
       }
 
@@ -603,7 +648,12 @@ export default class MonitorResourceUtil {
       // Check probe agreement for probe-based monitors
       if (
         monitor.monitorType &&
-        MonitorTypeHelper.isProbableMonitor(monitor.monitorType)
+        MonitorTypeHelper.isProbableMonitor(monitor.monitorType) &&
+        /*
+         * Traps arrive on exactly one probe — other probes' polled state
+         * cannot corroborate them, so agreement would always veto the trap.
+         */
+        !isSnmpTrapEvent
       ) {
         const probeAgreementResult: ProbeAgreementResult =
           await MonitorResourceUtil.checkProbeAgreement({
@@ -874,6 +924,12 @@ export default class MonitorResourceUtil {
         });
       } else if (
         !response.criteriaMetId &&
+        /*
+         * A trap that matches no criteria is simply ignored — it must not
+         * reset the monitor to its default status (the polled checks own
+         * the monitor's state).
+         */
+        !isSnmpTrapEvent &&
         monitorSteps.data.defaultMonitorStatusId &&
         monitor.currentMonitorStatusId?.toString() !==
           monitorSteps.data.defaultMonitorStatusId.toString()

package/Server/Utils/Monitor/MonitorTemplateUtil.ts

@@ -245,7 +245,7 @@ export default class MonitorTemplateUtil {
         } as JSONObject;
       }
 
-      if (data.monitorType === MonitorType.SNMP) {
+      if (data.monitorType === MonitorType.NetworkDevice) {
         const snmpResponse: SnmpMonitorResponse | undefined = (
           data.dataToProcess as ProbeMonitorResponse
         ).snmpResponse;