Let say that I have this case:

Im receiving traps from a system about disabling and enabling users

I want to arm a alert when specific user is disabled and rearm when user is enabled again.

SNMP varbind $8 contains info about that

Operator FileactInput - Disabled

now when someone enables that user ( FileactInput ) I want to rearm that alert.

varbind  $8 for enabling user is :

Operator  FileactInput - Enabled

Is this possible to use wildcards or something in match criteria to arm and rearm such alerts..

like "Operator % - Enabled" in criteria

Lets say I disable 3 users  and after enable 2 users then one alarm must remain active.

Other question is about notification

Can I send SNMP traps alerts to multiple emails

Like all alerts go to admin@blabla.ee and  specific user related alerts go to helpdesk@blabla.ee. Both using same MIB

bstrgrds,

Rain