The fix was to configure the AlertMap file according to what the device was sending as a trap and not as it was defined in the imported mib. This can be verified using one of two sources:
1. The Unknown Alert event will have the enterprise trap oid, the generic and specific traps id's and the varbind oid's sent from the trap. Compare this information to the information in the AlertMap file created from the trap mib
2. A sniffer trace of the raw trap. Compare the sniffer trace information to the information in the AlertMap file created from the trap mib
Unknown Alert event seen in SPECTRUM after importing trap mib
The user imported a vendor trap mib using SPECTRUM MIB Tools and created the AlertMap, EventDisp, Event Format and Probable Cause files. When one of these traps were received by SPECTRUM, SPECTRUM did not process the trap according to the definition in the files. It was processed as an Unknown Alert event on the model.
Causes of this problem:
The cause of the problem was what the vendor published in their trap mib and what the device actually sent as a trap were two different trap formats.
(Legacy KB ID CNC TS31138 )