Client services related to SNMP:
Site services related to SNMP:
Site processes not running as a service related to SNMP:
SmsExec thread components related to SNMP:
The net start command will display the service name SNMP Service, but it will also respond to the simpler SNMP when you are controlling it from the command line.
The SMS functionality for Windows NT event to trap translation is a DLL extension (SNMPELEA.DLL) to the SNMP service with the process name of SNMP and service name of SNMP service. The SMS extension to the SNMP service uses the Windows NT file SNMPAPI.DLL. As one thread reads the Windows NT event log, translates events, and adds SNMP traps to a list to be sent, another thread reads the list and has the SNMP service send the trap, and deletes it from the list. This second thread is sometimes called the trap sender. As the list grows, more memory is allocated to the SNMP service. After all the traps have been sent, the memory allocation will return to the original level, and the SNMP service idles. Since the Event to Trap Translator adds traps to the list faster than it sends them, a big burst can add quite a bit of memory allocation to the SNMP service.
The SMS feature trap translator is the TRAPFLTR thread component in SmsExec. TRAPFLTR starts SNMPTRAP.EXE after SmsExec starts TRAPFLTR. SNMPTRAP.EXE receives SNMP traps sent to that client, and passes them to the thread component TRAPFLTR in SmsExec. As the client receives traps, SNMPTRAP.EXE shows CPU activity. TRAPFLTR decides whether to write the trap to the database, or discard it. If it is a burst of traps, TRAPFLTR will get behind, and the memory allocation for SmsExec will grow. As the traps are discarded or written to the database, the memory allocation for SmsExec will be released and return to the original level.
If the Windows NT event log is set to a small size and to overwrite events as needed, and there is a burst of events, the Event to Trap Translator can fall behind and lose traps if they are overwritten before it translates the event.
If a client is sending traps to itself, use Network Monitor (running on a separate computer) to monitor the activity.