Watch on a value that changes

[Anon Anon]

So I have a situation I can't quite figure out how to write a test for an was wondering if anyone could help...

 

I have a situation when a device changes state, however I don't care what the state is, just that it has changed (It could be active to standby or standby to active).  To compound the fact, this is a Display String.  I tried an EoC, but need to apply a threshold to it for alarm.  I don't care which state it's in, only that it has changed state:

 

state = "active"

Changed to "standby"

Alarm...

and

state = "active"

changed to "standby"

Alarm.

 

Anyone have any insight on how I might do this?  Applying a threshold to the variable on an EoC won't work because I don't know what the previous state was and I really don't care, only that it changed.  I can't throw an event or a alarm without applying a threshold, so I'm not sure what that threshold should be since it can be either state, it's really dependent on the previous state.  I did change the variable in the database to be database, memory and polled, but I'm stuck on how to produce this alarm.

 

        Thanks

 

             David

[ackjo04]

David,

What is the exact Spectrum attribute you are trying to use for this?

Joe

[Anon Anon]

In this case its in CHECKPOINT-MIB.  It's specifically the Hastate variable.  I need to know when either or both of the firewalls transition there state.  We've had a number of firewalls transition state due to errors as of late, and I'm trying to figure out a way to sense when one of both of an HA pair of firewalls fails.  This was the only variable that I could find that would give us the current state.

 

           Dave

[ackjo04]

Dave,

I think I have a solution for you. I did this in my lab using the sysContact attribute and it worked. There should be no reason it does not work for hastate.

First, I needed to create a reference attribute. I used the Model Type Editor (MTE) to create a database text attribute on the Root model type called "Reference" with a default value I know the sysContact value on my model would never be.

I then created  the following watch on my test model type (Rtr_Cisco) with the following parameters:

 

Name	Test4
Developer ID	0xffff0000
Author	ackjo04
Last Modified Time:	Nov 18, 2013 11:16:46 AM EST
Model Type	Rtr_Cisco
Data Type	Text String
Expression	sysContact
Instance	None
Active By Default	Yes
Evaluate	By Change
Inheritable	Yes
Threshold	Threshold violated if value != Reference . Threshold reset if value == Reference . Generate Critical alarm with cause code 0xfff00001 . Alarm is user clearable. Watch will be reset upon user clearing of alarm.

Notice in the above watch, the Evaluate is set to "By Change" (Evaluate On Change - EoC) and the Threshold violated is my "Reference" attribute. Also, the watch is set to be User Clearable and to reset upon user clearing the alarm.

In order for an EoC watch to work, Spectrum has to actually read the value of the attribute to see if the value has changed from the previous time that attribute was read. This can be done by manually reading the attribute using the Attribute Browser or by putting the attribute in a OneClick subview so the value is read when the subview is viewed by a user. However, I am assuming you would want Spectrum to read it periodically by itself with no user action required.

I accomplished this by creating another watch that reads the value of sysContact every 60 seconds. The following are the watch parameters:

 

Name	Read_sysContact
Developer ID	0xffff0000
Author	ackjo04
Last Modified Time:	Nov 18, 2013 11:00:42 AM EST
Model Type	Rtr_Cisco
Data Type	Text String
Expression	sysContact
Instance	None
Active By Default	Yes
Evaluate	By Polling every 0 Days + 00:01:00
Inheritable	No
Threshold	None

After doing the above, when the value fo sysContact changed for my model, I received the standard "Threshold Violated" event 0x480004. I did specify to user a custom Probable Cause with the Alarm Title "HASTATE HAS CHANGED"

When the alarm is cleared, since reset upon user clearing the alarm is set, the next time it changes, the alarm will be reasserted.

Hope this helps.

Joe

[Eleuthera Lewis]

We use the following watch to monitor checkpoint HA state

Name	watchChkPtHAMismatch
Developer ID	0xffff0000
Author	elewis1
Last Modified Time:	Jul 17, 2013 1:19:14 PM EDT
Model Type	Host_Device
Data Type	Boolean
Expression	( ( ( ( ( haState == "standby" ) & ( haIdentifier == 1 ) ) | ( ( haState == "active" ) & ( haIdentifier == 2 ) ) ) | ( haState == "initializing" ) ) | ( haState == "Ready" ) )
Instance	None
Active By Default	No
Evaluate	By Polling every 0 Days + 00:05:00
Inheritable	Yes
Threshold	Threshold violated if value == TRUE . Threshold reset if value != TRUE . Generate Major alarm with cause code 0xfff00003 . Alarm is user clearable. Watch will not be reset upon user clearing of alarm.

 

Here is my documentation on why and how this works. We have a large firewall environment and its been 100% accurate.

"checks active for nodes configured as primary and standby for nodes configured as secondary"

 

Primary reason this works: haIdentifier is hardcoded per FW

 

Why is this coded assembly style?

watch expressions do not allow string conversion. using boolean of a text compare is a way around this

 

Checks OIDS:

SNMPv2-SMI::enterprises.2620.1.5.6.0 haState (text-string of standby state)

SNMPv2-SMI::enterprises.2620.1.5.8.0 haIdentifier (integer of what firewall is configured to be, 1 for primary, 2 for secondary)

 

all possible combinations:

node-01 active 0*1+1*0+0+0 Result: 0

node-01 standby 0*1+1*0+0+0 Result: 1

node-01 ready 0*1+1*0+0+0 Result: 1

node-01 init 0*1+1*0+0+0 Result: 1

node-02 active 1*0+0*1+0+0 Result: 1

node-02 standby 0*0+1*1+0+0 Result: 0

node-02 ready 0*0+0*1+1+0 Result: 1

node-02 init 0*0+0*1+0+1 Result: 1