Clear alarms with same event code using event vaiables

[Usman Bashir]

Dear fellows,

 

I want to know about that  have an event with event code 0x05c20017 that shows power traps/events and i receive two traps with different texts with same event code. now how i clear alarm according to their generation as their clearance event code is also same..

 

its the text of event

 

An "hwEntityInvalid" event has occurred, from {t} device, named {m}.

The entity is invalid.

hwBaseTrapSeverity = {T hwBaseTrapSeverity 1}
hwBaseTrapProbableCause = {T hwBaseTrapProbableCause 2}
hwBaseTrapEventType = {T hwBaseTrapEventType 3}
entPhysicalContainedIn = {I 4}
entPhysicalContainedIn.entPhysicalIndex = {o 5}
entPhysicalName = {S 6}
hwBaseTrapRelativeResource = {S 7}
hwBaseTrapReasonDescr = {S 8}

 

 please let me know how i clear these with using event variables.... i am unfamiliar with huawei formatting its deaits of huawei device.

 

kindly help.. how to work with event discrminators and clear alarms with same event code.

[Christopher Scollin]

I would use an Event Condition rule based on the HwBaseTrapSeverity varbind value. Here is a good KB on how to create an event condition rule based on a varbind value:

 

https://comm.support.ca.com/kb/How-to-create-good-condition-in-rule-Event-Condition-based-on-a-trap-varbind-value/KB000045035

 

 

[Usman Bashir]

Thanks scoch03 but severity of both events are same as i want to make both of them critical.

Can this will be done by hwbasetrapprobablecause value as these are different in each event occur with same event code.

[ackjo04]

On my 10.2.3 Linux system, I see the following.

 

The 0x05c20017 event is an out of the box event defined in the $SPECROOT/SS/CsVendor/Huawei/EventDisp file.

 

0x05c20017 E 20 A 1,0x05c20017,5

 

It is created by the hwEntityInvalid trap defined in the $SPECROOT/SS/CsVendor/Huawei/AlertMap file.

 

# hwEntityInvalid hwBaseTrapSeverity
1.3.6.1.4.1.2011.5.25.129.2.1.6.9 0x05c20017 1.3.6.1.4.1.2011.5.25.129.1.1(1,0)\
# hwBaseTrapProbableCause
1.3.6.1.4.1.2011.5.25.129.1.2(2,0)\
# hwBaseTrapEventType
1.3.6.1.4.1.2011.5.25.129.1.3(3,0)\
# entPhysicalContainedIn
1.3.6.1.2.1.47.1.1.1.1.4(4,5)\
# entPhysicalName
1.3.6.1.2.1.47.1.1.1.1.7(6,0)\
# hwBaseTrapRelativeResource
1.3.6.1.4.1.2011.5.25.129.1.4(7,0)\
# hwBaseTrapReasonDescr
1.3.6.1.4.1.2011.5.25.129.1.5(8,0)

According to the HUAWEI-BASE-TRAP-MIB where this trap is defined, this trap is sent when an entity is invalid for some reason.

 

As you can see in the configuration of the event in the EventDisp file, we apply an Event Discriminator to event variable 5 which is the entPhysicalIndex.

We also support the hwEntityResume trap which is sent when an entiry resumes from an invalid situation. This is the 0x05c20018 event which is also defined in the $SPECROOT/SS/CsVendor/Huawei/EventDisp file.

0x05c20018 E 20 C 0x05c20017,5

Notice again we have an Event Discriminator on event variable 5 which is also the entPhysicalIndex.

 

So, according to the configuration, the hwEntityResume trap should clear an alarm from the hwEntityInvalid trap if the values of Event Variable 5 are the same.

 

What version of Spectrum are you running?

 

Joe

[Usman Bashir]

Thanks JOSEPH you almost clear my vision in the scenario.

According to the information you write here is my question is:

I am using Spectrum 10.2 and  

Notice again we have an Event Discriminator on event variable 5 which is also the entPhysicalIndex.

 

So, according to the configuration, the hwEntityResume trap should clear an alarm from the hwEntityInvalid trap if the values of Event Variable 5 are the same

According to upper mentioned text spectrum match the value of entphysicalIndex at the time of clearance of event. So there is no need to use event discriminator further.

IN my Case i want to make the events of power 1 or 2 and Fan 1 nd 2 critical but if i change this event code to critical all other events lie in this event code also critical for spectrum.... thats a problem for me.....

IMG of events attached in trail.

 

like i want entPhysicalContainedIn.entPhysicalIndex = 18481156 and 18546689

i want fan and input power failure events to be critical how i can do this neglecting all others lie in same event code.....

As customers requirement is to critical the power faliure and fan failure traps. and then esclated to higher managment according to SLA so if all events lie in this Event code gone critical its a problem for me and customer also.

[ackjo04]

What I recommend is to create a custom event for both the hwEntityInvalid and hwEntityResume traps. Attach an Event Condition rule to these new events looking for either FAN or POWER in varbind 6 which is entPhysicalName. If found, generate another new custom event for both the hwEntityInvalid and hwEntityResume traps. Then set the default to the out of the box events 0x05c20017 and 0x05c20018.

Here is what I did in my lab:

1. Log into OneClick as an ADMIN user
2. Launch the Event Configuration editor
3. Find and selected the 0x5c20017 event and created two copies: 0xfff00006 and 0xfff00008
4. Find and selected the 0x5c20018 event and created two copies: 0xfff00007 and 0xfff00009
5. I removed the alarming on the 0xfff00006 event
6. I removed the alarm clear on the 0xfff00007 event
7. I changed the severity of the alarm on the 0xfff00008 event to Critical
8. I left the alarm clearing on the 0xfff00009 event
9. I configured an Event Condition rule on the 0xfff00006 event to generate event 0xfff00008 if varbind 6 is equal to either "FAN" or "POWER" and also set event 0x5c20017 to be the default event.
10. I configured an Event Condition rule ont he 0xfff00007 event to generate event 0xfff00009 if varbind 6 is equal to either "FAN" or "POWER" and also set event 0x5c20018 to be the default event.

The following are my configurations as they apear in my $SPECROOT/custom/Events/EventDisp file:

0xfff00006 E 20 R CA.EventCondition, "(regexp({v 6}, {S \"FAN\"}))" , "0xfff00008 -:-","(regexp({v 6}, {S \"POWER\"}))" , "0xfff00008 -:-","default" , "0x5c20017 -:-"
0xfff00007 E 20 R CA.EventCondition, "(regexp({v 6}, {S \"FAN\"}))" , "0xfff00009 -:-","(regexp({v 6}, {S \"POWER\"}))" , "0xfff00009 -:-","default" , "0x5c20018 -:-"
0xfff00008 E 20 A 3,0x05c20017,5
0xfff00009 E 20 C 0x05c20017,5

Notice the 0xfff00008 and 0xfff00009 events also use varbind 5 as an Event Discriminator same as the 0x5c20017 and 0x5c20018 events.

You will need to override the out of the box AlertMap file entry to use the 0xfff00006 and 0xffff7 events for the hwEntityInvalid and hwEntityResume traps.

The following are the enentries I added to $SPECROOT/custom/Events/AlertMap file:

 

# hwEntityInvalid hwBaseTrapSeverity
1.3.6.1.4.1.2011.5.25.129.2.1.6.9 0xfff00006 1.3.6.1.4.1.2011.5.25.129.1.1(1,0)\
# hwBaseTrapProbableCause
1.3.6.1.4.1.2011.5.25.129.1.2(2,0)\
# hwBaseTrapEventType
1.3.6.1.4.1.2011.5.25.129.1.3(3,0)\
# entPhysicalContainedIn
1.3.6.1.2.1.47.1.1.1.1.4(4,5)\
# entPhysicalName
1.3.6.1.2.1.47.1.1.1.1.7(6,0)\
# hwBaseTrapRelativeResource
1.3.6.1.4.1.2011.5.25.129.1.4(7,0)\
# hwBaseTrapReasonDescr
1.3.6.1.4.1.2011.5.25.129.1.5(8,0)

# hwEntityResume hwBaseTrapSeverity
1.3.6.1.4.1.2011.5.25.129.2.1.6.10 0xfff00007 1.3.6.1.4.1.2011.5.25.129.1.1(1,0)\
# hwBaseTrapProbableCause
1.3.6.1.4.1.2011.5.25.129.1.2(2,0)\
# hwBaseTrapEventType
1.3.6.1.4.1.2011.5.25.129.1.3(3,0)\
# entPhysicalContainedIn
1.3.6.1.2.1.47.1.1.1.1.4(4,5)\
# entPhysicalName
1.3.6.1.2.1.47.1.1.1.1.7(6,0)\
# hwBaseTrapRelativeResource
1.3.6.1.4.1.2011.5.25.129.1.4(7,0)\
# hwBaseTrapReasonDescr
1.3.6.1.4.1.2011.5.25.129.1.5(8,0)

 

After making these changes, update the event configuration and you should be good to go.

 

 

Joe

[Usman Bashir]

Thank you so JOSEPH ACKLEY its very helpful for me.

[Usman Bashir]

DEAR JOSEPH,

i want to change the title now of newly created Alarms 0xfff00008 but when i change title here it also chnage the parent event title that not fair. can i create new cause code for new alarm so the title is change...

 

guide me how do i set the different titles on 0x05c20017 & 0xfff00008 events.

[Usman Bashir]

I did this but the issue is that the first event occurs 0xfff00006 and secondly it dont show me variable values in them and the next events never occurs and no alarm ganerated