set counter for specific alert which are generate from all devices

[Rangaswamy Jupalle]

Hi All,

we are processing "port err disabled" syslog on spectrum, i would like to setup threshold/counter when its crossed 100 "port err disabled" from all devices and generate some other alert.

please let me know if anyone such kind of configuration 

[Catalin Farcasanu]

Rephase the request so it can be understood. Syslog in Spectrum means traps, so Event Processing. You also seem to want something related with multiple devices, not just one. 

------------------------------
Cătălin Fărcășanu
Senior Consultant
SolvIT Networks
------------------------------

[Rangaswamy Jupalle]

When multiple devices generated same alert(port error disables) and alert count hits 100, then I need notification in the form of new alert

[Raj.A]

Spectrum does not support cross-device alarm threshold based new alarm creation out of the box.

To achieve this, you may need to write a custom script to query the alarm table or using the REST API  to count the number of active alarms of a specific type across all devices. Once the defined threshold is breached, the script can trigger a new alarm on VNM model or on a specific model designated for this.

Additionally, you have not specified whether the threshold count should be based only on active alarms or if it should also include historical alarms over a specific time period.

Thank you.

Rajashekar

[Robert Kettles]

You might be able to do this with Condition Correlation.  I would need more details but there is a rule that will use count to trigger a condition/alarm on a correlation domain indicating that you have 100 or more of these events/alarms and then make all of the individual occurrences symptoms of the alarm on the correlation domain.