We are getting a Management agent lost alarm in CA Spectrum frequently for a particular device .The alarms cleared automatically within 3 to 5 minutes.
Please guide us how can we resolve this issue? also share .
Please let me know the reason behind these alarms.
I have the same issue for one (only one) device, which is the PDU. Waiting for a hint ....
Still waiting for hint from experts can anyone guide me on this?
in case this is a single device only this may point indeed to a device problem. What you can do - ahead of a sniffer running besides the SpectroSERVER filtered for the device IP - you can verify if that device is maybe busy or stressed.
A device could be stressed by SNMP request - and to verify lower that workload check for:
- attribute "Throttling" / 0x11f79 - Boolean - and set to "yes" (default is "no") - along with
- attribute "Throttle_Count" / 0x11f39 - Integer - and set this to "5" (default is 10)
Once this is done CA Spectrum will throttle the SNMP-requests when send to the device. In addition to this - go to the Device' Component Details Information tab - find Subview "CA Spectrum Modeling Information" and set here DCM Timeout to 5000 msec (default 3000ms).
Now verify if you still see the period Management Agent lost alarms. In case you wont - then reduce DCM timeout back to i.e. 3000 - or 2000 ms. Still having no Management Agent lost then indicates truly this is a device SNMP request stress issue. Smal / SOHO devices may show that symptom - or just overloaded devices. The timeout is related to the "network" between SpectroSERVER and the device - the throttling addresses a SNMP-stress condition. So you have 2 sets of parms (network connectivty and "delay" - and the SNMP related "workload at device level") you can tune.
In case that tuning wont affect the symptom - then we have to look at the sniffer data to see if the device may return a negative response - or just "timeout" ..
Kind regards, Joerg
(It would be good to know which devices this are - that may allow CA to check into the knowledgebase.)
Thanks for the hints.
I have tried to change the throttle attributes as well as the DCM timeout, but it does not help.
We will do a test with wireshark tomorrow.
This is a Racktivity PDU device under test by us. The first one that we enter in Spectrum.
We have seen with tcpdump that the spectrum server does receive a reply from the device for each poll, but sometimes it still raise an event like:
I will open a ticket with all the details.
what's the version of Spectrum?
Were you able to poll the device during these 3 to 5 minutes from Mib tools?
Does wireshark give you the response packets?
Are the device having problem belong to same subnet? Is this happening on specific time?
Are they snmp v 3 devices?
Please find the below detail for your query-
1-Spectrum Version - 126.96.36.199.82
2-Able to Poll successfully the device during the alarm appears in the Spectrum Oneclick console.
3-wireshark is not installed on the machine so it will be installed till EOD.
4-no specific time for the alarms.
5-SNMP v2 device
Any update on this?
What is the model type? It is monitored through system edge or native snmp
Model Type - Host_systemEDGE
Model Class - Workstation Server
Device Type - systemEDGE Host
Did you capture the packets using wireshark? Any snmp response drop packets observed? If nothing there, i suggest to log a support ticket at this point of time.