DX NetOps

Expand all | Collapse all

EventAdmin Models - how to forward to device

Jump to Best Answer
  • 1.  EventAdmin Models - how to forward to device

    Posted 06-01-2016 07:00 PM

    I'm still trying to get my head around what actually makes the EventAdmin models forward an alarm to a given device. Can anyone explain to me how this works when using the $SPECROOT/custom directory please?

     

    I have in my lab modeled an EventAdmin device with an IP of e.g. 192.168.1.10. I have a script which sends a trap from this host directly to the landscape with the EventAdmin model on it. I have also modeled a Pingable device with an ip of 192.168.1.1. This is the device the trap generated by the script is sending a trap about.

     

    I have in $SPECROOT/custom/Events/gen_app_gw/EventAdmin/EventDisp

     

    0xfff00000 E 20 P "CreateEventWithVariables( \
        { C CURRENT_MODEL }, \
        { H 0xfff00001 }, \
        SetEventVariable( GetEventVariableList(), { U 76620 }, \
          Append ( { S \"CPI: \" }, \
            GetRegexp( \
              GetEventVariable( { U 112 } ), \
              { S \"eventType=(.*?)\\\\(\" }, \
              { U 1 } ) ) ) )"
    0xfff00001 R CA.EventCondition, \
        "{ v 76620 } == {S \"CPI: RADIO_LOAD_PROFILE_FAILED\"}", "0xfff00009 -:-", \
        "{ v 111 } == {I 3}", "0xfff00002 -:-", \
        "{ v 111 } == {I 4}", "0xfff00002 -:-", \
        "{ v 111 } == {I 5}", "0xfff00002 -:-", \
        "default", "0xfff00008 -:-"
    0xfff00002 E 20 A { v 111 cisco.cWNotificationSeverity },0xfff00002,76620
    0xfff00008 E 20
    0xfff00009
    

     

    Everything seems to be working fine and the events and alarms are formatted in the correct way.

    I just need the alarms to be forwarded to 192.168.1.1. Currently they sit on the EventAdmin model so something I'm doing is wrong.

     

    The AlertMap file is under $SPECROOT/custom/Events/gen_app_gw/EventAdmin as well and contains:

     

    # ciscoWirelessMOStatusNotification         cWNotificationTimestamp
    1.3.6.1.4.1.9.9.712.0.1          0xfff00000 1.3.6.1.4.1.9.9.712.1.1.2.1.2(101,102)\
                                                # cWNotificationUpdatedTimestamp
                                                1.3.6.1.4.1.9.9.712.1.1.2.1.3(103,0)\
                                                # cWNotificationKey
                                                1.3.6.1.4.1.9.9.712.1.1.2.1.4(104,0)\
                                                # cWNotificationCategory
                                                1.3.6.1.4.1.9.9.712.1.1.2.1.5(105,0)\
                                                # cWNotificationSubCategory
                                                1.3.6.1.4.1.9.9.712.1.1.2.1.6(106,0)\
                                                # cWNotificationManagedObjectAddressType
                                                1.3.6.1.4.1.9.9.712.1.1.2.1.7(107,0)\
                                                # cWNotificationManagedObjectAddress
                                                1.3.6.1.4.1.9.9.712.1.1.2.1.8(8,0)\
                                                # cWNotificationSourceDisplayName
                                                1.3.6.1.4.1.9.9.712.1.1.2.1.9(109,0)\
                                                # cWNotificationDescription
                                                1.3.6.1.4.1.9.9.712.1.1.2.1.10(110,0)\
                                                # cWNotificationSeverity
                                                1.3.6.1.4.1.9.9.712.1.1.2.1.11(111,0)\
                                                # cWNotificationSpecialAttributes
                                                1.3.6.1.4.1.9.9.712.1.1.2.1.12(112,0)\
                                                # cWNotificationVirtualDomains
                                                1.3.6.1.4.1.9.9.712.1.1.2.1.14(113,0)
    

     

    I've got some SeverityMap files and some EventTable files but they are working so don't think they are faulty.

     

    Do I have the files in the correct place? Do I need to put all of the related EventDisp files in $SPECROOT/custom/Events/gen_app_gw/EventAdmin? I'm also assuming all the AlertMap and EventDisp files associated with the EventAdmin model go in this directory?

     

    I'm trying to get all this working by using the /custom - before I used to put EventAdmin under the SS directory which isn't good for upgrades, etc.

     

    I have no EventDisp or AlertMap files under $SPECROOT/custom/Events as I assume this is all done with EventAdmin and don't need any. On the oneClick I have the usual files under $SPECROOT/custom/ (CsEvFormat and CsPCause directories).

     

    The documentation has some scenario but doesn't really say which files go where when using $SPECROOT/custom - and in particular where EventDisp/AlertMap files go (Do some parts go under the $SPECROOT/custom/Events/gen_app_gw and others in $SPECROOT/custom/Events or does everything go in one place?)

     

    I can see EventType fff00002 coming in with the correct IP(192.168.1.1) and with the correct severity. Just not sure why it's not being forwarded to the Pingable Model!

     

    Anyone have any idea where I'm going wrong?

     

    Thanks,


    Frank



  • 2.  Re: EventAdmin Models - how to forward to device
    Best Answer

    Posted 06-01-2016 07:16 PM

    Frank,

    I believe what you are missing is to tell South Bound Gateway (SBG) to process the event for SBG purposes. IE forward the event to the target address (varbind 8) you have configured in the AlertMap file.

     

    What I recommend to do is the following:

    1. Move the event configurations for event id's 0xfff00000, 0xfff00001, 0xfff00002 and 0xfff00008 from the $SPECROOT/custom/Events/gen_app_gw/EventAdmin/EventDisp file to the $SPECROOT/custom/Events/EventDisp file. The only events you want to see in the $SPECROOT/custom/Events/gen_app_gw/EventAdmin/EventDisp file are the events you want processed on the EventAdmin model and the events you want processed for SBG purposes

    2. Add just the event id you want processed for SBG purposes to the $SPECROOT/custom/Events/gen_app_gw/EventAdmin/EventDisp file. In the example you mentioned, that would be event id 0xfff00000. When adding this event id to the $SPECROOT/custom/Events/gen_app_gw/EventAdmin/EventDisp file, only enter the event id 0xfff00000. Nothing more. By adding just the event id, you are telling SBG to process the event for SBG purposes.

     

    Update the event configuration after making these changes and see if the event is forwarded to the model associated with the ip address value for varbind 8.



  • 3.  Re: EventAdmin Models - how to forward to device

    Posted 06-02-2016 04:12 AM

    Thanks Joseph,

     

    I didn't quite understand the purpose of the files in gen_app_gw but this makes it a lot clearer. Many Thanks. It worked the moment I moved the EventDisp and AlertMap files to $SPECROOT/custom/Events and created just the $SPECROOT/custom/Events/gen_app_gw/EventAdmin/EventDisp file containing fff00000 event id.

     

    Regards,

     

    Frank



  • 4.  Re: EventAdmin Models - how to forward to device

    Posted 07-17-2017 03:14 PM

    How do you tell Spectrum which variable to take into account in order to assert the event to the correspondent model?