DX NetOps Manager

Expand all | Collapse all

Empty severity when generating a syslog event using REST

  • 1.  Empty severity when generating a syslog event using REST

    Posted 03-03-2017 05:42 AM

    Hello,

     

    I need to generate a syslog event (0x21001c) using the Spectrum Restful Webservices.

    I have successfully generated an event using the examples in spectrum/RestfulExamples/xml/Events but if I use the following xml file, the syslog severity in the event is empty :

     

    <?xml version="1.0" encoding="UTF-8"?>

    <rs:event-request throttlesize="10" xmlns:rs="http://www.ca.com/spectrum/restful/schema/request" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.ca.com/spectrum/restful/schema/request ../../../xsd/Request.xsd">

     

    <rs:event>

        <rs:target-models>

            <rs:model mh="0x102c11"/>

        </rs:target-models>

     

        <rs:event-type id="0x21001c"/>
        <!-- attributes/varbinds -->
        <rs:varbind id="1">FWM</rs:varbind>
        <rs:varbind id="2">2</rs:varbind>
        <rs:varbind id="3">STM_LOOP_DETECT</rs:varbind>
        <rs:varbind id="4">message</rs:varbind>

     

    </rs:event>
    </rs:event-request>

     

     

    When I send the POST request, the syslog severity is empty in the event.

    I have the event message "%FWM--STM_LOOP_DETECT: message"

    while I expect to have "%FWM-2-STM_LOOP_DETECT: message"

     

    In the event configuration, I know that the type of the variable 2 is a match table as below :

     

    %{S 1}-{T T1_210017 2}-{S 3}: {S 4}.

     

    If I check in the definition file for T1_210017 (in spectrum/SG-Support/CsEvFormat/EventTables/T1_210017_en_US), I see :

     

    0x00000001 0
    0x00000002 1
    0x00000003 2
    0x00000004 3
    0x00000005 4
    0x00000006 5
    0x00000007 6
    0x00000008 7

     

    My question is : Is there a specific syntax in the XML file to use a variable for which the type is a match table  ?

    Or can someone explain why the severity is empty in my event ?

     

    I've tried to use this :

    <rs:varbind id="2">0x00000003</rs:varbind>

    or

    <rs:varbind id="2">00000003</rs:varbind>

    but the severity in the event message is still empty.



  • 2.  Re: Empty severity when generating a syslog event using REST

    Posted 03-03-2017 04:00 PM

    Hi, Have You created that Event-Table by Your own? If yes, - have You relouded the Event-Configuration in Spectroserver/Oneclick? ... perhaps a very basic question but that problem causes the most bugs in Event-Proecssing.



  • 3.  Re: Empty severity when generating a syslog event using REST

    Posted 03-06-2017 04:56 AM

    Hi Erich,

    This is the default table for syslog events (in SG-Support directory, not in custom).

    In fact as a workaround, I could create a new event which would not use EventTable format variable but if possible I would like to use this one.