CA Spectrum - generating alarms every third poll period

[Ivan Gasparec]

Hi all,

 

I'm completly new in CA spectrum, so please have understanding :-)

I have situation that Spectrum sometimes generates the alarm that device has stopped respondig to polls, but that was only for one poll and it responded in next one.

 

So I want to adjust the CA Spectrum to generates the alarms only if he can't poll the device in three poll periods in a row.

Also, same thing could be used for the CPU or Memory usage. I don't want to receive the alarm if in one poll period my CPU usage is at 95%, but I want to receive an alarm if my CPU usage is at 95% for a 15 minutes (poll period is 5 minutes).

 

Thanks!

[Cristi Mitrana]

For the CPU monitoring, the thresholds are already set up like this (%x usage and duration Y seconds), so there's nothing to change. For the device stopped responding to polls, you can modify the Event generating the alarm to disable the alarm and then use a Sequence Rule to generate a new Alarm when 3 'Device stopped responding to Polls' occurs.

However, I wouldn't modify the default rule - if your SNMP agent stops responding every x poll cycles, this indicates either a network problem for a SNMP agent malfunctioning.

[Robert Kettles]

Some thing else to be aware of is that by default, a poll cycle in Spectrum isn't just a single poll.  There are two attributes called DCM timeout and DCM retry count.  With the default values, when Spectrum doesn't get a response from a device, it will retry 3 times with 3000 milliseconds (3 seconds) between the retries for that poll cycle.  Only if those fail will Spectrum say a device has stopped responding to polls.  You can adjust those values for the devices that are having issues but be aware that doing so will delay the time that Spectrum is aware of that device being down.  If you're sending out notifications from Spectrum and really want to wait 15 minutes (assuming the poll interval is 300 seconds) then you can configure SANM policies to wait for that period before sending out notifications.  The alarms would still appear in Spectrum but it would cut down on the number of emails/tickets/etc. being generated.  Hope that helps.

 

-Rob

[Ivan Gasparec]

Thanks Robert, I think that using the SANM policies is the best way to resolve this.

If I create a filter (filtered by Alarm Type) under SANM policy only for this one type of the alarm, with the AgeTime of 15 minutes, is that mean that all other alarms will be sent instantly?

[Robert Kettles]

You'll also want to make sure that you have a filter that excludes that one alarm type and has 0 for the AgeTime.  Then you'll you'll get the behavior you're looking for.