Send different traps with same event code

[Legacy User]

Hi,

 

I want to send different traps with same event code.

For this I worked on made changes to alert map and event disp file in /usr/Spectrum/custom/Events directory.

However the alarms was not generated.

 Any suggestion for this issue will accept.

 

 

Thanks,

Geetika

[kupga03]

Hi Geetika,

 

May i know the reason why you are looking for the same event code for different trap also need to understand what changes you did in the alert map and event disp file so that it will be easy to guide you further.

 

Regards

Ganesan.

[Legacy User]

Hi,

 

I saw document about sending different traps with one event code so I just want to implement that scenario.

In alert map file wrote code for sending the trap

1.3.6.1.4.1.22110.2.6.42 0xfff00010 1.3.6.1.4.1.22110.2.1(1,0)\
                                                          1.3.6.1.4.1.22110.2.2(2,0) 

 

Eventdisp:

0xfff00010 A 1,0xfff00010

 

Whenever I sent a trap it give a trap with trap occurrence will increase.Is there any possibility to send different trap with same event  code.

 

Thanks,

Geetika

[Christophe_Sperandio]

Ok, first you need to be clear on the way it works. Spectrum deals with trap this way:

 

TRAP ==> Spectrum Event (with an event code) ==> [Spectrum Event]* ==> [Spectrum Alarm] (with an alarm code = cause code)

 

The dichotomy which exists between an Event and an Alarm is very important. So, when you map several traps on the same event, you will have a specific event for each trap received, there is no deduplication in event. Then, if that event generates an alarm, you have deduplication, and in that case, the counter of occurrences might increase for each reception.

 

Now, there are several ways to deal with your situation, but first, we need to understand why you want to do that. What's the business case behind this?

Then, you can use either "discriminants" in the event configuration, you can also trigger an event rule on the initial event (here event 0xfff00010 in your example) and then generate different events based on conditions, or you can also trigger an event procedure. The decision relies on what you're trying to achieve at the end.

[Rajashekar Allala]

Geetika,

 

As per my understanding, you are getting confused with the trap Id and the varbinds.

Below what you mentioned are not multiple/different traps. The left to the event ID is trap OID and the right to teh event ID are the OIDs that contain the varbinds. When a trap is generated, it sends the data/values in the form of varbinds.

 

Trap mapping is correct in AlertMap file.

1.3.6.1.4.1.22110.2.6.42 0xfff00010 1.3.6.1.4.1.22110.2.1(1,0)\
                                                          1.3.6.1.4.1.22110.2.2(2,0)

 

Eventdisp:

0xfff00010 A 1,0xfff00010

 

This will log the event temporally and will not store in DDMDB. To get it logged in DDMDB, change this to 

0xfff00010 E 0 A 1,0xfff00010

 

Here E is used to log the event in DDMDB and 0 is the event severity. If no value is mentioned, spectrum uses "0" as default value.

 

Now, coming to the alarm part.

Hope, you have given the alarm title to the cause code 0xfff00010. Otherwise, you will get the alarms as "ALARM TITLE" --> In your case minor alarm as you are using the alarm severity 1..

 

To update/add the alarm title, use event configuration editor (Tools --> Utilities --> Event Configuration). Search for the event 0xfff00010 and update the alarm title at "Type" field on the Details panel.

 

Also, to display the varbinds properly in the event message, you need to have either event format file under /usr/Spectrum/custom/Events/CsEvFormat/ directory created or use the Event configuration Editor to update the event message.

 

Below is an example:

If you use the event format file, Navigate to /usr/Spectrum/custom/Events/CsEvFormat/

create a file as "Eventfff00010_en_US" and update the file with below content.

 

{d "%w- %d %m-, %Y - %T"} - Event/Trap generated from [Application Name]

[Field/Variable_Name1]: {S 1}
[Field/Variable_Name2]: {S 2}

(event [{e}])

 

Note: Here fill the Application name (optional), Feild/Variable_Name1 and 2 with proper text.

 

If you use the event configuration editor, search for event 0xfff00010 and update the event message with the above text. on the contents panel.

 

 

You are saying that, there is no alarm generated. Did you at least see the raw trap on the device events tab in spectrum?

 

Whenever I sent a trap it give a trap with trap occurrence will increase. Please clarify this statement.

From where are you sending the trap and what is increasing? Screenshot will help here to understand more on this and help you further.

 

Hope this helps.

 

Cheers,

Rajashekar

[Silvio Okamoto]

Hi Geetika,

 

When the first trap is sent, CA Spectrum will assert the Minor Alarm (as per your setting: A 1).

When the second trap is sent (to the same destination), CA Spectrum will increment the Occurrence field (to 2) of the alarm generated in the first trap, hence no new alarm will be asserted.

 

One option to have a new alarm asserted is using the Event Variable Discriminator and having a different value in each trap. Or select the "Generate a Unique Alarm for Each Event" option.

 

Take a look at this guide:

Working with Events and Alarms - CA Spectrum - 10.2 to 10.2.2 - CA Technologies Documentation 

 

Thanks,

Silvio

 

[Christophe_Sperandio]

Could you be a little bit preciser on what didn't work please? You should be able to put several entries in the AlertMap going to the same Event Code... Did you notice any errors in the logs?

[Anon Anon]

moving this thread to the CA Spectrum community.  

geethika  please be sure to follow that community   thank you !

[Philippe Baldy]

Hi geethika. It is not easy to understand what you want because you use sometimes the wrong terminology.

What you want ist to become two Alarms when two traps of the same type come. Silvio wrote the right thing:

  Or select the "Generate a Unique Alarm for Each Event" option.

 

In the EvenDisp it is with the flag U:

0xfff00010 A 1,0xfff00010,U

 

You could also use one of your 2 varbinds as discriminator attribute. Suppose the first variable discriminates the alarms:

0xfff00010 A 1,0xfff00010,1

[Legacy User]

Hi,

 

I am able to send different traps with same event code.Here I am using varbinds to send the different traps.

0x056e1128 E 50 A 2,0x056e1128,1,2

 

Thanks,

Geethika