I need clarification about how Spectrum handles traps from devices.

[lscott1_ball]

Here is my Scenario: We have a device. It's modeled in Spectrum. It has a 5 minute poll cycle. According to the device's administrator, this device stopped responding for several hours. Specrtum's OneClick Event viewer for this device showed several minor alarms (Event Type 0x22003b, 0x22003c, and 0x10701), but no critical alarm. Also there was nothing in the event viewer to suggest Spectrum had missed a polling cycle. During the outage the device was able to send SNMP traps to Spectrum. According to the device administrator Spectrum should not have been able to communicate (via SNMP or ICMP) to the device during the outage. The outage in question ran from 06:10AM on 20 March until 10:05AM 20 March.

I need clarification about how Spectrum handles traps from devices. Does Spectrum count a trap received from a device as valid communication? How long after Spectrum misses a poll does Spectrum log an error. If Spectrum receives a trap after the polling cycle will it remove/suppress a missed polling cycle from Spectrum? Does the received trap reset the clock/timer for the next polling cycle for Spectrum?

[Jason Meader]

Hi Lance,

When the device is down Spectrum will still process the traps and generate events/alarms if they are received but it does not change the polling cycle.

 

Unfortunately unless the issue happens to you again and we can grab debug (SNMP Stack debug and a couple of moot threading dumps both from the dynamic debugging on the VNM as well as a sniffer trace), I don’t think we’ll be able to give you a good answer as to why Spectrum didn’t alarm if the device truly was down.

 

Cheers

Jay