DX NetOps

 View Only
  • 1.  What Cisco Syslog trap proceduces event 0x210c0e?

    Posted Jun 14, 2018 03:51 PM

    I can't find an AlertMap entry for the trap that produced event 0x210c0e or an EventDisp entry.  Spectrum is obviously processing something to produce this event.  What is the Cisco Syslog trap that produces this event?  Event 0x210c0e has an event rule to determine which severity alarm to create:  

     

    If event 0x210c0e occurs,
    if strcmp({v 3} {S POWERSUPPLYBAD }) evaluates to TRUE, then generate 0x0021001b.
    else if ({v 2} == {I 1} || {v 2} == {I 2}) evaluates to TRUE, then generate 0x0021001c.
    else if ({v 2} == {I 3} || {v 2} == {I 4}) evaluates to TRUE, then generate 0x0021001b.
    else if ({v 2} == {I 5}) evaluates to TRUE, then generate 0x0021001a.
    else if ({v 1} == {S SYS } && {v 2} == {I 6} && {v 3} == {S CONFIG_I }) evaluates to TRUE, then generate 0x00821029.
    else default evaluates to TRUE, then generate 0x00210017.

     

    I'd really like a better understanding of how this event is received and processed within Spectrum.  There is very little information in the 10.2 documentation about this event.  Any additional information would be greatly appreciated.



  • 2.  Re: What Cisco Syslog trap proceduces event 0x210c0e?
    Best Answer

    Broadcom Employee
    Posted Jun 14, 2018 08:54 PM

    Hi John,

     

    Event 0x210c0e is the default event to create for Syslog traps. If Spectrum cannot find any event to map the Syslog traps from the following three files or in the custom folder, Spectrum would generate this Syslog Event 0x210c0e.

     

     

    $SPECROOT>/SS/CsVendor/Ctron_CAT/Switch.txt

    $SPECROOT>/SS/CsVendor/CiscoPIX/Pix.txt

    $SPECROOT>/SS/CsVendor/Cisco_Router/Rtr.txt

     

    Please let me know if you have any questions.

    Yan



  • 3.  Re: What Cisco Syslog trap proceduces event 0x210c0e?

    Broadcom Employee
    Posted Jun 15, 2018 03:40 PM

    Hi John,

                  Maybe this helps?

     

    The trap comes in formatted as such:

     

    FACILITY-SEVERITY-MNEMONIC: Message-text

     

    It then parses these files for a match (depending on modeltype.  If you customize them, I always recommend just adding the same entry to all 3 files):

     

    $SPECROOT>/SS/CsVendor/Ctron_CAT/Switch.txt

    $SPECROOT>/SS/CsVendor/CiscoPIX/Pix.txt

    $SPECROOT>/SS/CsVendor/Cisco_Router/Rtr.txt

     

    If no match is found, it then processes to 0x210c03.

    Cheers

    Jay