How to clear an alarm automatically after a change of state?

[Erwan RAULET]

I enabled SNMP traps on my routers to receive "TMNX OSPF NG NBR STATE CHANGE" alerts. I want to receive an alarm when I lose an OSFP neighbor with the DOWN (1) state and automatically delete this alarm when its state changes to FULL (8). I modified the event corresponding to this alarm in the Event Configuration to generate a major alarm with an "Event Variable Discriminators" equal to 1 and configure "Cleared Alarm" with the same event with "Event Variable Discriminators" equal to 8 . I did not set up an Event Rule
With this configuration, when I receive an alarm, it is not automatically deleted when the neighbor state changes to FULL.
Can you tell me if my approach is the right one and how can I solve my need?

Thanks in advance

 

[Catalin Farcasanu]

You're not very coherent in your request. If you create a alarm based on a given discriminator, you should create the clearing of the alarm based on the same discriminator. You cannot have one discriminator (1) at alarm creation and another (8) at event clearance. It has to be the same var bind, as these come in pairs. 

[John OMahony]

This is not the correct use of discriminators.

 

To do what you need you will need to create an Event Condition rule for event 0x4ca0452 and create 2 new events.

The logic as follows ..

 

If event 0x4ca0452 has State = Down (1) then create event 0x1

If event 0x4ca0452 has State = Full (8) then create event 0x2

 

Event 0x1 is set up to create the alarm.

Event 0x2 is set up to clear that alarm.

 

John

[Erwan RAULET]

Thank you JohnO2 for your response. I tried your proposal but I don't receive any alarms.

Here is my configuration of the event 0x4ca0452:

and the event rule:

The event 0xfff00006 has this configuration:

and the event 0xfff00007:

With these configurations, I receive no alarm 0xfff00006. See where I could have been wrong in these?

Thank you for your help.

[Jason Volpini]

Hello Erwan

 

The condition shows "if ({v 3} == {I 1})"  - What is "v 3?" This would be defined in the Alertmap for 0x4ea0452. Please post the Alertmap for event 0x4ea0452 to see the variables listed. 

 

Also it may be helpful to look up the OID of "TMNX OSPF NG NBR STATE CHANGE" in MIB Tools and post the Info on it. in order to confirm (1) = DOWN and (8)  = FULL

 

You can also debug the event by defining an event disp error file in <SPECROOT>/SS/.vnmrc file. For example:  

 

event_disp_error_file=TMNX_OSPF_event_debug

 

The file gets created/written to <SPECROOT>/SS

 

Regards, 

Jay V

[Erwan RAULET]

Hello Jay

Here is the Event Message with the Alertmap and the event condition {v 3} is red and bold:

 

A "tmnxOspfNgNbrStateChange" event has occurred, from {t} device, named {m}.

A tmnxOspfNgNbrStateChange notification is generated when there has
         been a change in the state of a non-virtual OSPF neighbor. This
         notification should be generated when the neighbor state regresses
         (e.g., goes from Attempt or Full to 1-Way or Down) or progresses
         to a terminal state (e.g., 2-Way or Full). When an neighbor
         transitions from or to Full on non-broadcast multi-access and
         broadcast networks, the notification should be generated by the
         designated router.  A designated router transitioning to Down will
         be noted by the tmnxOspfNgIfStateChange notification.

tmnxOspfRouterId = {U 1}
tmnxOspfRouterId.vRtrID.tmnxOspfVersion.tmnxOspfInstance = {o 2}
tmnxOspfNgNbrState = {T tmnxOspfNgNbrState 3}
tmnxOspfNgNbrState.vRtrID.tmnxOspfVersion.tmnxOspfInstance.tmnxOspfNgNbrIfIndex.tmnxOspfNgNbrIfInstId.tmnxOspfNgNbrIfAreaId.tmnxOspfNgNbrRtrId = {o 4}

 

The look up of OID of "TMNX OSPF NG NBR STATE CHANGE" in MIB Tools is:

 

tmnxOspfNgNbrStateChange NOTIFICATION-TYPE
 VARIABLES {
    tmnxOspfRouterId               1.3.6.1.4.1.6527.3.1.2.36.2.1.5 TmnxOspfRouterIdTc            
    tmnxOspfNgNbrState             1.3.6.1.4.1.6527.3.1.2.36.34.1.9 INTEGER                       
  {
     down(1)
     attempt(2)
     init(3)
     twoWay(4)
     exchangeStart(5)
     exchange(6)
     loading(7)
     full(8)
  }
 }
 DESCRIPTION
 "A tmnxOspfNgNbrStateChange notification is generated when there has
         been a change in the state of a non-virtual OSPF neighbor. This
         notification should be generated when the neighbor state regresses
         (e.g., goes from Attempt or Full to 1-Way or Down) or progresses
         to a terminal state (e.g., 2-Way or Full). When a neighbor
         transitions from or to Full on non-broadcast multi-access and
         broadcast networks, the notification should be generated by the
         designated router.  A designated router transitioning to Down will
         be noted by the tmnxOspfNgIfStateChange notification."
-- 1.3.6.1.4.1.6527.3.1.3.36.0.42

And the result in the MIB Toools of "TnmxOspfNgNbrState" is:

I hope that these informations help you to understand my problem.

I also think that I need to provide an Event Variable Discriminator to distinguish each instance and maybe the variable "4".

Regards

[Jason Volpini]

hi Erwan

 

The event message is not the same as the Alertmap. The Alertmap file should be located in <SPECROOT>\SS\CsVendor\AlcatelSvcRtr\AlertMap

 

or if modified, will be in <SPECROOT>\custom\Events\Alertmap

 

Are you getting event 0x4ca0452 showing on a model? What does tmnxOspfNgNbrState = {T tmnxOspfNgNbrState 3} show on the event? 

 

Regards, 

Jay V

[Erwan RAULET]

In <SPECROOT>\SS\CsVendor\AlcatelSvcRtr\AlertMap

 

# tmnxOspfNgNbrStateChange                   tmnxOspfRouterId
1.3.6.1.4.1.6527.3.1.3.36.0.42 0x04ca0452 1.3.6.1.4.1.6527.3.1.2.36.2.1.5(1,2)\
                                                                    # tmnxOspfNgNbrState

                                                                     1.3.6.1.4.1.6527.3.1.2.36.34.1.9(3,4)

Nothing in <SPECROOT>\custom\Events\Alertmap for this event

 

Regards