Creating a WATCH to ignore any negative value

[Jason Hebron]

Hi
I need to create a watch on LOW  port utilization on a port - I am using a counter delta on the ifHCIn Octets then doign a basic bit of math to get the value with a polling interval of 120 seconds

 

( ( COUNTER_DELTA( ifHCInOctets ) / 120 ) * 8 )

 

The watch has a threshold of "create event if value < 200000000

This has generally worked but every so often (well once) it had a negative value as the watch returned value (possibly due to counter roll over)

What I am trying to do is now changed the WATCH to not trigger if the value is a negative. Essentially only triger if between range 0 and 200000000

I'm working on achieving it via an EventDisp rule but wondering if the community can point me at a better way of only evaluating the value if is 0 or greater.

 

Thanks

[Jason Meader]

Maybe try something like this:

Watch Type Examples - CA Spectrum - 10.2 to 10.2.3 - CA Technologies Documentation 

 

Or hack one of the other examples. I think you could achieve it with a couple of watches.

Cheers

Jay

[Jason Hebron]

I thought I would delve a little deeper and make it simpler - I set the watch to use simply the COUNTER_DELTA

 COUNTER_DELTA( ifHCInOctets )

I set it to evaluate every 60 seconds and captured the raw value of the ifHCInOctets and the value from the watch

Things at this point get confusing to me 

The differential values on the ifHCInOctets give me "real values" as verified by using other stats checking systems
However - the values for the watch COUNTER_DELTA(ifHCInOctets) are rather all over the show including negative values even when the ifHCInOctets is increasing

I may be missing something obvious