HiI need to create a watch on LOW port utilization on a port - I am using a counter delta on the ifHCIn Octets then doign a basic bit of math to get the value with a polling interval of 120 seconds
( ( COUNTER_DELTA( ifHCInOctets ) / 120 ) * 8 )
The watch has a threshold of "create event if value < 200000000
This has generally worked but every so often (well once) it had a negative value as the watch returned value (possibly due to counter roll over)
What I am trying to do is now changed the WATCH to not trigger if the value is a negative. Essentially only triger if between range 0 and 200000000
I'm working on achieving it via an EventDisp rule but wondering if the community can point me at a better way of only evaluating the value if is 0 or greater.
Maybe try something like this:
Watch Type Examples - CA Spectrum - 10.2 to 10.2.3 - CA Technologies Documentation
Or hack one of the other examples. I think you could achieve it with a couple of watches.
I thought I would delve a little deeper and make it simpler - I set the watch to use simply the COUNTER_DELTA
COUNTER_DELTA( ifHCInOctets )
I set it to evaluate every 60 seconds and captured the raw value of the ifHCInOctets and the value from the watch
Things at this point get confusing to me
The differential values on the ifHCInOctets give me "real values" as verified by using other stats checking systemsHowever - the values for the watch COUNTER_DELTA(ifHCInOctets) are rather all over the show including negative values even when the ifHCInOctets is increasing
I may be missing something obvious