DX NetOps

 View Only
  • 1.  CA SPECTRUM TRAP STORM WORKING procedure

    Posted Nov 13, 2019 02:28 AM
    Hello All,

    yesterday i face an issue with the juniper router in which its Routing engine malfunctioned and switched to backup RE. but there the issue is i am unable to get the trap from that router as first there is an event of    "Device LHR-GT-BNG-MX48-1-re0 of type JuniperJUNOSRtr is no longer responding to primary management requests (e.g. SNMP), but appears to be responsive to other communication protocol (e.g. ICMP)." and then after few second there was an alarm of trap storm maybe due to which the traps are discarded.

    i want to know the complete working of trap storm feature...
    our enviornment values are: 20 traps/sec and threshold limit 5s. these are default.
    kindly guide about the working and will it discard all the traps in 5 seconds and then when it will normal the traps receiving after once it get suppressed.


    Thanks



    ------------------------------
    [Resident Enginner ]
    [PTCL]
    [ISlamabad]
    ------------------------------


  • 2.  RE: CA SPECTRUM TRAP STORM WORKING procedure
    Best Answer

    Broadcom Employee
    Posted Nov 14, 2019 09:18 AM
    Hi Liaquat,

    It is in the CA Spectrum guide.
    https://techdocs.broadcom.com/content/broadcom/techdocs/us/en/ca-enterprise-software/it-operations-management/spectrum/10-3-2/managing-network/modeling-and-managing-your-it-infrastructure/vnm-attributes-in-the-information-tab.html

    How Trap Storm Detection Works

    The SpectroSERVER can block the processing of traps that are coming from managed and unmanaged devices when a threshold is reached. Excessive traps that are coming at a high rate can take down your SpectroSERVER and Archive Manager. You can enable the trap storm detection at your SpectroSERVER or at the level of a modeled device. When devices that are modeled in CA Spectrum send more than 20 traps per second, you must adjust traps_per_sec_storm_threshold so that trap storm detection does not limit the ability to receive traps.
    You can enable the trap storm detection at any level by configuring the following two attributes. These attributes are available under the Attributes in the Component detail pane for the selected VNM model or for a selected device model:
    • traps_per_sec_storm_threshold
      Defines the rate at which traps are received per second from a managed or unmanaged device. When this rate is sustained for the amount of time that is specified by the TrapStormLength, the SpectroSERVER stops the processing of traps from that unmanaged or managed device.
      Default: 20 traps per second

    • TrapStormLength
      Defines the time in seconds for which the traps_per_sec_storm_threshold value is sustained. SpectroSERVER considers it a trap storm and disables the processing of traps from that unmanaged or managed device.
      Default: 5 seconds
    When traps received from any device reach the configured thresholds, the SpectroSERVER identifies this rate as a trap storm. The SpectroSERVER stops handling traps from that device and traps from other devices are not blocked. SpectroSERVER trap storm detection logic is based on each IP address of an unmanaged or a managed device (trap source) that sends traps to SpectroSERVER. As a result, you can configure each device to send traps to the SpectroSERVER at the appropriate rate.

    NOTE:
    SpectroSERVER does not stop the processing of unmanaged traps when the overall trap storm rate from all the unmanaged devices exceeds the single trap storm threshold rate of an unmanaged device. As a result, you can configure each unmanaged device to send traps to the SpectroSERVER at the appropriate rate.


    ------------------------------
    Technical Support Engineer IV
    Broadcom Inc
    ------------------------------



  • 3.  RE: CA SPECTRUM TRAP STORM WORKING procedure

    Posted Mar 26, 2021 06:29 AM
    Hello All,

    i have changed the Traps_per-Second_storm_threshold  attribute to 40 from VNM  component detail tab and then attributes  and Trapstornlength attribute to 15.

    but when i select a device in unvierse and then open its component detail tab and then attributes the value are still default 20  and 5.

    Can we change a storm limit on device individually?
    and what the purpose of this VNM attributes because there is no change in device same attributes?

    ------------------------------
    [Resident Enginner ]
    [PTCL]
    [ISlamabad]
    ------------------------------



  • 4.  RE: CA SPECTRUM TRAP STORM WORKING procedure

    Broadcom Employee
    Posted Mar 26, 2021 06:40 AM
    When you change the traps_per_sec_storm_threshold and TrapStormLength on the VNM model, they are applicable for unmanaged traps (from devices that are not modeled in Spectrum).
    You have to change the traps_per_sec_storm_threshold and TrapStormLength on each modeled device where you need to increase the values.

    ------------------------------
    Technical Support Engineer IV
    Broadcom Inc
    ------------------------------



  • 5.  RE: CA SPECTRUM TRAP STORM WORKING procedure

    Posted Mar 26, 2021 11:20 AM
    Hello,

    thank you for your provided information! so i want to change the trap storm threshold for model devices there is any global attribute for this?
    or this needs to change against every modeled device? it's a huge task as model devices count is large!

    ------------------------------
    [Resident Enginner ]
    [PTCL]
    [ISlamabad]
    ------------------------------



  • 6.  RE: CA SPECTRUM TRAP STORM WORKING procedure

    Broadcom Employee
    Posted Mar 26, 2021 11:28 AM
    Why would you need to change the traps_per_sec_storm_threshold and TrapStormLength to all models?

    ------------------------------
    Technical Support Engineer IV
    Broadcom Inc
    ------------------------------



  • 7.  RE: CA SPECTRUM TRAP STORM WORKING procedure

    Posted Mar 30, 2021 06:11 AM
    Actually, in our environment we have configured many alarms through traps. so whenever any card on router is faulty or malfunctioned all its interfaces going down and that node sending traps of links down and card faluty and maybe power source issue and spectrum take it as trap storm and drop all the traps and we missed the actual card malfunctioned alarms or power suppply faulty alarms so team never able to know that card is faulty as no ticket is generated because no alarm appears!

    ------------------------------
    [Resident Enginner ]
    [PTCL]
    [ISlamabad]
    ------------------------------