Sam,
I am not familiar with the SNOW integration but if it uses AlarmNotifier you can use SANM to age the alarm before sending it to AlarmNotifier.
If you can configure which alarms to send to SNOW, you can ADD an even pair rule to the 0x10d35 event looking for the 0x10d30 event to be generated within nnn seconds. If the 0x10d30 event is not generated within nnn seconds, generate a new custom critical event and send that one to SNOW. Your new event/alarm could be "Device lost contact for more than 5 minutes".
Make sure the 0x10d30 event clears your custom alarm.
You can ADD to the out of the box configuration of the 0x10d35 event as long as you do not change the out of the box behavior.
I did the following in the lab (I set the timer to 60 seconds not 300 for testing):
0xfff00034 E 0 A 3,0xfff00034,N
0x00010d30 E 50 C 0x00010003 C 0x00010004 C 0x00010007 C 0x00010009 C 0x003d0000 C 0xfff00034
0x00010d35 E 75 A 3,0x00010009,N R CA.EventPair, 0x10d30, "0xfff00034 -:-", 60
Here are the results:
Original Message:
Sent: 12-10-2019 11:43 AM
From: Samuel Johnson
Subject: Spectrum - DEVICE HAS STOPPED RESPONDING TO POLLS
In our environment these alerts go off non stop and we have an integration with SNOW for auto-ticketing.
This causes an issue because by the time an engineer goes to check the alert has already cleared.
We had to turn off auto-ticketing for this particular which isn't ideal.
I tried created an event rule to address the issue but I was advised that it could cause irregular behavior with Spectrum.
DCM Timeout only goes to 1 minute so that isn't helpful. Polling is 5 minutes by default and we can't push that much further.
Has anyone seen this issue and addressed it?
------------------------------
Thanks
Sam Johnson
------------------------------