DX NetOps

 View Only
Expand all | Collapse all

Configuring an alarm for only a group of devices

  • 1.  Configuring an alarm for only a group of devices

    Posted Sep 22, 2020 05:41 AM
    Hello, 

    Can you tell me please if we can configure an alarm with the traps for only a group of devices in Spectrum.
    I have cisco and ironports devices that are sending the same trap, i need to configure an alarm with this trap, but this alarm should only come up in the ironports devices.

    Is there any solution/ filter to apply for this please ?

    Thank you 

    Sara


  • 2.  RE: Configuring an alarm for only a group of devices

    Broadcom Employee
    Posted Sep 22, 2020 07:40 AM
    Sara,

    There are a couple f different options;

    You can customize the processing on a per model type basis. 

    For example, you have model type Rtr_Cisco and GnSNMPDev. They both can assert the 0x1030a event which generates the Minor Authentication Failure alarm. This is defined in the Global EventDisp file in the $SPECROOT/SS/CsVendor//IETF directory as follows:
    0x0001030a E 50 A 1,0x0001030a
    If you want to have this assert a Critical alarm if it is a Rtr_Cisco model type, then do the following:
    1. Launch OneClick as an ADMIN user
    2. Select Tools -> Utilities -> Event Configuration from the top level menu
    3. Search for and select 1030a
    4. Click on the Alarms tab and select Critical from the menu
    5. Click on the Event Options tab
        a. Click on the Override button
        b. Find and select Rtr_Cisco and click the OK button
        c. Save the changes
    6. Update the Event Configuration

    You should now see a Cisco_Router directory under the $SPECROOT/custom/Events directory. Inside the Cisco_Router directory, you should see an Rtr_Cisco directory. Inside the Rtr_Cisco directory, you should see an EventDisp file. Inside the EventDisp file, you should see the following:
     
    0x1030a E 0 A 3,0x1030a
    Now, when an Authentication Failure alarm is asserted on an Rtr_Cisco model type, it should be a Critical alarm. All others will be Minor.

    Use an Event Condition Rule

    Configure an Event Condition rule to check the value of the ModelType_Handle attribute id 0x10001 or ModelTypeName attribute id 0x10000. If a Cisco Router then generate event A if ironports generate event B.

    Joe



  • 3.  RE: Configuring an alarm for only a group of devices

    Posted Sep 22, 2020 09:45 AM
    Hello Joe, 
    Thanks for your quick response. I'm testing this solution then will let you know by the news.

    Have a nice day !

    Sara


  • 4.  RE: Configuring an alarm for only a group of devices

    Posted Sep 23, 2020 03:55 AM
    Hello Joe, 

    I tested this solution but the problem is that the both devices are not certified so there are like GNSNMPDev. ( model type name)
    Do you have any other suggestion please ?

    Thank you 
    Sara


  • 5.  RE: Configuring an alarm for only a group of devices

    Broadcom Employee
    Posted Sep 23, 2020 07:14 AM
    Sara,

    My first recommendation is to self certify the devices. https://techdocs.broadcom.com/us/en/ca-enterprise-software/it-operations-management/spectrum/10-4-2/managing-network/certifications/self-certification.html

    You can also use an Event Condition rule. Maybe check the device type attribute. If the ironports device, generate event B.

    Joe



  • 6.  RE: Configuring an alarm for only a group of devices

    Posted Sep 23, 2020 08:59 AM
    Joe, 
    Unfortunately, I can't do a self certification, I'll update to the 10.4.1 till the next month.
    I'll see with the customer if he can send to me a trap with more informations so that i can do a condition for the ironports alarms, because the trap is received with empty variables.
    Do you think that i can use the {m} variable to do the condition in the event rules please ? I have the name of the devices on it.

    thanks 

    Sara


  • 7.  RE: Configuring an alarm for only a group of devices
    Best Answer

    Broadcom Employee
    Posted Sep 23, 2020 04:03 PM
    Sara,

    Unfortunately, you cannot use the {m} variable. However, in the event condition rule you can use the Attribute ID and specify the Model_Name attribute id 0x1006e. Since this a test value I like to use the Regular Expression Operator. Below is an example. Replace the highlighted ModelName with the name of the model.


    Joe



  • 8.  RE: Configuring an alarm for only a group of devices

    Posted Sep 24, 2020 08:53 AM
    Hello Joe, 

    Thank you, that's really help me to resolve my issue.

    Have a nice day !

    Sara


  • 9.  RE: Configuring an alarm for only a group of devices

    Broadcom Employee
    Posted Sep 24, 2020 08:58 AM
    Glad I could help