Sara,
There are a couple f different options;
You can customize the processing on a per model type basis.
For example, you have model type Rtr_Cisco and GnSNMPDev. They both can assert the 0x1030a event which generates the Minor Authentication Failure alarm. This is defined in the Global EventDisp file in the $SPECROOT/SS/CsVendor//IETF directory as follows:
0x0001030a E 50 A 1,0x0001030a
If you want to have this assert a Critical alarm if it is a Rtr_Cisco model type, then do the following:
1. Launch OneClick as an ADMIN user
2. Select Tools -> Utilities -> Event Configuration from the top level menu
3. Search for and select 1030a
4. Click on the Alarms tab and select Critical from the menu
5. Click on the Event Options tab
a. Click on the Override button
b. Find and select Rtr_Cisco and click the OK button
c. Save the changes
6. Update the Event Configuration
You should now see a Cisco_Router directory under the $SPECROOT/custom/Events directory. Inside the Cisco_Router directory, you should see an Rtr_Cisco directory. Inside the Rtr_Cisco directory, you should see an EventDisp file. Inside the EventDisp file, you should see the following:
0x1030a E 0 A 3,0x1030a
Now, when an Authentication Failure alarm is asserted on an Rtr_Cisco model type, it should be a Critical alarm. All others will be Minor.
Use an Event Condition Rule
Configure an Event Condition rule to check the value of the ModelType_Handle attribute id 0x10001 or ModelTypeName attribute id 0x10000. If a Cisco Router then generate event A if ironports generate event B.
Joe
Original Message:
Sent: 09-22-2020 05:41 AM
From: Assistance GAR
Subject: Configuring an alarm for only a group of devices
Hello,
Can you tell me please if we can configure an alarm with the traps for only a group of devices in Spectrum.
I have cisco and ironports devices that are sending the same trap, i need to configure an alarm with this trap, but this alarm should only come up in the ironports devices.
Is there any solution/ filter to apply for this please ?
Thank you
Sara