How can I resolve the name of a watch instance ID?

[Anon Anon]

Hi community,

I'm looking for a solution to monitor serverfarms on a F5 Loadbalancer, using Spectrum 9.2 H3
The required MIBs are already there and I build a watch to get the status of every farm. For every farm instance I get the right value. Unfortunately I just can see the instance ID in the event, not the real name. For example:

"The threshold of instance 10.118.101.114.102.97.104.114.101.110.50 of watch Serverfarm has been violated on behalf of model localhost. The watch source value 3 is equal to the threshold reference value of 3."

I know this is just the normal behavior of a watch but none of my colleagues can work with just the ID. Is there any possibility to get the translated name in my event?
I know the attribute for the farm names but I have no clue if there's a way to combine it with my watch or event file.
Does anyone here has an idea or another way to monitor these farms?


Thanks for your help!

Best regards,
Christina

[Catalin Farcasanu]

Hi Christina,

I guess that the instance is identifying a specific farm and you have a mapping of id's into TEXT information.

You can work your way with changing the events, to reference the instance to a table using the {T  } directive.

Please check section 'Referencing Attribute Values in a MIB Table' (pag 37) and 'Referencing OIDs' (pag 38) in document 'Event Configuration User Guide
r9.2 CA Spectrum® Infrastructure Manager'. You should find all required information in that document.

Regards,
Catalin.

[Anon Anon]

Hi Catalin,

first you guessed right, the instance id does identify the specific farm =).

However, thanks for your answer but I'm not sure if an Event Table will help me out.
As far as I know they're created when you map a trap, which I do not - I created a watch. Secondly they seem to be very static but I need a dynamic solution because we (de)configure serverfarms on our device every day (so there's a ongoing change in instance IDs). There is no possibility to maintain a textfile because we could not handle huge amount of work, so I have to refer on the active instance IDs.

Is there a dynamic way to do something like this or am I missing something with the Event Table solution?

Regards,

Christina

[Anon Anon]

I found a nice solution. This was not about Event Tables but Event Procedures.

I mapped my watch on a new event (ffff0098) and created a new one (ffff1002) with the help of a lot of different procedures.

0xffff0098 P \
"CreateEventWithVariables( {C CURRENT_MODEL}, {H 0xffff1002}, \
SetEventVariable( GetEventVariableList(), {U 8}, \
ToString(ReadAttributeInstance ({C CURRENT_MODEL}, {H 0x3b715e8}, \
ToObjectId( GetEventVariable ({U 8}))))))"

As you can see, I overwrite the original variable 8 (instance ID of my farm) with the name of the farm. It works well.
Maybe this solution will help someone else in the future.

Christina

[Anon Anon]

ChristinaZ wrote:

I found a nice solution. This was not about Event Tables but Event Procedures.

I mapped my watch on a new event (ffff0098) and created a new one (ffff1002) with the help of a lot of different procedures.

0xffff0098 P \
"CreateEventWithVariables( {C CURRENT_MODEL}, {H 0xffff1002}, \
SetEventVariable( GetEventVariableList(), {U 8}, \
ToString(ReadAttributeInstance ({C CURRENT_MODEL}, {H 0x3b715e8}, \
ToObjectId( GetEventVariable ({U 8}))))))"

As you can see, I overwrite the original variable 8 (instance ID of my farm) with the name of the farm. It works well.
Maybe this solution will help someone else in the future.

Christina

I have a question about this, in your case what is event fff0098, fff1002 and 3xb715e8

Thanks in advance

Regards

Frank

[Eleuthera Lewis]

0xfff0098 and 0xfff1002 are custom created events. This is detailed on page 30 of the Event Configuration User Guide.

0x3b715e8 is an attribute instance hash table on the device model. For the F5 this stores the instance ID to pool name mapping. Check your F5 models in spectrum, they should have this table.
ltmVsStatusName 0x3b715e8


I've been using a modified version of ChristinaZ's solution for several months now and it works great. We have several thousand pool member status changes daily and Event Procedures is definitely the most efficient solution to resolving names.

[Anon Anon]

Thanks for your answer

Still some questions left

I know how to create an event. From what i understand is, if 0xfff0098 is generated, it needs processing.
Is 0xfff0098 or 0xfff1002 the finale event?

I need the Poolname's in my event so i need 0x3b7119d.

But what do i need to set in the 0xfff0098 and 0xfff1002 events.

This is my final event for now:
Date = {d "%w- %d %m-, %Y - %T"}
Host = {m}
Pool = /Common/poolname (This is static, i now have 1 event per pool, this should be dynamic with the processing)
Current Active Members = {S 4}

I hope you can help me to achieve this

Thanks in advance

[Eleuthera Lewis]

Page 99 of the Event Guide details event procedures. That is the core of what is doing the name lookup.

The final event will be 0xfff1002, and your Event Format File would need to have:

Pool = /Common/poolname {I 8}

The workflow for this will happen in the following steps

1. Watch detects pool down
2. Watch initiates event 0xffff0098
3. 0xffff0098 initiates the Procedure in the EventDisp file
4. The Procedure creates a new event on the current model with event code 0xffff1002.
The Procedure populates variable 8 with the string of the pool name from attribute hash table 0x3b7119d on the current model
5. Event 0xffff1002 is displayed in the OneClick event log.

[Anon Anon]

Thanks, this makes it clear.

Still 1 questions

I created the xml file in the folder %spectrum folder%/SS/CsVendor/CA/Procedures
Do i need to restart the spectoserver process before this will work?

Thanks in advance

Regards

[Eleuthera Lewis]

Any changes to the Event Procedure should be followed with clicking the Update Event Configuration button on the VNM model for the landscape.

.

[Anon Anon]

Why did you create a xml file? Usually you just have to create some Event and PCause files and edit your EventDisp in <specroot>/custom/Events

[Anon Anon]

Ahhh that's better, now i see it on the event rules tab of the event configuration.
If the threshold is reached, its trying to process via the rule, but i get this error
An event occurred for model 'hostname' of type 'F5BigIPDev' for which no event format file exists.

on the oneclick server for both event there is a CsEvFormat.
The is how both events (0xfff004af, 0xfff00ab0) looks like
{d "%w- %d %m-, %Y - %T"} - Date = {d "%w- %d %m-, %Y - %T"}
Host = {m}
Pool = {I 8}
Current Active Members = {S 4}

(event [{e}])

This is how my EventDisp file looks like on the spectroserver
0xfff004af P \
"CreateEventWithVariables( {C CURRENT_MODEL}, {H 0xfff00ab0}, \
SetEventVariable( GetEventVariableList(), {U 8}, \
ToString(ReadAttributeInstance ({C CURRENT_MODEL}, {H 0x3b7119d}, \
ToObjectId( GetEventVariable ({U 8}))))))"

Thanks guys for helping me out

[Anon Anon]

I found a part of the problem, it was a typo. now its processing the event.
But still it's not displaying the poolname.

The event with the procedure has no event message, i tried it with a message like {I 8} or {U 8}, but that is also not working
and the final event has the variable {I 8}.

One thing i don't get, in the event procedure it using variable {U 8}, i don't know why varible u8 why not u3 for example?

Regards

Frank

[Anon Anon]

Hi community,

I'm looking for a solution to monitor serverfarms on a F5 Loadbalancer, using Spectrum 9.2 H3
The required MIBs are already there and I build a watch to get the status of every farm. For every farm instance I get the right value. Unfortunately I just can see the instance ID in the event, not the real name. For example:

"The threshold of instance 10.118.101.114.102.97.104.114.101.110.50 of watch Serverfarm has been violated on behalf of model localhost. The watch source value 3 is equal to the threshold reference value of 3."

I know this is just the normal behavior of a watch but none of my colleagues can work with just the ID. Is there any possibility to get the translated name in my event?
I know the attribute for the farm names but I have no clue if there's a way to combine it with my watch or event file.
Does anyone here has an idea or another way to monitor these farms?


Thanks for your help!

Best regards,
Christina

Hi all,

I see that I am late to this discussion, but I wanted to provide a similar solution to this F5 problem.
The attached Word doc (draft) is the solution that I developed for a globally well-known client last year;
it requires 2 watches, one to grab the pool names, and one to poll for the pool active member counts.
Of course, all the hex ID's are custom for my customer's environment, you'd have to load the MIBs yourself and use your own environment's hex IDs.

ChristnaZ's solution looks similar, and more elegant; I just wanted to provide an alternative that I know works as well.

(NOTE: I have updated the attached document with a newer version with better screen shots)

HTH,
--Mark S

Attachment(s)

f5.docx   374 KB 1 version

[Eleuthera Lewis]

I'm confused on why you needed the 2nd watch as I've done this with a single watch. Doesn't the PoolName attribute automatically update with the Device's periodic SNMP polling? Your EventProcedure does not perform a live update of the F5, just a query on the attribute database which contains whatever Spectrum received during the Device's last polling cycle.

The 2nd watch does not get called by the EventProcedure, so do you have it in the formula for the 1st watch? I really think you could delete the 2nd watch entirely and it would still work the same.

Great write up, I wish I had this when I was first tasked with renaming F5 alarms.

[Anon Anon]

@lutelewis,

The way the F5 pool tables are constructed, the "table index" is actually the decimal-encoded ASCII representation of the pool's human-readable (text) name.
The first octet is the size of the text string (N), the next N octets are the string itself.

So the OID index provided in the OP: [font=Courier New].10.118.101.114.102.97.104.114.101.110.50[font]
translates to the 10-character text name: [font=Courier New]verfahren2[font]

The active pool count is polled at [font=Courier New]1.3.6.1.4.1.3375.2.2.5.1.2.1.8.10.118.101.114.102.97.104.114.101.110.50[font]
and the text name is polled at [font=Courier New]1.3.6.1.4.1.3375.2.2.5.1.2.1.1.10.118.101.114.102.97.104.114.101.110.50[font]
The first watch looks at the pool counts, and polls on an interval;
the second watch pulls the pool names, which are only polled when an alarm is being set or cleared, so the second watch is polled on demand to populate the variable [font=Courier New]0xfff00a80[font].

It is highly possible that I over-engineered the solution,
but at the time I was unable to find a simpler method,
and once it was functional... well, you know :-)

FYI, I just found a typo in the draft document I published this morning,
so I dug up the (sanitized) official copy that I delivered to the customer (attached).
This one has a more thorough write-up, and several screen shots too!
It's a great example of using Watches, Event Procedures, and Policy Manager together.

HTH,
--Mark S

Attachment(s)

f5.docx   374 KB 1 version

[Eleuthera Lewis]

You may/probably need that since you are storing that in a custom variable. The Spectrum F5 BIGIP model types should store these names (value) and their corresponding decimal notation (Instance ID) in a predefined attribute, as referenced by the solution in the 2nd post of this thread. There a many more statistics that can be dynamically looked besides the PoolName once you have this.

But yes, if it's not broke don't try to fix it :). If only F5 sent this encoded representation in a trap so these complex workflows aren't needed.

[Anon Anon]

MarkSerencha wrote:

Hi community,

I'm looking for a solution to monitor serverfarms on a F5 Loadbalancer, using Spectrum 9.2 H3
The required MIBs are already there and I build a watch to get the status of every farm. For every farm instance I get the right value. Unfortunately I just can see the instance ID in the event, not the real name. For example:

"The threshold of instance 10.118.101.114.102.97.104.114.101.110.50 of watch Serverfarm has been violated on behalf of model localhost. The watch source value 3 is equal to the threshold reference value of 3."

I know this is just the normal behavior of a watch but none of my colleagues can work with just the ID. Is there any possibility to get the translated name in my event?
I know the attribute for the farm names but I have no clue if there's a way to combine it with my watch or event file.
Does anyone here has an idea or another way to monitor these farms?


Thanks for your help!

Best regards,
Christina

Hi all,

I see that I am late to this discussion, but I wanted to provide a similar solution to this F5 problem.
The attached Word doc (draft) is the solution that I developed for a globally well-known client last year;
it requires 2 watches, one to grab the pool names, and one to poll for the pool active member counts.
Of course, all the hex ID's are custom for my customer's environment, you'd have to load the MIBs yourself and use your own environment's hex IDs.

ChristnaZ's solution looks similar, and more elegant; I just wanted to provide an alternative that I know works as well.

(NOTE: I have updated the attached document with a newer version with better screen shots)

HTH,
--Mark S

Thanks!! with your document its now working

[Anon Anon]

Hello Frank,

There are a few event variables which are predefined. You can find them in the Watches User Guide (Event Variables, page 24). Variable 8 contains the "Instance object identifier (OID) if the watch has instances, otherwise empty".
Hope this helps to understand the procedure.