Spectrum is receiving a trap from a device with a single varbind containing two information as below:
The goal is to split the contents of this single varbind into two variables. One for the hostname and one for the status.
Variable 1: DataLogger1 or DataLogger2
Variable 2: UP or DOWN
Release : Any version
Component : SPCAEM - Events and Alarms
Event Procedure and RegEx will be used to parse a single varbind into two event variables.
The first event procedure on the 0xfff00000 event code will generate the 0xfff00001 with the variable U 101 - Status.
The second event procedure on the 0xfff00001 event code will generate the 0xfff00002 with the variable U 1 - Hostname. The variable U 1 will be used to create the event model.
Follow these steps to split the single varbind into two variables:
1) On the SpectroSERVER machine, create the $SPECROOT/custom/Events/gen_app_gw/AlertMap file with the following content:
# sbAlert #alertStatus
1.3.6.1.4.1.23257.1.100.6.0 0xfff00000 1.3.6.1.4.1.23257.1.100.1(100,0)
2) On the SpectroSERVER machine, create the $SPECROOT/custom/Events/gen_app_gw/EventDisp file with the following content:
0xfff00000 P" \
CreateEventWithVariables( \
{C CURRENT_MODEL}, \
{H 0xfff00001}, \
SetEventVariable( \
GetEventVariableList(), \
{U 101}, \
GetRegexp(GetEventVariable( \
{U 100}), \
{S \"- *(.*)\"}, \
{U 1})) \
)"
0xfff00001 P" \
CreateEventWithVariables( \
{C CURRENT_MODEL}, \
{H 0xfff00002}, \
SetEventVariable( \
GetEventVariableList(), \
{U 1}, \
GetRegexp(GetEventVariable( \
{U 100}), \
{S \"(.*)-[^-]*\"}, \
{U 1})) \
)"
0xfff00002