How to split a single trap varbind into two variables
Article ID: 192939
Updated On:
Products
Issue/Introduction
Spectrum is receiving a trap from a device with a single varbind containing two information as below:
OID : 1.3.6.1.4.1.23257.1.100.1 DataLogger1-UP
OID : 1.3.6.1.4.1.23257.1.100.1 DataLogger2-DOWN
OID : 1.3.6.1.4.1.23257.1.100.1 DataLogger2-UP
We want to split the content of this single varbind into two variables. One for the hostname and another for the status.
Variable 1: DataLogger1 or DataLogger2
Variable 2: UP or DOWN
These are the events generated on the EventAdmin model:
Environment
Release : 10.4.1
Component : SPCAEM - Events and Alarms
Resolution
Event Procedure and RegEx will be used to parse a single varbind into two event variables.
The first event procedure on the 0xfff00000 event code will generate the 0xfff00001 with the variable U 101 - Status.
The second event procedure on the 0xfff00001 event code will generate the 0xfff00002 with the variable U 1 - Hostname. The variable U 1 will be used to create the event model.
Follow these steps to split the single varbind into two variables:
1) On the SpectroSERVER machine, create the $SPECROOT/custom/Events/gen_app_gw/AlertMap file with the following content:
# sbAlert #alertStatus
1.3.6.1.4.1.23257.1.100.6.0 0xfff00000 1.3.6.1.4.1.23257.1.100.1(100,0)
2) On the SpectroSERVER machine, create the $SPECROOT/custom/Events/gen_app_gw/EventDisp file with the following content:
0xfff00000 P" \
CreateEventWithVariables( \
{C CURRENT_MODEL}, \
{H 0xfff00001}, \
SetEventVariable( \
GetEventVariableList(), \
{U 101}, \
GetRegexp(GetEventVariable( \
{U 100}), \
{S \"- *(.*)\"}, \
{U 1})) \
)"
0xfff00001 P" \
CreateEventWithVariables( \
{C CURRENT_MODEL}, \
{H 0xfff00002}, \
SetEventVariable( \
GetEventVariableList(), \
{U 1}, \
GetRegexp(GetEventVariable( \
{U 100}), \
{S \"(.*)-[^-]*\"}, \
{U 1})) \
)"
0xfff00002
3) On the SpectroSERVER machine, create the $SPECROOT/custom/Events/gen_app_gw/EventAdmin/EventDisp file with the following content:
0xfff00002
4) On the SpectroSERVER machine, create the $SPECROOT/custom/Events/gen_app_gw/EventModel/EventDisp file with the following content:
0xfff00002 E 20 A { v 101 OSIsoft.OSI_sbAlert },0xfff00002
5) There are the event messages for the custom events:
6) The 0xfff00002 event code has an event Condition to either generate a Critical alarm or clear it, based on the value of variable 101 (UP / DOWN). The OSI_sbAlert SeverityMap file located in $SPECROOT/custom/Events/OSIsoft/SeverityMaps/ directory defines the conditional alarm severity.
7) When the traps with the following varbinds are received, Spectrum will create the associated EventModel and generate the critical alarms:
DataLogger1-DOWN
DataLogger2-DOWN
8) When the traps with the following varbinds are received, Spectrum will clear the critical alarms:
DataLogger1-UP
DataLogger2-UP
Additional Information
You can also download the attached Events-split-varbind.zip file, extract and save in the $SPECROOT/custom/Events/ directory of SpectroSERVER and OneClick machines to quickly validate the customization to split the single varbind into two variables.
These files are from Windows environment. So if you going to use them in a Linux environment, you will need to convert those text files.
1) The CsEvFormat and CsPCause folders should be placed in the OneClick machine, in $SPECROOT/custom/Events/ directory.
The gen_app_gw and OSIsoft folders should be placed in the SpectroSERVER machine, in $SPECROOT/custom/Events/ directory.
2) On the OneClick Administration web page, update the Event and Alarm files.
3) On the SpectroSERVER, on the VNM model, update the Event Configuration files under the SpectroSERVER Control subview.
Event Data Template Fiels:
Parse a Single Varbind into Multiples Event Variables:
Attachments
Feedback
