How to split a single trap varbind into two variables

Products

• Spectrum
• Network Observability

Issue/Introduction

Spectrum is receiving a trap from a device with a single varbind containing two information as below:

OID : 1.3.6.1.4.1.23257.1.100.1  DataLogger1-DOWN
OID : 1.3.6.1.4.1.23257.1.100.1  DataLogger1-UP
OID : 1.3.6.1.4.1.23257.1.100.1  DataLogger2-DOWN
OID : 1.3.6.1.4.1.23257.1.100.1  DataLogger2-UP

 

The goal is to split the contents of this single varbind into two variables. One for the hostname and one for the status.

Variable 1: DataLogger1 or DataLogger2

Variable 2: UP or DOWN

Environment

Release : Any version

Component : SPCAEM - Events and Alarms

Resolution

Event Procedure and RegEx will be used to parse a single varbind into two event variables.

The first event procedure on the 0xfff00000 event code will generate the 0xfff00001 with the variable U 101 - Status.

The second event procedure on the 0xfff00001 event code will generate the 0xfff00002 with the variable U 1 - Hostname. The variable U 1 will be used to create the event model.

Follow these steps to split the single varbind into two variables:

1) On the SpectroSERVER machine, create the $SPECROOT/custom/Events/gen_app_gw/AlertMap file with the following content:

# sbAlert          #alertStatus
1.3.6.1.4.1.23257.1.100.6.0 0xfff00000 1.3.6.1.4.1.23257.1.100.1(100,0)

2) On the SpectroSERVER machine, create the $SPECROOT/custom/Events/gen_app_gw/EventDisp file with the following content:

0xfff00000 P" \

CreateEventWithVariables( \

{C CURRENT_MODEL}, \

{H 0xfff00001}, \

SetEventVariable( \

GetEventVariableList(), \

{U 101}, \

GetRegexp(GetEventVariable( \

{U 100}), \

{S \"- *(.*)\"}, \

{U 1})) \

)"

0xfff00001 P" \

CreateEventWithVariables( \

{C CURRENT_MODEL}, \

{H 0xfff00002}, \

SetEventVariable( \

GetEventVariableList(), \

{U 1}, \

GetRegexp(GetEventVariable( \

{U 100}), \

{S \"(.*)-[^-]*\"}, \

{U 1})) \

)"

0xfff00002