How to split a single trap varbind into two variables

book

Article ID: 192939

calendar_today

Updated On:

Products

CA Spectrum

Issue/Introduction

Spectrum is receiving a trap from a device with a single varbind containing two information as below:

OID : 1.3.6.1.4.1.23257.1.100.1  DataLogger1-DOWN
OID : 1.3.6.1.4.1.23257.1.100.1  DataLogger1-UP
OID : 1.3.6.1.4.1.23257.1.100.1  DataLogger2-DOWN
OID : 1.3.6.1.4.1.23257.1.100.1  DataLogger2-UP
 

We want to split the content of this single varbind into two variables. One for the hostname and another for the status.

Variable 1: DataLogger1 or DataLogger2

Variable 2: UP or DOWN

 

These are the events generated on the EventAdmin model:

Environment

Release : 10.4.1

Component : Spectrum Core / SpectroSERVER

Resolution

Event Procedure and RegEx will be used to parse a single varbind into two event variables.

The first event procedure on the 0xfff00000 event code will generate the 0xfff00001 with the variable U 101 - Status.

The second event procedure on the 0xfff00001 event code will generate the 0xfff00002 with the variable U 1 - Hostname. The variable U 1 will be used to create the event model.

Follow these steps to split the single varbind into two variables:

1) On the SpectroSERVER machine, create the $SPECROOT/custom/Events/gen_app_gw/AlertMap file with the following content:

# sbAlert          #alertStatus
1.3.6.1.4.1.23257.1.100.6.0 0xfff00000 1.3.6.1.4.1.23257.1.100.1(100,0)

2) On the SpectroSERVER machine, create the $SPECROOT/custom/Events/gen_app_gw/EventDisp file with the following content:

0xfff00000 P" \

CreateEventWithVariables( \

{C CURRENT_MODEL}, \

{H 0xfff00001}, \

SetEventVariable( \

GetEventVariableList(), \

{U 101}, \

GetRegexp(GetEventVariable( \

{U 100}), \

{S \"- *(.*)\"}, \

{U 1})) \

)"

0xfff00001 P" \

CreateEventWithVariables( \

{C CURRENT_MODEL}, \

{H 0xfff00002}, \

SetEventVariable( \

GetEventVariableList(), \

{U 1}, \

GetRegexp(GetEventVariable( \

{U 100}), \

{S \"(.*)-[^-]*\"}, \

{U 1})) \

)"

0xfff00002

3) On the SpectroSERVER machine, create the $SPECROOT/custom/Events/gen_app_gw/EventAdmin/EventDisp file with the following content:

0xfff00002

4) On the SpectroSERVER machine, create the $SPECROOT/custom/Events/gen_app_gw/EventModel/EventDisp file with the following content:

0xfff00002 E 20 A { v 101 OSIsoft.OSI_sbAlert },0xfff00002

5) There are the event messages for the custom events:

6) The 0xfff00002 event code has an event Condition to either generate a Critical alarm or clear it, based on the value of variable 101 (UP / DOWN). The OSI_sbAlert SeverityMap file located in $SPECROOT/custom/Events/OSIsoft/SeverityMaps/ directory defines the conditional alarm severity.

7) When the traps with the following varbinds are received, Spectrum will create the associated EventModel and generate the critical alarms:

 DataLogger1-DOWN

 DataLogger2-DOWN

8) When the traps with the following varbinds are received, Spectrum will clear the critical alarms:

 DataLogger1-UP

 DataLogger2-UP

Additional Information

You can also download the attached Events-split-varbind.zip file, extract and save in the $SPECROOT/custom/Events/ directory of SpectroSERVER and OneClick machines to quickly validate the customization to split the single varbind into two variables.

These files are from Windows environment. So if you going to use them in a Linux environment, you will need to convert those text files.

1) The CsEvFormat and CsPCause folders should be placed in the OneClick machine, in $SPECROOT/custom/Events/ directory.

The gen_app_gw and OSIsoft folders should be placed in the SpectroSERVER machine, in $SPECROOT/custom/Events/ directory.

2) On the OneClick Administration web page, update the Event and Alarm files.

3) On the SpectroSERVER, on the VNM model, update the Event Configuration files under the SpectroSERVER Control subview.

 

Event Data Template Fiels:

https://techdocs.broadcom.com/content/broadcom/techdocs/us/en/ca-enterprise-software/it-operations-management/spectrum/10-4-1/integrating/southbound-gateway-toolkit/the-event-data-template/event-data-template-fields.html

 

Parse a Single Varbind into Multiples Event Variables:

https://techdocs.broadcom.com/content/broadcom/techdocs/us/en/ca-enterprise-software/it-operations-management/spectrum/10-4-1/managing-network/event-configuration/how-to-use-procedures-in-event-processing/parse-a-single-varbind-into-multiple-event-variables.html

Attachments

1592171201991__Events-split-varbind.zip get_app