What is the potential cause of a Spectrum Cold Start Trap Storm?

Products

• Spectrum
• CA eHealth

Issue/Introduction

We have received a lot of false alarms in Spectrum for Cold Start traps.

 

We have verified there were no outages which would cause the devices to issue a Cold Start trap.

 

Environment

Release : 10.3.2+

Component : Spectrum Core / SpectroSERVER

Cause

A cold start trap for many devices with the same exact time stamp most likely indicates a singular trap was asserted across multiple device models.

Check the USMOtherIPAddesses (0x5b60004) attribute on some of the devices for the same IP address.

When a trap comes into the Spectrum server it will assert the Alarm on all devices where the source IP exists.

 

Resolution

Set UseRPAForTrapProcessing=TRUE for the devices in question.   

This can be done in bulk against multiple device models via the Spectrum attribute editor

Enabling the above will exclude the overlapping IP Addresses from being used during trap processing.

Please refer to ArticleId 140583 which is linked under the additional information section for more information.

Additional Information

When trap source IP address is found on multiple devices in Spectrum all devices with the IP receive the alert