System Edge log match trap processing without Southbound Gateway

Products

• CA Spectrum
• DX NetOps

Issue/Introduction

In Spectrum, the log match trap from System Edge (SysEdge) is processed by Southbound Gateway. But if a System Edge machine is discovered in Spectrum, the log match trap will not be processed by Spectrum. This solution helps you to re-configure the event 0x0116002f so that it gets processed successfully by Spectrum if you do not use the Southbound Gateway or plan not to use it in the future.

Environment

Release:
Component:

Resolution

Perform the configuration steps below in Spectrum so that the log match trap gets processed successfully. In Spectrum Event Configuration Editor there are 2 events of type 0x0116002f. One gets processed globally and the other gets processed for SysEdge machines. You need to reconfigure the SysEdge event accordingly to achieve the end result.

1. Logon to Event Configuration Editor in Spectrum OneClick console and filter for 0x0116002f event.
   
   

   

   
    
2. Observe that we have 2 events with this event code.
3. Click on the event which is processed by SysEdge. Identify this event by checking the content option in the top right panel.
4. Click on the events option in the details panel.
5. By default this event is processed by Southbound Gateway. So uncheck the option "Register the event for SBGW processing".
   
   

   

   
    
6. Save this from the File tab on the top left corner of the ECE console.
7. Now filter for the event 0x0116002f which is processed globally and have a look at the event condition rule written on it from the event options tab.
   
   

   

   
    
8. This event condition will trigger log match traps with different severities based on the event variable 107. Event variable 107 is the severity varbind inside the SysEdge log match trap.
9. Out of the box this event condition is not mapped to the SysEdge log match event. So you need to copy this event condition from the Global SysEdge log match event to the SysEdge log match event:
    
   
   1. Logon to SpectroSERVER systema s the user that owns the Spectrum installation.
   2. Navigate to $SPECROOT/SS/Csvendor/Ctron_Gen_HOST/EventDisp file.
   3. Filter for 0x0116002f event.
   4. Copy the entire condition and place it in $SPECROOT/custom/Event/Ctron_Gen_HOST/Host_systemEDGE/EventDisp file.
   
   
   
   The event condition looks like this:
   
   0x0116002f R Aprisma.EventCondition, \
   "!exists( { v 107 } )", "0x01169af4 -:-", \
   "{ v 107 } == { I 4 }", "0x01169af5 -:-", \
   "{ v 107 } == { I 5 }", "0x01169af6 -:-", \
   "{ v 107 } == { I 6 } || { v 107 } == { I 7 }", "0x01169af7 -:-", \
   "{ v 107 } == { I 2 }", "0x01169af8 -:-", \
   "default", "0x01169b01 -:-"
    
10. Save the files. Reload the event from OC Home page -> Administration -> Update Event and Alarm files.
    
    

    

    
     
11. From OC alarms console -> universe -> Filter for VNM model -> Go to component detail panel of VNM model -> SpectroSERVER Control subview -> Click on update event configuration.
    
    

    

    
     
12. Now these are the events which get generated based on the event condition written on 0x0116002f (SysEdge) event.
    
    0x01169af5 ------> Minor
    0x01169af6 ------> Major
    0x01169af7 -----> Critical