How to generate a Syslog alarm on the interface?

Products

• Spectrum

Issue/Introduction

Cisco syslog 6.4.2 code version will include the interface information.  Does Broadcom have plans to modify the handling of the syslog alarms to associate them to the impacted interface instead of to the device?  If so, when is that release/update planned?

Example of 6.4.2 syslog:

LC/0/0/CPU0:Jul 22 16:53:07.527 UTC: pfm_node_lc[308]: %PLATFORM-SFP-2-LOW_RX_POWER_ALARM : Set|envmon_lc[143445]|0x102902a|TenGigE0/0/2/2

Highlighted portion is the interface

Environment

Release : 20.2

Component :

Cause

Configuration issue

Resolution

This can be achieved by using a combination of ParseMaps and an EventProcedure.  At this time there is no plan for a gui implementation.

Here's an example:

Example syslog:
%CDP-4-DUPLEX_MISMATCH: duplex mismatch discovered on Ethernet2/0 (not half duplex), with R13 Ethernet0/1 (half duplex).

Create a ParseMap file
ParseMap entry: $SPECROOT/SS/CsVendor/ParseMaps/CDP-4-DUPLEX-MISMATCH:

Event066e0020
duplex mismatch discovered on {STRING 1} ({STRING 2}), with {STRINGNOWS 3} {STRINGNOWS 4} ({STRING 5})

This means that event 0x066e0020 will be generated upon match with 5 event variables
Varbind 1:  Ethernet2/0
Varbind 2:  not half duplex
Varbind 3:  R13
Varbind 4:  Ethernet0/1
Varbind 5:  half duplex

Create a duplicate of Event066e0020 - in this example it will be Event066e0021.  You can do this in the Event Configuration GUI or manually copy the file (just be sure to give it a proper name that matches the other Event files):

Create the Event Procedure in the $SPECROOT/custom/Events/EventDisp:
0x066e0020 P "ForEach(\
                          GetModelsByAttrValue(\
                                   {H 0x10069},\
                                   { C CURRENT_MODEL } ),\
                                   { Variable if_handle }, \
                                   { Variable notFound },\
                                   {B true},\
                                   If ( And({Variable notFound}, Exists( ReadAttribute({ Variable if_handle }, { H 0x130d1 }))),\
                                       If ( And({Variable notFound},\
         Equals( ReadAttribute( {Variable if_handle}, {H 0x129e0}), GetEventVariable( {U 1}) )),\
            If ( And ({Variable notFound}, ReadAttribute( {Variable if_handle}, {H 0x12a54})),
                                    Prog2(\
                                                  Assign({Variable notFound}, {B false}),
                                                                             CreateEventWithVariables( {Variable if_handle}, {H 0x066e0021},\
                                                                                 GetEventVariableList())),\
                                                                                 Nil()),\
                                                                                 Nil()),\
                                                                      Nil()))"

This will:
Find all models where Device_Mdl_Handle (0x10069) is equal to the current model
That have X_ifIndex (0x130d1).   This attribute will just include interfaces.
If no prior match, see if HWComponentDescription (0x129e0) matches varbind 1 (due to interface reporting issue)
If it does, check GeneratePortStatusAlarms (0x12a54) is true
If so, CreateEventWithVariables (0x066e0021) on the model we found.
Otherwise, continue looping through the list until we succeed or exhaust

Once you have created the files and updated the EventDisp you'll need to copy those files to each SS and the Event files you created to each OC. Then on the VNM on each SS you need to go to the VNM - Component Detail - Information - SpectroSERVER Control and press the Update Event Configuration button.
Then, on each OC, navigate to the OC Administartion page, click on Administration - Update Event and Alarm Files - click the Reload button.

You'll need to create this combination for every syslog message you want to map to the interface.