How to create an Event Condition to Spectrum process an event differently for a specific Model Type Name

Products

• CA Spectrum
• DX NetOps

Issue/Introduction

On some of the devices, if the NEW OSPF LS ADVERTISEMENT ORIGINATED alarm is generated we want a Major severity instead of the default Minor severity. 

Can the alarm severity be modified based on the Model Type Name?

• Event Code: 0x22003b
• Event Message: An ospfOriginateLsa trap has been received for router {O 1}.  The LSA type is {T ospfLsdbType 2}, the LSA ID is {O 3}, and the originating router is {O 4}.
• Alarm Title: NEW OSPF LS ADVERTISEMENT ORIGINATED

Environment

Release : 21.2

Component :

Resolution

The proposal is creating an event condition to evaluate the Model Type Name when the 0x22003b event code occurs. If it is SwCiscoIOS, then it will generate a new custom 0xfff00000 event code which will generate a Major alarm. If not, then it will generate a new custom 0xfff00001 event code which will generate a Minor alarm.

1. In the Event Configuration Editor, select the Event Code in question (0x22003b), select the Event Rules TAB, and click on the button to create an Event Condition:

2. Click on the "+" sign to add an Event Condition:

3. Select the following options:

• Attribute ID: 0x10000 (Modeltype_Name attribute ID)
• Operator: Equal To
• String: SwCiscoIOS (Modeltype_Name)
• Generate Event: 0xfff00000 (next custom event code available in your environment)

And click on the "Insert Criterion" button.

4. Then click on the OK button.

5. Click on the "+" sign to add the default Event Condition:

6. Select the following options:

• Operator: Default
• Generate Event: 0xfff00001 (next custom event code available in your environment)

And click on the "Insert Criterion" button.

7. Then click on the OK button.

8. Then click on the OK button.

9. The Event Condition was created:

10. Set the Major severity, Cause Code, Event Variable Discriminators, and the Alarm Title for the 0xfff00000 event code:

11. Select the "Store Event in Historical Database"

12. Set the Minor severity, Cause Code, Event Variable Discriminators, and the Alarm Title for the 0xfff00001 event code:

13. Select the "Store Event in Historical Database"

14. Disable the alarm for the 0x22003b event code and save the change.

 

All the steps performed in the Event Configuration Editor will create these entries in the the $SPECROOT/custom/Events/EventDisp file:

0x22003b E 30 R CA.EventCondition, "({a 0x10000} == {S \"SwCiscoIOS\"})" , "0xfff00000  -:-","default" , "0xfff00001  -:-"
0xfff00000 E 0 A 2,0x22003b,4
0xfff00001 E 0 A 1,0x22003b,4