No alarm for File System offline with MS Windows native SNMP agent

Products

• CA Spectrum
• DX NetOps

Issue/Introduction

A File System Monitoring rule was created to generate an alarm when the File System is offline. Either when the File System (disk) is deleted or put in an offline state, no alarm is generated.

Environment

Release : 21.2

Component : Spectrum Core / SpectroSERVER

Cause

The Windows native SNMP agent is reconciling the instances/indexes of the Disk in the MIB when the Disk is either deleted or put in an offline state, hence Spectrum doesn't know if the disk is deleted or offline.

Either deleting or putting the disk offline, the Drive E is missing in hrStorageDescr (OID 1.3.6.1.2.1.25.2.3.1.3 - hrStorageDescr).

When the disk is either deleted or put in an offline state, the index/instance 4 becomes drive F, which is an active disk, hence Spectrum will not generate the alarm.

Prior to putting the volume/disk offline (Drive_E_online.walk file):

• OID: 1.3.6.1.2.1.25.2.3.1.3.4 is E:\ Label:New Volume  Serial Number 42eaa31f
• OID: 1.3.6.1.2.1.25.2.3.1.3.5 is F:\ Label:New Volume  Serial Number 36028267

After putting the volume/disk offline (Drive_E_offline.walk file):

• OID: 1.3.6.1.2.1.25.2.3.1.3.4 is F:\ Label:New Volume  Serial Number 36028267

https://oidref.com/1.3.6.1.2.1.25.2.1.4 (hrStorageFixedDisk)
https://oidref.com/1.3.6.1.2.1.25.2.3.1.2 (hrStorageType)
https://oidref.com/1.3.6.1.2.1.25.2.3.1.3 (hrStorageDescr)
https://oidref.com/1.3.6.1.2.1.25.3.2.1.5 (hrDeviceStatus) 

Drive_E_online.walk 

1.3.6.1.2.1.25.2.3.1.2.2      , ObjectID    , 1.3.6.1.2.1.25.2.1.4
1.3.6.1.2.1.25.2.3.1.2.4      , ObjectID    , 1.3.6.1.2.1.25.2.1.4
1.3.6.1.2.1.25.2.3.1.2.5      , ObjectID    , 1.3.6.1.2.1.25.2.1.4 

1.3.6.1.2.1.25.2.3.1.3.2      , OctetString , C:\ Label:  Serial Number 1e3770d3
1.3.6.1.2.1.25.2.3.1.3.4      , OctetString , E:\ Label:New Volume  Serial Number 42eaa31f
1.3.6.1.2.1.25.2.3.1.3.5      , OctetString , F:\ Label:New Volume  Serial Number 36028267 

1.3.6.1.2.1.25.3.2.1.5.2      , Integer     , 2
1.3.6.1.2.1.25.3.2.1.5.4      , Integer     , 2
1.3.6.1.2.1.25.3.2.1.5.5      , Integer     , 2 

Drive_E_offline.walk 

1.3.6.1.2.1.25.2.3.1.2.2      , ObjectID    , 1.3.6.1.2.1.25.2.1.4
1.3.6.1.2.1.25.2.3.1.2.4      , ObjectID    , 1.3.6.1.2.1.25.2.1.4 

1.3.6.1.2.1.25.2.3.1.3.2      , OctetString , C:\ Label:  Serial Number 1e3770d3
1.3.6.1.2.1.25.2.3.1.3.4      , OctetString , F:\ Label:New Volume  Serial Number 36028267
1.3.6.1.2.1.25.2.3.1.3.5      , OctetString , Virtual Memory 

1.3.6.1.2.1.25.3.2.1.5.2      , Integer     , 2
1.3.6.1.2.1.25.3.2.1.5.4      , Integer     , 2
1.3.6.1.2.1.25.3.2.1.5.5      , Integer     , 2

Resolution

The workaround is to use the SystemEDGE agent rather than the MS Window native SNMP agent.

Additional Information

https://community.broadcom.com/enterprisesoftware/communities/community-home/digestviewer/viewthread?GroupId=1675&MessageKey=4ecce17f-aea0-44ef-9640-6b932dec3963