search cancel

Interface alarm not correlated to Device Down


Article ID: 255965


Updated On:


CA Spectrum DX NetOps


A device down alarm is seen as root cause along with an interface on the device also showing a Critical alert.  The Device Down is not showing the interface as as symptom.


Release : Any
Component: SpectroSERVER - Fault Isolation


In the case, the following screen shot was received showing the issue:

The "BAD LINK DETECTED" alarm was asserted on the interface model on Nov 22, 2022 at 3:26:19 PM.

A  "BAD LINK DETECTED" alarm is asserted by one of the following:

- Link Down Trap
- Port Fault Correlation
- Proactively polling the interface for ifOper/Admin status using either PollPortStatus or Live Pipes/Links

The "DEVICE DOWN" alarm was asserted on the device model on Nov 22, 2022 at 3:28:08.

The "DEVICE DOWN" alarm is asserted on a model when Spectrum loses both SNMP and ICMP contact with a device model AND Fault Isolation determines it is down and just not non-contactable.

An alarm is determined to be a symptom of another alarm IF Spectrum determines one alarm is the root cause of another alarm.

In this instance, that does not apply. 

The "BAD LINK DETECTED" alarm was not caused by the "DEVICE DOWN" alarm. It was cause by one of the reasons why a "BAD LINK DETECTED" alarm is caused (as noted above) almost two minutes before Spectrum asserted the "DEVICE DOWN".

Then, almost two minutes later, Spectrum lost SNMP and ICMP contact with the device model and asserted the "DEVICE DOWN" alarm.

You will also notice in the screen shot above, the Condition of the interface model is Suppressed.

Models can have multiple conditions asserted on them at the same time. In this instance:

- The interface has a Critical Condition from the "BAD LINK DETECTED" alarm
- The interface has a Suppressed Condition because Spectrum has lost SNMP and ICMP contact with the device model so Spectrum Fault Suppression asserts a Suppressed condition on all the child models in this instance.

Spectrum shows the Condition as Suppressed in the Condition column of the Root Cause tab because a Suppressed condition is higher on the priority (for lack of a better term) of Conditions. The priority list is:

Initial - Blue
Maintenance - Brown
Suppressed - Grey
Critical - Red
Major - Orange
Minor - Yellow
Normal - Green

So in this instance, the interface has both a Suppressed AND a Critical Condition asserted so the Condition column of the Root Cause tab will show Suppressed.

Spectrum does not correlate the "BAD LINK DETECTED" alarm as a symptom of the "DEVICE DOWN" alarm. 

This is functioning as designed.