Spectrum clear alert does not work when varbind discriminators do not match
Article ID: 258538
Updated On:
Products
Issue/Introduction
We are trying to map traps from a custom mib to generate and clear alarms in Spectrum.
The alert raised based on combination of 2 variable fields in 0xfff00000 and is working as expected.
However clear alert which is also based on a combination of the same 2 variables oxfff00001 is not working.
Environment
Release : 21.2
Cause
The raise and clear traps have the trap varbinds defined differently, so when mapped in Spectrum, they are given varbinds.
Currently they are seen in the alertMap as:
# alarmRaise currentAlarmId
1.3.6.1.4.1.637.65.1.1.2.6.1 0xfff00000 1.3.6.1.4.1.637.65.1.1.1.2.1.1(1,0)\
# friendlyName
1.3.6.1.4.1.637.65.1.1.1.2.1.2(2,0)\
# eventTime
1.3.6.1.4.1.637.65.1.1.1.2.1.3(3,0)\
# eventType
1.3.6.1.4.1.637.65.1.1.1.2.1.4(4,0)\
# probableCause
1.3.6.1.4.1.637.65.1.1.1.2.1.5(5,0)\
# perceivedSeverity
1.3.6.1.4.1.637.65.1.1.1.2.1.6(6,0)\
# additionalText
1.3.6.1.4.1.637.65.1.1.1.2.1.7(7,0)\
# specificProblems
1.3.6.1.4.1.637.65.1.1.1.2.1.8(8,0)\
# acknowledgementStatus
1.3.6.1.4.1.637.65.1.1.1.2.1.9(9,0)\
# reserveStatus
1.3.6.1.4.1.637.65.1.1.1.2.1.10(10,0)\
# additionalInformation
1.3.6.1.4.1.637.65.1.1.1.2.1.11(11,0)\
# neLocationName
1.3.6.1.4.1.637.65.1.1.1.2.1.12(12,0)\
# managedobjectInstance
1.3.6.1.4.1.637.65.1.1.1.2.1.13(13,0)\
# acknowledgementUserName
1.3.6.1.4.1.637.65.1.1.1.2.1.14(14,0)\
# asIdentity
1.3.6.1.4.1.637.65.1.1.1.2.1.15(15,0)
# alarmClear currentAlarmId
1.3.6.1.4.1.637.65.1.1.2.6.2 0xfff00001 1.3.6.1.4.1.637.65.1.1.1.2.1.1(1,0)\
# eventTime
1.3.6.1.4.1.637.65.1.1.1.2.1.3(2,0)\
# friendlyName
1.3.6.1.4.1.637.65.1.1.1.2.1.2(3,0)\
# probableCause
1.3.6.1.4.1.637.65.1.1.1.2.1.5(4,0)\
# asIdentity
1.3.6.1.4.1.637.65.1.1.1.2.1.15(5,0)
The clear alarm varbinds must match the create alarm varbinds if you want to clear based on the varbinds. We document this here:
Clearing Alarms
You can specify that an event can clear any of the following types of alarms:
An alarm with a specific alarm cause code that was created without event discriminators.
All alarms with a specific alarm cause code that were created based on event discriminators if their variable values match the variables in the alarm-clearing event.
All alarms with a specific alarm cause code that were created based on event discriminators regardless of whether their variable values match those in the alarm-clearing event.
Clear Alarms Based on Event Discriminator Values
In the context of clearing alarms, event discriminators are the IDs of the event variables to examine in the alarm-clearing event and an alarm to determine whether to clear the alarm as a result of the event.
Recall that the event variable IDs are mapped (in the AlertMap file) to the OIDs of the variable bindings that are sent with the trap, and their values are copied from the alarm-generating event to the alarm if the alarm is generated as a result of examination of their values.
Because the values of event variables are also stored in the alarms that are generated based on events, you can use event discriminators to differentiate multiple occurrences of an alarm and clear alarms that are based on the values of the variables. More specifically, the alarm can be cleared if the values in the alarm-clearing event match the values that are stored in the alarm.
Resolution
To change this in Spectrum go to the custom alertMap at
Spectrum/custom/Events/AlertMap
Change the varbinds to match each other.
- change the clear to
# alarmClear currentAlarmId
1.3.6.1.4.1.637.65.1.1.2.6.2 0xfff00001 1.3.6.1.4.1.637.65.1.1.1.2.1.1(1,0)\
# eventTime
1.3.6.1.4.1.637.65.1.1.1.2.1.3(3,0)\
# friendlyName
1.3.6.1.4.1.637.65.1.1.1.2.1.2(2,0)\
# probableCause
1.3.6.1.4.1.637.65.1.1.1.2.1.5(5,0)\
# asIdentity
1.3.6.1.4.1.637.65.1.1.1.2.1.15(15,0)
2. save the AlertMap
3. In Event configuration, change the clear event to
A "alarmClear" event has occurred, from {t} device, named {m}.
Notification that an alarm has been cleared
currentAlarmId = {I 1}
eventTime = {S 3}
friendlyName = {S 2}
probableCause = {S 5}
asIdentity = {S 15}
keep the variable discriminators as 2,5 in both
4. Save the event
Feedback
