How to customise events to add specified terms to alarm or message titles based on device type

Products

• Network Observability
• Spectrum

Issue/Introduction

How can the alarm title be changed with additional terms when the event is raised on a certain device type, but not changed for all others?

For example, if we want to add the term “SNORT DEVICE : “ to the event message for event type 0x10f09 - High Aggregate CPU Utilization, when the event occurs for certain types of Cisco Devices? 

Environment

DX NetOps Spectrum all currently supported releases

Resolution

The attribute to use for identifying the device System OID is 0x117a7:

So the basic Event Procedure condition check would look like:

0x10f09 E 20 P  "If ( Equals( ReadAttribute( { C CURRENT_MODEL }, { H 0x117a7 } ), \
      { S \"1.3.6.1.4.1.9.1.2774\" } \
     ), \
   CreateEventWithVariables( \
       { C CURRENT_MODEL }, \
       { H 0xfff00000 }, \
       SetEventVariable( \
         GetEventVariableList() \
           ## Code to get event variable 7 & add "SNORT DEVICE : " to it
  ), \
  Nil() \
)"

The above uses a conditional statement that check attribute 0x117a7, if it is equal to the SysOID of the desired device (in this example - 1.3.6.1.4.1.9.1.2774), then it creates a new event (specified here as the first custom event code - 0xfff00000). This new event will copy all the attributes of the spawning event (0x10f09) but add  "SNORT DEVICE : " to it. The code to implement this fully would be:

0x10f09 E 50 P " \
  If( \
    Equals( ReadAttribute( { C CURRENT_MODEL }, \
                             { H 0x117a7  } ),   \
      { S \"1.3.6.1.4.1.9.1.2774\" } ), \
    CreateEventWithVariables( \
     { C CURRENT_MODEL }, \
      { H 0xfff00006 }, \
      SetEventVariable( \
        GetEventVariableList(), \
        { U 7 }, \
       { S \"SNORT DEVICE : \" }      )), \
            CreateEventWithVariables( \
      { C CURRENT_MODEL }, \
      { H 0xfff00007 }, \  
          GetEventVariableList()))"

0xfff00006 E 0 A 2,0xfff00006

0xfff00007

On your system, the 0xfff00006 & 0xfff00007 codes may already be taken, so you would have to create new custom ones and use those instead. The above would be placed in the custom EventDisp file, located under:

$SPECROOT/custom/Events/EventDisp

This will override the system default setup for the 0x10f09 event and will appear as follows in Event Configuration:

So the above will start the Alarm Title with "SNORT DEVICE :" and then append the rest of the title ({  U 7  }) to it as per:

NOTE: This is a customisation so is outside the scope of support. We provide this as a guidance and example but the implementation is your's to create.