Is there a correlation between a device down event and alerts on the HSRP/VRRP?
For example: HSRPGroug AtRisk, HSRPGroup AllComponentsDown.
HSRPGroup does not have Root-Cause so it doesn t do any correlation. HSRPGroup events are defined as only Events not Problems. If there is a down event reported by HSRPGroup, it is only being reported.
HSRPgroup alerts are events and no root cause analysis is available. So if a Router in an HSSRP group goes down you should expect to receive a device down event for the router and the appropriate HSSRP event listed below.
Here is an excerpt from IP Manager Reference guide:
The following event is detected for HSRPGroup and exported to the Global Manager:
- SwitchOverFailed: Indicates that traffic fails to switch from an active interface to a standby interface in an HSRPGroup and that all interfaces in the HSRPGroup are inactive.
- AllComponentsDown: Indicates that all the components in the HSRPGroup are down.
- AtRisk: Indicates that the number of functioning components <= AtRisk threshold.
- ReducedRedundancy: Indicates that at least one component is not functioning but the total number of components > AtRisk threshold.
The SwitchOver event is not used as a symptom for root-cause analysis.
The SwitchOver event is subscribed to by the Global Manager.