Enable monitoring for Syslog event PCE_PEER_STATE_CHANGE

Products

• Network Observability
• Spectrum

Issue/Introduction

Steps to implement syslog events to alarm monitoring 

Environment

Spectrum : Any version

Resolution

• Spectrum offers the ability to map the syslog message to a specific event based on the tuple <facility> <severity> <mnemonic>
• Based on the ModelHandle Type of your devices, you need to use one of the syslog-to-event mapping files.
• If its Cisco Router with ModelHandle Type 0x21000c, then we need to use the Rtr.txt file under $SPECROOT/custom/Events/
• Here are the detailed steps to implement: 
  1. Create 3 new custom events using the Event Configuration, Let's consider you get the event codes from 0xfff00011 to 0xfff00013 (please change values based on your created events)
  2. Save the events and close the window.
  3. Create a file Rtr.txt under $SPECROOT/custom/Events (if it does not exist) in SpectroServer and add the following line 

     OS-XTC 5 PCE_PEER_STATE_CHANGE 0xfff000011

     Note: Replace the event code in with the code of the first event you created.                                                                                               
  4. Edit the EventDisp file custom/Events/ folder in all the SpectroServers and replace the lines for the new events with these ones

     0xfff00011 P "If( Regexp( GetEventVariable( { U 4 } ), { S \"PCEP Peer (.*) state changed to Down\" } ), CreateEventWithVariables( { C CURRENT_MODEL }, { H 0xfff00012 }, SetEventVariable( GetEventVariableList( { C CURRENT_EVENT } ), { U 6 }, GetRegexp( GetEventVariable( { U 4 } ), { S \"PCEP Peer (.*) state changed to (.*)\" }, { U 1 } ) ) ), CreateEventWithVariables( { C CURRENT_MODEL }, { H 0xfff00013 }, SetEventVariable( GetEventVariableList( { C CURRENT_EVENT } ), { U 6 }, GetRegexp( GetEventVariable( { U 4 } ), { S \"PCEP Peer (.*) state changed to (.*)\" }, { U 1 } ) ) ) )"
     
     0xfff00012 E 0 A 2,0xfff00012,6
     
     0xfff00013 E 0 C 0xfff00012,6

     Note: Replace the event codes with the code of the first, second and third events you created (0xfff00011 with the first event, 0xfff00012 with the second, 0xfff00013 with the third one)

  5. Reload events in the VNM model for every SpectroServer                                                                                                                                                                                                    
  6. Open the Event Configuration, search the first event 0xfff00011 and configure the below Event Message. 

     %{S 1}-{T T1_210017 2}-{S 3}: {S 4}.

  7. For the second event 0xfff00012, change the Event Message to look like this

     PCEP Peer {S 6} state changed to Down

  8.  Also update the Alarms tab for the second event to like below ( Note: change severity if needed)
  9.  For the third event 0xfff00013, change the Event Message to look like this

     PCEP Peer {S 6} state changed to Up

  10. For the third event, set the second event as the cleared event by third event                                                                                                                                                         

  11. Now save the 3 events in the Event Configuration tool and reload Events files in the Administration of the OneClick Administration page. 

Additional Information

Please use the following trap commands to test the above:

• To raise the alarm

  snmptrap -v 2c -c public <ss>:162 '' 1.3.6.1.4.1.9.9.41.2.0.1 1.3.6.1.4.1.9.9.41.1.2.3.1.2 s "OS-XTC" 1.3.6.1.4.1.9.9.41.1.2.3.1.3 i 6 1.3.6.1.4.1.9.9.41.1.2.3.1.4 s PCE_PEER_STATE_CHANGE 1.3.6.1.4.1.9.9.41.1.2.3.1.5 s "PCEP Peer x.x.x.x state changed to Down" 1.3.6.1.4.1.9.9.41.1.2.3.1.6 t 173814422100 1.3.6.1.6.3.18.1.3.0 a <ip>

 

• To clear the alarm

  snmptrap -v 2c -c public <ss>:162 '' 1.3.6.1.4.1.9.9.41.2.0.1 1.3.6.1.4.1.9.9.41.1.2.3.1.2 s "OS-XTC" 1.3.6.1.4.1.9.9.41.1.2.3.1.3 i 6 1.3.6.1.4.1.9.9.41.1.2.3.1.4 s PCE_PEER_STATE_CHANGE 1.3.6.1.4.1.9.9.41.1.2.3.1.5 s "PCEP Peer x.x.x.x state changed to Up" 1.3.6.1.4.1.9.9.41.1.2.3.1.6 t 173814422100 1.3.6.1.6.3.18.1.3.0 a <ip>

 

Note: Replace <ss> and <ip> with the IP address of the SpectroServer and the IP address of the device respectively.