Generate Port Flapping Alarm on Interface Rather than Device

Products

• Network Observability

Issue/Introduction

Out of the box Spectrum will generate port flapping alarms when it sees an interface link up / link down 15 times within  a five minute period. How can this be raided on the
   the port model instead of the device?


Out of the box logic:


It does this by using an Event Series Sequence rule on the 0x220002 Link Up event. If 0x220002 (link up) is followed by 0x220001 (link down) within 60 seconds generate 0x220006.





The 0x220006 has an Interface Flap rule applied to it out of the box. If event 0x220006 is seen 15 times in a 5 minute window generate event 0x220007.





0x220007 alarms on the device

 

 

 

Resolution

We can generate the event on the port model by reconfiguring event 0x220007 not to alarm and then configuring an Event Procedure which will find the
    interface and raise a new event on the interface model which can be configured to alarm.

0x220007 E 30 P "ForEach( \     GetModelsByRelationName({ C CURRENT_MODEL }, { S \"HASPART\" }, {C RELATION_SIDE_RIGHT}), \     {Variable if_handle},  \     {Variable ret}, \     {U 0}, \     If( \       Equals( GetEventVariable( { U 1 }), ReadAttribute( { Variable if_handle }, { H 0x130d1 } ) ), \       CreateEventWithVariables( { Variable if_handle }, { H 0xffff0000 }, GetEventVariableList() ), \       Nil() \     ) \ )"

The above entry can be copied andc written to the $SPECROOT/custom/Events/EventDisp file. Make sure that there are not any spaces after the back slash escape 
   at the end of each line as these escape the new line and compilation would then error.

Note: You will need to replace the custom event id 0xffff0000 with the next custom event id in your own environment.


The above event procedure finds all models that have a HASPART relation to the device (port models) and then checks the X_ifIndex value on the models returned and compares it
    to the ifIndex provided in the original event to find the correct interface. Once found it generates a new event that can be configured to alarm with the original alarm info from the
    the 0x220007 event. 
    

 

Additional Information

Event Procedure Function Reference:

ForEach
CreateEventWithVariables
GetModelsByRelationName
If