Retrieve Suppressed Device Details in Parent Alarms via REST API

Products

• Network Observability

Issue/Introduction

When a parent device enters a "Down" state, Spectrum suppresses alarms for downline child devices, but the parent alarm lacks metadata or a summary of these suppressed entities.․​​​​​‌​

ERROR MESSAGE: "One Device got down and downline devices also got suppressed, however we recieved only one alarm without any detail of suppressed devices."

SYMPTOMS:

• Parent alarm is generated without a count or list of suppressed nodes.

• Operations teams lack visibility into the scope of outages.

• Manual investigation is required to identify impacted downline infrastructure.

CONTEXT: Occurs during condition correlation when a root cause device suppresses child device alarms.

Environment

Network Observability DX NetOps Spectrum 24.3.13

Cause

Standard Out-of-the-Box (OOTB) configuration for Condition Correlation does not dynamically populate parent alarm descriptions with child metadata. Attribute 0x12dc7 must be queried specifically to expose this list.

Resolution

PREREQUISITES:

• Access to the Spectrum OneClick Server REST API.

• The specific Alarm ID of the parent alarm.

IMPACT: Reduced visibility for the Operations Command Center (OCC) regarding outage scope.

STEPS:

1. QUERY ATTRIBUTE 0X12DC7:

   Use the REST API to expose attribute 0x12dc7 (RootCause_List), which contains the relationship between the Critical alarm and suppressed entities.

   Endpoint: Https://[OneClickServer]:844/spectrum/restful/alarms

   Method: POST

   Body: <rs:alarm-request throttlesize="10" xmlns:rs="http://www.ca.com/spectrum/restful/schema/request" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.ca.com/spectrum/restful/schema/request ../../../xsd/Request.xsd"> <rs:requested-attribute id="0x12dc7"/> <rs:alarms id="[Alarm_ID]" /> </rs:alarm-request>

   EXPECTED: The API returns a string mapping the Critical alarm to suppressed devices, including Hostnames and Model Handles.

2. PARSE RESULTS:

   The result field will populate with the suppression list details.

   Example Output: "Sim::[ServerName] (0x100006a, Critical)\n Sim2:[ServerName] (0x1001109, Suppressed)\nSim3:[ServerName] (0x1001188, Suppressed)"

VERIFY SUCCESS:

• API response contains attribute 0x12dc7.

• Suppressed device hostnames and statuses are visible in the response string.

Additional Information

RELATED RESOURCES:

• KB-187467: Spectrum Alarm Customization

• REST API Documentation: Alarm Resource Attributes

PREVENTION: Customize alarm templates to include attribute 0x12dc7 if persistent visibility is required in the OneClick UI.