How to create an Event Condition Rule to generate alarm if the device belongs to a Global Collection

Products

• Network Observability
• Spectrum

Issue/Introduction

There may be scenarios where you only want alarms for a specific set of devices, and that's where you can use Event Condition rules.

Environment

DX NetOps Spectrum: Any version

Resolution

1. In the Event Configuration Editor, locate the event code you want to customize. Select it and in the Event Rules tab, select Event Condition... option:

In this example, the 0x10017 was chosen. Select your event code you want to customize.

2. Click on the "+" signal icon to create your event condition rule:

3. Select as follow:

• Event Variable Type: Attribute ID
• Value: 0x12adb   (supply any other attribute you want to evaluate)
• Operator: Regular Expression
• Event Variable Type: String
• Value: GC-9800-40   (supply your Global Collection name in this field)

Click on Insert Criterion button

Supply the Generate Event: (supply your custom event code - when the device belongs to the GC)

Select Copy All and click on OK button

4. Click on the "+" signal to create the default rule:

5. Select as follow:

Operator: Default

Click on Insert Criterion button

Supply the Generate Event: (supply your custom event code - when the device does not belong to the GC)

Select Copy All and click on OK button

6. Click OK button:

7. Click on the Save button:

Now once the 0x10017 event is generate, it will evaluate if the device belongs to Global Collection called GC_9800-40. If positive, it will generate event 0xfff00000. If the device does not belong to Global Collection called GC_9800-40, it will generate event 0xfff00001.

In the $SPECROOT/custom/Events/EventDisp file:

0x10017 E 50 R CA.EventCondition, "(regexp({a 0x12adb}, {S \"GC_9800-40\"}))" , "0xfff00000  -:-","default" , "0xfff00001  -:-"
0xfff00000 E 0 A 1,0x1030a
0xfff00001 E 0

 

For test purpose, you can manually generate the 0x10017 event via CLI do evaluate the Event Condition Rule created against 0x10017  event code.

cd $SPECROOT/vnnmsh    (logged as Spectrum Install Owner account)

./connect

./create event type=0x10017 text=Authentication_Failure mh=<model_handle of a device that belongs to GC_9800-40 Global Collection>

An alarm will be generated.

./create event type=0x10017 text=Authentication_Failure mh=<model_handle of a device that does NOT belongs to GC_9800-40 Global Collection>

No alarm will be generated.