Duplicate EventModels Created for Existing UIMHost Models in Spectrum

Products

• Network Observability

Issue/Introduction

Duplicate EventModels are redundantly created in Spectrum for devices that already exist as valid UIMHost models․​​​​​​​‍

SYMPTOMS:

• Spectrum generates an EventModel instead of asserting alarms to the existing UIMHost model․

Cause

The issue stems from mismatches between the data UIM synchronizes to Spectrum (via nisapi) and the data UIM sends in live SNMP traps․ UIM sends events using Virtual Cluster IPs, which do not match the physical Node IPs synchronized to Spectrum․ Because Spectrum cannot find the Cluster [IP-address] in its database using Southbound Gateway logic and Variable 8 in the trap, it treats the event as coming from a new, unknown device and generates an EventModel․ Additionally, UIM sometimes sends conflicting identification data within a single trap (e․g․, [cluster-name] in Variable 8 but [node-name] as source)․

 

Resolution

The EventModel creation is the correct behavior as a model with the virtual cluster IP does not exist. This could potentially be worked around by manually creating Pingable
   models using the Virtual IP addresses to represent the cluster resource.

Additional Information

Southbound Gateway - Variable ID Field 8 (Target Address)
https://techdocs.broadcom.com/us/en/ca-enterprise-software/it-operations-management/spectrum/25-4/integrating/southbound-gateway-toolkit/the-event-data-template/variable-id-field-8-target-address.html