Explanation of the Spectrum DiscoverConnectionAfterLinkUpEvent attribute id 0x11d25
SPECTRUM will automatically discover and map the associated model's connections one poll interval after it receives a LINK up trap from a device when the DiscoverConnectionAfterLinkUpEvent attribute id 0x11d25 is set to Yes (True). This delay allows the device to fully reconfigure its related SNMP tables before SPECTRUM reads them. The Poll Interval setting for the device appears in the Information tab in the SPECTRUM Modeling Information subview.
The information read to discover the model's connections depends on the mib support of the device. If the device is a layer 3 device, then the ipAddress and ipRoute tables are read. This could be costly if the ipRoute table on the device is large.
If the device is a layer 2 device, SPECTRUM will read the transparent bridge table. Again, this could be costly if this is a core switch with a large table.
SPECTRUM will also read proprietary discovery tables like the Cisco Discovery Protocol or the Nortel Discovery Protocol tables if supported.
If the device supports all three of the above, SPECTRUM will read all three. For example, the device is a Cisco router, with CDP, routing and bridging enabled.
By being costly if the tables are large is that it would be a lot of snmp traffic on the network and for the device to respond to. If the device is busy, it could cause the device to stop responding to snmp resulting in an incomplete modeling of the connections.
This can be resolved by throttling the snmp down by setting the Throttling attribute (0x11f79) to True (default value False) and the Throttle_Count attribute (0x11f39) to a value that will allow the device time to recover between snmp requests (default value 10).
Throttling - 0x11f79 - Controls whether or not SPECTRUM should restrict the amount of outstanding SNMP requests sent to a device. This helps to alleviate problems involving SNMP agents that cannot handle large amounts of SNMP requests.
Throttle_Count - 0x11f39 - Determines how many outstanding SNMP requests are allowed when throttling is enabled for a device.
There are some special considerations for flapping interfaces. A flapping interface is one that is constantly going up and down, most likely due to a problem on the device. The SPECTRUM intelligence associated with setting Device Discovery After Link-Up Events to "Yes" excludes LinkUp traps from flapping interfaces, so the stream of LinkUp traps from a flapping interface does not interfere with a LinkUp trap for another interface on the same device. This allows the connection discovery action to run as expected.
When this intelligence detects a flapping interface, a minor alarm is generated on the related device. After a default interval of 10 minutes without receiving a trap from the flapping interface, the alarm is cleared. The default settings used to identify and track flapping interfaces are configured using Event Rules associated with Events 0x220002, 0x220006. The default settings are as follows:
" An Event Sequence Rule on Event 0x220002, which generates Event 0x220006 if a LinkUp trap is received and is followed by a LinkDown trap from the same interface within 60 seconds.
" An Event Rate Window Rule on Event 0x220006, which generates Event 0x220007 if 15 0x220006 events are generated within 5 minutes (300 seconds). Event 0x220007 generates a Minor alarm on the device.
" An Event Pair Rule on Event 0x220006 which generates Event 0x220008 if Event 0x220006 is not followed by Event 0x220007 within 10 minutes (600 seconds). Event 0x220008 clears the Minor alarm generated by Event 0x220007.
The default values will generate an alarm after 15 LinkUp/Down trap pairs are received and clear the alarm 10 minutes after the last LinkUp/Down Trap pair is received. These settings are user configurable, enabling you to define flapping interface Event thresholds to meet your needs. The rules listed abov.e are specified in the <$SPECROOT>/SS/CsVendor/IETF/EventDisp file.