Error processing event for OSPF-5-ADJCHG syslog with Spectrum

Products

• Spectrum
• Network Observability

Issue/Introduction

Description:

When the OSPF-5-ADJCHG syslog is processed through the ParseMaps file, Spectrum is creating event 0x3dc0003 stating the following:

 

Event : The received string:
             " Process 100, Nbr 10.10.10.52 on FastEthernet4 from 2WAY to DOWN, Neighbor Down: Dead timer expired"
             does not match the format defined in the Parse Map file OSPF-5-ADJCHG:
             "Process {INTEGER 1}, Nbr {INTEGER 2} on {STRING 1} from {STRING 2} to {STRING 3}, {STRING 4}"
             If you are unable to resolve the mismatch please refer to the Southbound Gateway Toolkit Guide (5066).
             Regular Expression:
             "(?C0)([\s]*)(Process )(?C1)([\s]*)(\d+)(?C2)([\s]*)(, Nbr )(?C3)([\s]*)(\d+)(?C4)([\s]*)( on )(?C5)([\s]*)([ @_%~;,<>a-zA-Z-\t\/\.0-9\(\)=,\\\|\[\]\#\^\$\*\+\?\.{}:%\&\x22']+)(?C6)([\s]*)( from )(?C7)([\s]*)([ @_%~;,<>a-zA-Z-\t\/\.0-9\(\)=,\\\|\[\]\#\^\$\*\+\?\.{}:%\&\x22']+)(?C8)([\s]*)( to )(?C9)([\s]*)([ @_%~;,<>a-zA-Z-\t\/\.0-9\(\)=,\\\|\[\]\#\^\$\*\+\?\.{}:%\&\x22']+)(?C10)([\s]*)(, )(?C11)([\s]*)([ @_%~;,<>a-zA-Z-\t\/\.0-9\(\)=,\\\|\[\]\#\^\$\*\+\?\.{}:%\&\x22']+)(?C12) "
             The error occurred after the symbol (?C4) and before the symbol (?C5) on substring ".XX.XX.XX  on FastEthernet4 from 2WAY to DOWN, Neighbor Down: Dead timer expired".
             See the contents of the Message Map file OSPF-5-ADJCHG.  Rtr_Cisco (name - spectrum_1.broadcom.com). -

 

Environment

Release: 21.2, 22.2
Component: SPCAEM : Spectrum Alarm

Resolution

Solution:

The solution is to modify the OSPF-5-ADJCHG file located in the $SPECROOT/SS/CsVendor/ParseMaps directory on the SpectroSERVER systems to match the format
   received from the device for the OSPF-5-ADJCHG syslog.

The OSPF-5-ADJCHG file should be changed to the following:

Event04bd16be
Process {INTEGER 1}, Nbr {IPADDRESS 2} on {STRING 3} from {STRING 4} to {STRING 5}, {STRING 6}
Example: %OSPF-5-ADJCHG: Process 1, Nbr 2 on abcd from efgh to ijkl, mnop

After making the above change to the OSPF-5-ADJCHG file, the Event Configuration will need to be updated on each SpectroSERVER system for the change to take affect:

 

1. Find and select the VNM model
2. Click on the Information tab in the Component Detail panel
3. Find and expand the SpectroSERVER Control subview
4. Click on the Update Event Configuration button

 

In addition, the $SPECROOT/SG-Support/CsEvFormat/Event04bd16be file on the SpectroSERVER, OneClick and Report Manager systems needs to be changed to the following:

 

{d "%w- %d %m-, %Y - %T"} Cisco IOS Error:%OSPF-5-ADJCHG, Process {I 1}, Nbr {I 2} on {S 3} from {S 4} to {S 5}, {S 6} {t} (name - {m}). - (event [{e}])

 

After making the above change, the Events will need to be updated on all OneClick and Report Manager systems:

 

1. Log into the OneClick web pages as an ADMIN user
2. Click on the Administration link
3. Click on the Update Event and Alarm files link
4. Click on the Reload button