Finding out the top occurring Events in CA Spectrum

Products

• Spectrum
• Network Observability

Issue/Introduction

There are various scenarios that sometimes occur that cause Spectrum to slow down due to performance degradation.  This can be due to devices flooding Spectrum with traps or network faults resulting in an excessively large number of alarms being generated. In these cases, as part of the troubleshooting process, it's good to find out what events have been generated the most so as to help identify the root cause of the problem.
 
How can the top occurring events be identified for a specific time period?

Environment

Release: All Supported Releases
Component: SPCAEM - Events and Alarms

Resolution

NOTE: In the following MySql commands, replace <PASSWD> with the root password for your DX NetOps Spectrum version.

You can find out which are the top events generated by querying the DDM db (Archive Manager Data base) as follows;

1.     Login to the SpectroSERVER command line (under Windows, run bash -login)

2.    cd $SPECROOT/mysql/bin

3.     Enter the following command to log into the Archive Manager MySQL DB: 

./mysql --defaults-file=../my-spectrum.cnf -uroot -p<PASSWD> ddmdb 

 

4.     When the MySQL prompt appears, to specify a particular date range (In this example just after midnight on 30th Dec through to midnight on 2nd Jan);

SELECT hex(type), COUNT(*) AS cnt FROM event WHERE utime >= UNIX_TIMESTAMP("2018-12-30 00:00:00") AND utime <= UNIX_TIMESTAMP("2019-01-02 23:59:59") GROUP BY type ORDER BY cnt DESC LIMIT 10;

 
 Or, the last 24 hours worth of events, run;

SELECT hex(type), COUNT(*) AS cnt FROM event WHERE (utime > (unix_timestamp(curdate()) - 1*24*3600 ))

 

This will list out the top 10 occurring event codes (in Hexadecimal) and the number of times they've occurred in this time range. You can then check to see what events they are by search for them in the Event Configuration (under Spectrum OneClick client -> Tools menu -> Utilities).

Additional Information

Query a specific event code to see the number of times this event has occurred on each device:

                                                                                                                               start date                                                               end date                               event code

SELECT hex(model_h), count(*) as c from ddmdb.event where utime > UNIX_TIMESTAMP('2022-07-28 00:00:00') and utime < UNIX_TIMESTAMP('2022-07-29 00:00:00') and type=0x10d67 group by hex(model_h) order by c desc;