Event rate rule on 0x0010D35 in Spectrum

Products

CA Spectrum DX NetOps

Issue/Introduction

We would like to create an Event Rate rule applied to vent 0x0010D35 - Device Has Stopped Responding to Polls. We want to see an alarm raised if 0x0010D35 occurs in (x) occurrences in (y) time. How do we set this up?

In some cases, a device may be showing 0x10D35 DEVICE HAS STOPPED RESPONDING TO POLLS alarms and when the network team investigates the issue, the Router is back up. However, the alarms persist over a period of time, just not fast enough to determine if there is a true issue or not.

Having an event rate rule that would raise a separate alarm if 10D35 occurs a number of times within a set time period, this would help us determine if the Alarms are showing a legitimate "flapping" device that needs attention.

Environment

DX NetOps Spectrum - all releases

Cause

0x10D35 Alarms are occurring at a high rate:

Network latency and device response time affect 10D35 alarms. DCM Timeout values determine how long and how many retries Spectrum will attempt to poll the device.

Resolution

It is not recommended to apply customizations to Inference Handler events such as 0x0010D35 (see Additional Information below). If any IH events are customized (Including changing Severity!) it can have adverse affects on Spectrum's Inference Handler algorithms. However, in this case we will first spin off a custom event based on Model_Class, and apply an Event Rate rule to the custom event. In this way, we try to mitigate the impact the customization may have on Spectrum's ability to manage Fault Isolation.

The following EventDisp was created in ECE and searches for Model_Class = Router (I 3) or bRouter (I 4) and generates custom event 0xfff00001 (your custom event code may be different).

0x00010d35 E 75 A 3,0x00010009,N R CA.EventCondition, "({a 0x11ee8} == {I 3} || {a 0x11ee8} == {I 4})" , "0xfff00001 -:-"

Then we apply an Event Rate rule to 0xfff00001 that says if this event occurs 4 times in 2 hours, generate event 0xfff00002, which has a Critical Alarm configured.

Be sure to save your changes, and Update Event Configuration on the VNM model. Go to

VNM > Information > SpectroSERVER Control > Update Event Configuration

You can apply the same principle to any event, and adjust the rate parameters to your needs.

Additional Information

Please reference the "Event and Alarm Customization" section of the documentation and knowledge article "Spectrum Fault Isolation not suppressing or asserting alarms as expected - event customization" for more information.