Event rate rule on 0x0010D35 in Spectrum
Article ID: 70737
Updated On:
Products
Issue/Introduction
We would like to create an Event Rate rule applied to vent 0x0010D35 - Device Has Stopped Responding to Polls. We want to see an alarm raised if 0x0010D35 occurs in (x) occurrences in (y) time. How do we set this up?
In some cases, a device may be showing 0x10D35 DEVICE HAS STOPPED RESPONDING TO POLLS alarms and when the network team investigates the issue, the Router is back up. However, the alarms persist over a period of time, just not fast enough to determine if there is a true issue or not.
Having an event rate rule that would raise a separate alarm if 10D35 occurs a number of times within a set time period, this would help us determine if the Alarms are showing a legitimate "flapping" device that needs attention.
Environment
DX NetOps Spectrum - all releases
Cause
0x10D35 Alarms are occurring at a high rate:
Network latency and device response time affect 10D35 alarms. DCM Timeout values determine how long and how many retries Spectrum will attempt to poll the device.
Resolution
It is not recommended to apply customizations to Inference Handler events such as 0x0010D35 (see Additional Information below). If any IH events are customized (Including changing Severity!) it can have adverse affects on Spectrum's Inference Handler algorithms. However, in this case we will first spin off a custom event based on Model_Class, and apply an Event Rate rule to the custom event. In this way, we try to mitigate the impact the customization may have on Spectrum's ability to manage Fault Isolation.
The following EventDisp was created in ECE and searches for Model_Class = Router (I 3) or bRouter (I 4) and generates custom event 0xfff00001 (your custom event code may be different).
0x00010d35 E 75 A 3,0x00010009,N R CA.EventCondition, "({a 0x11ee8} == {I 3} || {a 0x11ee8} == {I 4})" , "0xfff00001 -:-"
Then we apply an Event Rate rule to 0xfff00001 that says if this event occurs 4 times in 2 hours, generate event 0xfff00002, which has a Critical Alarm configured.
Be sure to save your changes, and Update Event Configuration on the VNM model. Go to
VNM > Information > SpectroSERVER Control > Update Event ConfigurationYou can apply the same principle to any event, and adjust the rate parameters to your needs.
Additional Information
Feedback
