How to add additional instance information to an event created from an instance SpectroWatch in CA Spectrum

Products

• CA Spectrum
• DX NetOps

Issue/Introduction

I have created a threshold SpectroWatch on the locIfInCRC attribute id 0x2100e6 attribute of a Cisco router. When the threshold is reached, the resulting event specifies the instance in the table that exceeded the threshold. I would like to include the interface description of the associated interface in the event. How can this be accomplished?

Environment

Release : Any version of Spectrum

Component : Spectrum Core / SpectroWatch

Resolution

This can be accomplished by using an Event Procedure to read the same instance value of the ifDescr attribute id 0x100c5 and save to an Event Variable.

The only basic requirement for doing this is the table where you want to collect the additional information from MUST be instance in the same way as the table the SpectroWatch is using in the watch expression.

In this example, the table that defines the locIfInCRC attribute is indexed by the ifIndex from the interfaces table. So we can use the same instance that exceeded the threshold to get the same instance value from the ifDescr attribute in the interfaces table.

When a threshold is exceeded on an instance attribute from a watch, the instance that exceeded the threshold is passed on to the resulting event as event variable "8". So we can use this information in the Event Procedure to get this instance value for ifDescr using the ReadAttributeInstance function. The following is an example:

0xfff00000 E 0 P "\

CreateEventWithAttributes( \

 { C CURRENT_MODEL }, \

 { H 0xfff00001 }, \

 SetEventAttribute( \

  GetEventAttributeList(), \

  { U 20 }, \

  ReadAttributeInstance( \

   { C CURRENT_MODEL }, \

   { H 0x100c5 }, \

  GetEventAttribute( { U 8 } ))))"

 

In the above example, the watch is configured to generate event 0xfff00000. The ReadAttributeInstance function tells Spectrum to collect the value of the 0x100c5 attribute (ifDescr) and use the value from Event Variable 8 {U 8} as the instance. When received, save that value to Event Variable 20 for event 0xfff00001.

Additional Information

The following is another example if there is more than one Event Variable you wish to populate. The following example populated three Event Variables. Note for each Event Variable you wish to populate requires a separate "SetEventAttribute" parameter.

0xfff00000 E 0 P "\
 CreateEventWithAttributes( \
  { C CURRENT_MODEL }, \
  { H 0xfff00001 }, \
  SetEventAttribute( \
   SetEventAttribute( \
    SetEventAttribute( \
   GetEventAttributeList(), \
   { U 10 }, \
   ReadAttributeInstance( \
    { C CURRENT_MODEL }, \
    { H 0xc40c26 }, \
   GetEventAttribute( { U 8 } ))), \
   { U 20 }, \
   ReadAttributeInstance( \
    { C CURRENT_MODEL }, \
    { H 0xc40c22 }, \
   GetEventAttribute( { U 8 } ))), \
   { U 30 }, \
   ReadAttributeInstance( \
    { C CURRENT_MODEL }, \
    { H 0xc40c25 }, \
   GetEventAttribute( { U 8 } ))))"