LINK UP/DOWN TRAPS RECEIVED IN THE LAST 5 MINUTES EXCEEDS THRESHOLD alarm in CA Spectrum

Products

• CA Spectrum

Issue/Introduction

The "LINK UP/DOWN TRAPS RECEIVED IN THE LAST 5 MINUTES EXCEEDS THRESHOLD" alarm is based on receiving 15 "60 second communication link up/down pair events (event id 0x00220006)" within a 5 minute period. However, these link up/down pairs do not have to be on the same interface. The way the rule is written, the 15 "60 second communication link up/down pair events (event id 0x00220006)" is the total number across all interfaces associated with the device. However, the resulting event (event id 0x00220007) for the "LINK UP/DOWN TRAPS RECEIVED IN THE LAST 5 MINUTES EXCEEDS THRESHOLD" displays the interface index and description of the interface from the last 0x00220006 event which leads the user to believe that interface was flapping to cause the alarm when in reality it may not be.

Environment

Release: Any
Component:

Resolution

The solution is to modify the $SPECROOT/SS/CsVendor/IETF/EventDisp entry for the 0x00220006 event to discriminate on Event Variable 1 which is the interface index. Add the following to the $SPECROOT/custom/Events/EventDisp entry:

0x00220006 E 50 R { 1 } CA.InterfaceFlapRule, 15, 300, 600, "0x00220007 -:-", "0x00220008 -:-"

The added { 1 } to the EventRule above will discriminate on event variable 1.