Hello
Looking for a pointer or two on this
The alarm for OSPF IF State Change - event 0x22003f
is a generic one that reports on state change of the OSPF
An average message (event) has a payload similar to this
An ospfIfStateChange trap has been received for router <router ip address>.
The interface is <interface ip address>, and the new state is OTHER-DESIGNATED-
ROUTER
Its configured to send a minor alarm
I need to have it process so that in the event of the new state being DOWN it
sends a major alarm
I looked at the contents of CsVendor/Ctron_SNMP_Rtr/eventdisp and it has a
statement that has me a bit confued - especially when I match it to the Alert
map
Alert Map has the following
# The OIDs listed here are for an Alert Handler. The real generated
# events/alarms are found by adding 0x10 to the the event codes below.
......
...
1.3.6.1.2.1.14.16.2.6.16 0x22002f 1.3.6.1.2.1.14.1.1(1,0)\
1.3.6.1.2.1.14.7.1.1(2,0)\
1.3.6.1.2.1.14.7.1.2(0,0)\
1.3.6.1.2.1.14.7.1.12(3,0)
So reading the above I take it to mean the trap above's real generated event
is in fact 0x22003f
the EventDisp has the following info relevant
0x0022002f E 30
....
..
# The 16 events that follow are controlled by the OSPF Trap Configuration View
# off of the OSPF2RtrApp and are generated by an Alert Handler.
0x0022003f E 30 A 1,0x0022003f
So by reading that I work on the assumption that the original trap is
recevied, generates an event 0x0022002f then the Alert Handler dishes out the
0x22003f event
All good so far
I want to then differentiate the message received so that the "DOWN" state
generates a different payload - a Major alert
So looking at that I am working on using an event conditoin rule
# 0x0022003f E 30 A 1,0x0022003f \ R Aprisma.EventCondition, "{VARDATA
3} == { S \"DOWN\" }", "0xffff0701 -:-", "default", "0xffff0700"
Based on varbind 3 of the original trap, however I can;t seem to get this
working, mainly I think because the varbind is probably not passed on to the
new event
So wondering if anyone has good tips on best way of differentiating based on
the new state
I'm on Linux so no Watch editor or ECeditor or Spectrograph
Any pointers appreciated
Jason Hebron
---
To unsubscribe from spectrum, send email to [EMAIL PROTECTED] with the body:
unsubscribe spectrum [EMAIL PROTECTED]
