Could simplify this down - in Event editing can I simply check for s string in the payload of the event message
By that I mean the event generated payload has the word I need to differentiate on. Rather than using varbinds and trying to pass from one event to the next - which may not work anyway as the alert handler and ospf2rtrapp trap handler Or another way of approaching it - how does one get into the ospf2rtrapp trap handler? -----Original Message----- From: Jason Hebron [mailto:[EMAIL PROTECTED] Sent: Thursday, 4 December 2008 3:43 p.m. To: spectrum Subject: [spectrum] OSPF if state change Hello Looking for a pointer or two on this The alarm for OSPF IF State Change - event 0x22003f is a generic one that reports on state change of the OSPF An average message (event) has a payload similar to this An ospfIfStateChange trap has been received for router <router ip address>. The interface is <interface ip address>, and the new state is OTHER-DESIGNATED- ROUTER Its configured to send a minor alarm I need to have it process so that in the event of the new state being DOWN it sends a major alarm I looked at the contents of CsVendor/Ctron_SNMP_Rtr/eventdisp and it has a statement that has me a bit confued - especially when I match it to the Alert map Alert Map has the following # The OIDs listed here are for an Alert Handler. The real generated # events/alarms are found by adding 0x10 to the the event codes below. ...... ... 1.3.6.1.2.1.14.16.2.6.16 0x22002f 1.3.6.1.2.1.14.1.1(1,0)\ 1.3.6.1.2.1.14.7.1.1(2,0)\ 1.3.6.1.2.1.14.7.1.2(0,0)\ 1.3.6.1.2.1.14.7.1.12(3,0) So reading the above I take it to mean the trap above's real generated event is in fact 0x22003f the EventDisp has the following info relevant 0x0022002f E 30 .... .. # The 16 events that follow are controlled by the OSPF Trap Configuration View # off of the OSPF2RtrApp and are generated by an Alert Handler. 0x0022003f E 30 A 1,0x0022003f So by reading that I work on the assumption that the original trap is recevied, generates an event 0x0022002f then the Alert Handler dishes out the 0x22003f event All good so far I want to then differentiate the message received so that the "DOWN" state generates a different payload - a Major alert So looking at that I am working on using an event conditoin rule # 0x0022003f E 30 A 1,0x0022003f \ R Aprisma.EventCondition, "{VARDATA 3} == { S \"DOWN\" }", "0xffff0701 -:-", "default", "0xffff0700" Based on varbind 3 of the original trap, however I can;t seem to get this working, mainly I think because the varbind is probably not passed on to the new event So wondering if anyone has good tips on best way of differentiating based on the new state I'm on Linux so no Watch editor or ECeditor or Spectrograph Any pointers appreciated Jason Hebron --- To unsubscribe from spectrum, send email to [EMAIL PROTECTED] with the body: unsubscribe spectrum [EMAIL PROTECTED] --- To unsubscribe from spectrum, send email to [EMAIL PROTECTED] with the body: unsubscribe spectrum [EMAIL PROTECTED]
