Jim, Thank you for the quick and verbose reply. This gives me a very good place to start.
--Gary From: "Pfleger, Jim" <[email protected]> To: Gary Blydenburgh/intd...@intdata, "Spectrum users" <[email protected]> Date: 11/02/2010 06:52 PM Subject: Re: [spectrum] Counter Deltas Gary- You're not going to be able to do all that you want in just the watch configuration. You'll also need to set up some event rules in the event configuration editor (ECE). First, configure the watch to generate an event whenever the delta is greater than zero, but don't generate an alarm. (Let's call this event 1 for this discussion.) Also, assuming that you want to check ifInErrors on each available interface, and not just one particular one, you'll want to make sure to set the instance parameter of the watch to "All" and change your watch expression to COUNTER_DELTA(ifInErrors.#). This way you'll get one event per failed interface per device. Then in the ECE, create event 1. On its alarms tab, you'll want this event to generate your warning alarm (call it alarm 1). Again, since you want one alarm per interface, you'll need to use an event discriminator. Specifically, you'll want to set the discriminator to 8, which is the event variable that contains the instance identifier - in this case the ifIndex. Now, on the event rules tab, create an "event rate" rule that generates a second event (event 2) when this one occurs two or more times in five minutes. In the ECE, find and open event 2. On the alarms tab set its event discriminator to 8, have it generate alarm 2, and also clear alarm 1 (so you don't have both a warning and critical alarm). Of course this is just a high-level pass, and I haven't tried to actually implement this, but this should be enough to get you started. And don't forget to set your watch to run more than once per five minutes or you'll never get a critical alarm. :-) HTH, Jim -- JIM PFLEGER | Application Architect | Insight | insight.com t. 480.889.9680 f. 480.889.9599 [email protected] On 11/2/10 1:50 PM, "Gary" <[email protected]> wrote: > Greetings all, > > I am trying to create a couter_delta watch on on the ifInErros attribute. I > want to generate a crtical alarm if I have two delta changes in a 5 minute > period, and generate a warning alarm if we only get 1 delta in 5 minutes. I > can't figure out how to get this done in the "Create Watch" screen. > > The expression I have is COUNTER_DELTA(ifInErrors), what I can't seem to find > is how to get time associated with the expression. I didn't see anything in > the Thresholds tab that would help me. > > Can anyone point me in the right direction? > > --Gary > --- > To unsubscribe from spectrum, send email to [email protected] with the body: > unsubscribe spectrum [email protected] ******************************************************* This message (including any files transmitted with it) may contain confidential and/or proprietary information, is the property of Interactive Data Corporation and/or its subsidiaries, and is directed only to the addressee(s). If you are not the designated recipient or have reason to believe you received this message in error, please delete this message from your system and notify the sender immediately. An unintended recipient's disclosure, copying, distribution, or use of this message or any attachments is prohibited and may be unlawful. ******************************************************* --- To unsubscribe from spectrum, send email to [email protected] with the body: unsubscribe spectrum [email protected]
