Am Feb 24, 2011 um 1:43 AM schrieb Kenneth Kirchner:
> Does anyone have any advice on how to make Spectrum less sensitive to
> "Management Agent Lost" events? We see lots of events where Spectrum says
> the agent is lost, but comes up less than 3 minutes later (poll interval is
> 300 seconds, so I am not sure how it even knows). If we manually poll as
> soon as we get the alarm, 99% of the time it is successful. I have raised
> the DCM Retry Count to 3, but that does not appear to have helped. We have
> all kinds of WAN links (ATM, T1, etc) and the latency/reliability issues that
> go with them, so I cant say the network is not at fault, but I wish I had
> more information about what Spectrum tried and when it tried it. As soon as
> we get the Major alarm, we get a ticket in our ticketing system, so this is
> creating a bit of extra work for a problem that has resolved itself before
> the ticket even gets assigned.
If you just want to make the alarming less sensitive, you can insert another
event between the problem event and the alarm.
Say your troublesome event is 0xffff0001, and it creates an alarm with probable
cause 00000001, it is cleared by event 0xffff0002 and you want to delay the
alarm by N seconds.
In Event Configuration, create a new event (let's call it 0xffff0003). Have it
create an alarm with probable cause 00000001. Give it an appropriate event
message ('troublesome event 0xffff0001 has been present for N minutes'). Save
that.
Select event 0xffff0001. Remove the alarm generation from the event. Create
an event pair that says if 0xffff0001 is created and not followed by 0xffff0002
within N seconds, generate 0xffff0003.
Now the alarm condition will have to be present for N minutes before the alarm
is generated. If you make N a few seconds longer than two polling cycles, it
will take failing two consecutive polls to trigger the alarm.
Mathias Wegner
---
To unsubscribe from spectrum, send email to [email protected] with the body:
unsubscribe spectrum [email protected]
