Skip to content
CA Spectrum - 10.2 to 10.2.3
Documentation powered by DocOps

Working with Events and Alarms

Last update November 16, 2018

Contents

The following sections details all the features and options that you face while working with Events and Alarms in CA Spectrum.

Finding Events

To find an event, you can filter the list of events in the Navigation panel to include only events with displayed property values that include a specific text string. For example, if the Type column is displayed, you can enter “timeout” to filter the list to include only events that generate alarms that include the word (in uppercase or lowercase) in the alarm type text string (alarm title).

An event that is mapped to a Trap has the Trap Event column checked.

To find events.

  1. If necessary, click SPEC--reload_ICO (Reloads the list of events) to update the event table in the Navigation panel to include all events in the distributed environment.

    Note: Typically, you must reload the list of events if you started Event Configuration from MIB Tools. Starting Event Configuration in this manner only loads into Event Configuration the specific events you selected in MIB Tools.
  2. Verify that the event properties that you want to search against are displayed in the events table. If not, add the appropriate table columns as described in Adding and Removing Columns from the Events Table.

    Note: Only visible table columns are included in the filtering process.
  3. In the Filter field, enter the text string to search for in the event table.
    The list of events in the table is filtered to include only those events that have the text string you specified in the displayed property values.

Create Events from Scratch

You can create new events from scratch.

Note: Creating a management module for a device that CA Spectrum does not support by default; use MIB Tools to map traps sent by the device to new CA Spectrum events before using Event Configuration. (Events are automatically created when you define the trap mappings). You can then launch Event Configuration directly from MIB Tools to configure the events and associated alarms.
For more information, see Mapping Traps to CA Spectrum Events.

To create a new event.

  1. In the Navigation panel, click spec--ec--createevent--ICO (Creates an event).
    The Create Event dialog appears.
  2. Enter an event code or accept the default event code.

    Note: The event code is a 4-byte integer that is expressed in hexadecimal format. The first 2 bytes contain the developer ID, and the last 2 bytes identify the event with a unique number. While the default code is unique, it is recommended that you enter a code beginning with your CA-assigned developer ID. This ID lets you easily recognize your custom code in OneClick and prevents potential conflicts with other CA Spectrum event codes. The event code 0x10000 represents a null event. This event cannot be generated. However, the null event can be used in an event rule that requires an event code as a parameter.
  3. Enter an event message as described in Entering an Event Message. (You can also modify the message after the event is created.)
    Remember that most of the information that a OneClick user receives about an event is through the message text that is affiliated with that event. For this reason, provide as much information about the event as possible in the message.
  4. (Optional) Enter the Vendor to specify the developer, vendor, or manufacturer.

    Note: The Vendor is available in the directory under <$SPECROOT>/custom/Events that contains the EventDisp file. The event options (and other event processing information) are stored in event configuration files referred to as event disposition files.
  5. Click OK.
    The new event is added to the table of events in the Navigation panel. The event is displayed in bold. The Modification column displays New.

    Note: The event is marked New. However, the event is not saved. You can make more updates such as create more events, modify existing events, or delete events, and save all the updates at one time.
  6. Configure the event, as described in Configuring Events.
  7. (Optional) Add event rules to the event, as described in Creating an Event Rule.
  8. Save the changes to one or more landscapes, as described in Saving Events to Landscapes.
    The events appear in the normal font and are not marked in the Modification column.

Create Events from a Copy

You can create new events by copying existing events.

Note: Creating a management module for a device that CA Spectrum does not support by default, use MIB tools to map the traps that are sent by the device to new CA Spectrum events (automatically created when the trap mappings are defined) before using Event Configuration. You can then launch Event Configuration directly from MIB Tools to configure the events and associated alarms.
For more information, see Mapping Traps to CA Spectrum Events.

To create an event from a copy.

  1. In the Navigation panel, select the event that you want to copy, and click spec--ec--copyevent--ICO (Copies the selected event).
    The Copy Event dialog opens.
  2. Enter an event code or accept the default event code.
  3. Note: The event code is a 4-byte integer that is expressed in hexadecimal format. The first 2 bytes contain the developer ID, and the last 2 bytes identify the event with a unique number. Though the default code is unique (even regarding the event that you are copying), it is recommended that you enter a code beginning with your CA-assigned developer ID. This ID lets you easily recognize your custom code in OneClick and prevents potential conflicts with other CA Spectrum event codes. The event code 0x10000 represents a null event. This event cannot be generated. However, the null event can be used in an event rule that requires an event code as a parameter.
  4. Revise the event message as appropriate for the new event, as described in Entering an Event Message. (You can also modify the message after the event is created.)
    Remember that most of the information that a OneClick user receives about an event is through the message text which is affiliated with that event. For this reason, provide as much information about the event as possible in the message.
  5. Click OK.
    The new event is added to the table of events in the Navigation panel. The event displays in bold. The Modification column displays New.

    Note: The event is marked New. However, the event is not saved. You can make more updates such as create more events, modify existing events, or delete events, and save all the updates at one time.
  6. Configure the event, as described in Configuring Events.
  7. (Optional) Add event rules to the event, as described in Creating an Event Rule.
  8. Save the changes to one or more landscapes, as described in Saving Events to Landscapes.
    The events appear in the normal font and are not marked in the Modification column.

About Configuring Events

To configure an event, specify the following:

Note: You can also create event rules that are activated (triggered) by an event. For example, some types of events can be tolerated and do not indicate problems if the frequency at which they are generated does not reach a specific threshold, within a specific amount of time. You can create a rule that watches for this scenario, and when it occurs, generates another event (and associated alarm) in response.

Event Messages

The event message is the message that is displayed on the Events tab in OneClick when the event occurs.

spec--ec--events--OTH

When you compose an event message, you can use plain text and variables that reference specific data about the generated event. For the descriptions of each variable and the proper syntax to use when including them, see the subsections that follow.

Note: The event messages are stored in event configuration files referred to as event format files.

Variable Descriptions and Syntax

This section provides information about the event variables that you can use when you define event messages. When you include an event variable in a message, use the syntax that is defined here.

In the sections that follow, the # sign represents the event variable ID that is mapped to the OID of the variable binding that is sent with the trap. This assignment is made in the OID map in an AlertMap file that MIB Tools automatically creates when you map a trap to an event.

You can construct any type of message using event variable IDs. The only requirement is that the variables that you use in the message are of the proper data type.

Note: 0x12a63 is a reserved event variable ID that is used for a web context URL.
  • {d “%w- %d %m-, %Y - %T”}
    This variable is for the date string. This variable must be included in every event message. By including this variable exactly as shown, you tell CA Spectrum to capture the time and date that the alert is received.

    Note: You do not need to include this variable if you are entering the event message using Event Configuration, as the application automatically inserts the variable in the event format file that it creates when you save the event to a landscape.

    Date/Time specifier options:

    • %u
      Use GMT time not local time. Must appear first in format.
    • %%
      Writes % to buffer.
    • %d
      Writes day-of-month 01..31 to buffer.
    • %d-
      Writes day-of-month 1..31 to buffer.
    • %D
      Writes date dd/mm/yy to buffer.
    • %H
      Writes hour-of-day 00..23 to buffer.
    • %h
      Same as %m.
    • %j
      Writes day-of-year 1..366 to buffer.
    • %m+
      Writes full month name to buffer.
    • %m-
      Writes abbreviated month name to buffer.
    • %m*
      Writes month index 1..12 to buffer.
    • %m
      Writes month index 01..12 to buffer.
    • %M
      Writes minute 00..59 to buffer.
    • %S
      Writes second 00..59 to buffer.
    • %T
      Writes time hh:mm:ss to buffer.
    • %w+
      Writes full weekday name to buffer.
    • %w-
      Writes abbreviated weekday name to buffer.
    • %w
      Writes weekday index 1..7 to buffer.
    • %y
      Writes year 00..99 to buffer.
    • %Y
      Writes year 0000..9999 to buffer.
  • {t}
    This variable inserts the model type name in the message. The (t) variable is defined internally and is not configurable.
  • {m}
    This variable inserts the model name in the message. The (m) model name variable is defined internally and is not configurable.
  • {e}
    This variable inserts the event code in the message. The (e) variable is defined internally and is not configurable.
  • {u}
    This variable inserts the user name in the message. The (u) variable is defined internally and is not configurable.
  • {T <event table file name> #}
    Inserts a text string that is associated with a MIB table attribute value. The association between the attribute value and the text string is defined in an event table file that MIB Tools creates automatically when you map the trap to the event. For more information, see Referencing Attribute Values in a MIB Table.
  • {Y <event table file name> #}
    Inserts a text string that is associated with an OID. The association between the attribute value and the text string is defined in an event table file that MIB Tools creates automatically when you map the trap to the event. For more information, see Referencing OIDs.
  • {Z <event table file name> #}
    Inserts a text value that is associated with an integer bit value. The association between the integer bit value and the text string is defined in an event table file that MIB Tools creates automatically when you map the trap to the event. For more information, see Referencing Integer Bit Values.
  • {o #}
    Inserts an object ID.
  • {O #}
    Inserts an octet string.
  • {X #} or {x #}
    Inserts an octet string that is displayed in hexadecimal format.
  • {S #}
    Inserts a text string.
  • {B #}
    Inserts a Boolean value. Zero denotes false. Any other value denotes true.
  • {I #}
    Inserts an integer.string that is displayed.
  • {L #}
    Inserts a Counter64 counter.
  • {U #}
    Inserts an unsigned integer or Counter64 counter.
  • {R #}
    Inserts a real number in the range: 10E37 to 10E37.
  • {H #}
    Inserts a 32-bit hex number with a 0x prefix.
  • {K #}
    Converts a DateAndTime attribute value from an octet string to a text string, and inserts the formatted text string.
  • {G #}
    Calculates and inserts the device up time that is based on the value of the event variable (#). The value is displayed as days+hours:mins:secs.
  • {D #}
    Used with an event variable (#), which contains an integer representing the number of seconds from 1969. Converts that value to a string that represents the date and time.

Referencing Attribute Values in a MIB Table

If a variable binding that is sent with a trap contains an attribute value from a MIB table, you can use it in an event message. To use it in an event message, apply proper syntax and reference the following information:

  • The event variable to which the OID of the variable binding is mapped.
  • The event table file that contains the enumerated attribute values and the associated text strings to use in event messages. (MIB Tools automatically creates the Event table files when you map traps to new CA Spectrum events.)

As an example, assume that you have an event table file that is named BeaconType that associates the following attribute values with corresponding text strings:

0x00000001 Reconfiguration
0x00000002 Signal-Loss
0x00000003 Bit-Streaming
0x00000004 Contention-Streaming
0x000000ff None

To reference these values in an event message, use the following syntax:

{T BeaconType 2}
  • T
    Indicates that you are inserting a MIB table attribute whose values are enumerated in an event table file.
  • BeaconType
    Specifies the name of the event table file that contains the enumerated values.
  • 2
    Specifies the event variable number that is mapped (in the AlertMap file) to the OID of the variable binding that is sent with the trap. CA Spectrum takes the value of the event variable and retrieves the corresponding text string that is defined in the event table file. For example, if the event variable above, 2, stored the value 3, the text “Bit-Streaming” would be rendered in the event message.

Referencing OIDs

If a variable binding that is sent with a trap contains an OID, you can use it in an event message. To use it in an event message,use the proper syntax and reference the following:

  • The event variable to which the OID of the variable binding is mapped.
  • The event table file that contains the enumerated OID values and the associated text strings to use in event messages. (MIB Tools automatically create Event table files when you map traps to new CA Spectrum events.)

As an example, assume that you have an event table file that is named NewTable that associates the following attribute values with corresponding text strings:

1.3.6.1.4.1.1563.1.2.1.1.3.2.36.2.6 dot6
1.3.6.1.4.1.1563.1.2.1.1.3.2.36.2.5 dot15
1.3.6.1.4.1.1563.1.2.1.1.3.2 dot7

To reference these values in an event message, use the following syntax:

{Y NewTable 2}
  • Y
    Indicates that you are inserting the value of a variable binding whose possible OID values are enumerated in an event table file.
  • NewTable
    Specifies the name of the event table file that contains the enumerated values.
  • 2
    Specifies the event variable number that is mapped (in the AlertMap file) to the OID of the variable binding that is sent with the trap. CA Spectrum takes the value of the event variable and retrieves the corresponding text string that is defined in the Event Table file. For example, if the event variable above, 2, stored the value 1.3.6.1.4.1.1563.1.2.1.1.3.2, the text “dot7” would be rendered in the event message.

Referencing Integer Bit Values

If a variable binding that is sent with a trap contains an OID, you can use it in an event message. To use it in an event message,use the proper syntax and reference the following:

  • The event variable to which the OID of the variable binding is mapped.
  • The event table file that contains the enumerated integer bit values and the associated text strings to use in event messages.

    Note: When you map traps to new CA Spectrum events MIB Tools automatically created Event table files.

As an example, assume that you have an event table file that is named NewBitTable that associates the following integer bit values with corresponding text strings:

1 dsx1NoAlarm
2 dsx1RcvFarEndLOF
3 dsx1XmtFarEndLOF
4 dsx1RcvAIS

To reference these values in an event message, use the following syntax:

{Z NewBitTable 2}
  • Z
    Indicates that you are inserting the value of a variable binding whose possible integer bit values are enumerated in an event table file.
  • NewBitTable
    Specifies the name of the event table file that contains the enumerated values.
  • 2
    Specifies the event variable number that is mapped (in the AlertMap file) to the OID of the variable binding that is sent with the trap. CA Spectrum takes the value of the event variable and retrieves the corresponding text string that is defined in the Event Table file. For example, if the event variable above, 2, stored the value 4, the text “dsx1RcvAIS” would be rendered in the event message.

Example Event Message

The following message is a sample event message:

{d "%w- %d %m-, %Y - %T"} A device {m} of type {t} has reported a Firewall trap has occurred. {S 1} contains the name of the last trap sent via fw. - (event [{e}])

When the message is displayed on the Events tab in OneClick, it is rendered as follows:

  • {d "%w- %d %m-, %Y - %T"} is replaced with the date and time
  • {m} is replaced with the model name
  • {S 1} is replaced with a string value (S for string data type) from a variable binding
  • {t} is replaced with the model type
  • {e} is replaced with the event code.

Specify Event Options

You can specify the following options for an event:

  • Whether the event is logged in the Distributed Data Manager (DDM) database by the Archive Manager for historical and reporting purposes.
    Events for a model that are not logged in the DDM database are displayed on the Events tab in OneClick only if they are generated while the Events tab for that model is displayed.
  • Whether the event is global or specific to one or more model types.
    Global events are those that are generated for all models of all model types regardless of the developer who created the model type. Examples of global events include “link down” or “cold start” events.
    If an event is specific to a model type, it is generated only for models of specific model types (for example, for a device model type that supports a proprietary MIB).
  • The Vendor field appears only for those events that are defined for a vendor. The Vendor field appears as read-only only for events that are defined under a vendor directory. This field is configurable for a new event until the event has been saved, then it appears as read-only.
Note: The Event options (and other event processing information) are stored in event configuration files referred to as event disposition files.

To specify options for an event.

  1. Select the event in the Navigation panel.
  2. In the Details panel, click the Event Options tab.
  3. If you want the event to be logged in the Distributed Data Manager (DDM) database by the Archive Manager, select Store Event in Historical Database.
  4. Under Scope, specify the scope of the event:
    • If the event is global, select Global.
    • If the event is specific to a model type, select Model Type. Then, in the Select Model Type dialog, select the name of one or more model types to which the event applies, and click OK. (Use the CTRL key to select multiple model types.)
    Note: Changing the scope of an event does not modify the event; instead, a duplicate event with the same event code but a different event scope is automatically created. As a result, when you save both events to a landscape, two event maps in two different event disposition files are created. This feature lets you specify event processing for the event and apply those instructions globally, and then override those processing instructions, for the same event, for specific model types. When CA Spectrumprocesses an event, the event maps in model type-specific event disposition files take precedence over the event maps for the same events in global event disposition files. If you change the scope of an event and you do not require the original event, you can delete it if it is a custom event.

Configure Events to Generate Alarms

You can specify that the currently selected event generates an alarm, and you can configure the alarm itself using the Alarms tab in the Details panel. The Details panel is shown in the following image:


spec--ec_configurealarmgen_SCR

When you configure an event to generate an alarm and then save that change to a landscape, you create a mapping between the event and the alarm in a configuration file, an event disposition file.

Follow these steps:

  1. Select the event in the Navigation panel, and then click the Alarms tab in the Details panel.

    Note: Under Generated Alarm, the value for Severity is None, indicating that the event does not generate an alarm.
  2. Select an alarm severity other than None from the Severity list. For more information, including descriptions of the different severity levels, see Specifying an Alarm Severity.
  3. (Optional) For Cause Code, change the alarm cause code (the 8-digit, hexadecimal code that identifies the cause of the alarm). For more information, see Specifying an Alarm Cause Code.

    Events that generate alarms typically use their event codes as alarm cause codes. The event code of the event is therefore the default alarm cause code of the alarm.
  4. For Event Variable Discriminators, enter a comma-separated list of event variable IDs if you want to use the values of the variables in the event to determine whether to generate the alarm.
    Enter each ID separately; ranges of IDs are not supported.

    Note: By default, CA Spectrum does not generate a new alarm each time the same event occurs if an alarm already exists for that event on the model. You can use event discriminators or alarm options to change this default behavior.

    For example, if the event generates alarm 0x3b10011, and you enter “1,3” for Event Variable Discriminators, and if an alarm 0x3b10011 already exists on the model, a new alarm is generated ONLY if the values for both event variables 1 and 3 are different in the new event instance as compared to current alarms on the model generated from the same event.
    For more help with this step, see Using Event Variable Discriminators to Generate Alarms.

  5. For Type, enter a text string that identifies the type of the alarm, for example, “BAD LINK DETECTED.”
    The text string that you enter for Type is displayed as the alarm title in OneClick, as shown in the following image. For enhanced readability in OneClick, enter the text string in capital letters.
    spec--ec--alarmdetails--OTH
  6. Specify the symptoms, probable causes, and recommended corrective actions for the alarm, respectively, on the Symptoms, Probable Causes, and Recommended Actions tabs. This information is displayed on the Alarm Details tab in OneClick, as shown in the preceding image.

    Note: For more information, see Specifying Symptoms, Causes, and Recommended Actions.
  7. Click the Alarm Options tab, and specify advanced options for the alarm. For more information, see Specifying Alarm Options.
  8. To configure the selected event to also clear one or more alarms, specify the alarms in the Cleared Alarms area of the Contents panel.
    For more information, see Configuring an Event to Clear Alarms.

Specify an Alarm Severity

The following lists the alarm severity levels that are used in CA Spectrum. Each severity level is associated with a color-coded condition that is displayed on the model. When an alarm of the specified severity is asserted on a model, the condition color is displayed on the model’s icon to reflect the alarm status.

  • Normal (0)
    Color-coded condition: Green
    Indicates that:
    • Contact has been made with the device, and the device is operating typically.
    • A Normal Alarm is generated.
    • If an event generates an alarm but a severity for the alarm is not specified (for instance, if you have created the supporting EventDisp configuration file manually and inadvertently omitted a severity), CA Spectrum assigns normal severity status to the alarm.
  • Minor (1)
    Color-coded condition: Yellow
    Indicates that an abnormal situation exists, but no immediate action is required. This level of severity is also used for alarms created only to convey information, such as “Duplicate IP."
  • Major (2)
    Color-coded condition: Orange
    Indicates that a loss of service has occurred or is impending. Action is required within a short period.
  • Critical (3)
    Color-coded condition: Red
    Indicates that a loss of service has occurred and immediate action is required.
  • Maintenance (4)
    Color-coded condition: Brown
    Indicates that the device has been taken offline for maintenance purposes.
  • Suppressed (5)
    Color-coded condition: Gray
    Indicates that the device cannot be reached due to a known error condition that exists on another device.
  • Initial (6)
    Color-coded condition: Blue
    Indicates that contact with the device has not yet been established.
  • Variable
    Color-coded condition: N/A; evaluates to a severity that has a color-coded condition.
    Lets you assign an alarm severity that is based on the value of a variable binding. For example, if the value of the variable binding is 1, then the alarm is assigned a severity level of Minor.
    To use this option, do the following:
    • For Severity, select Variable.
    • For Event Variable, specify the ID of the event variable that stores the variable binding value to use to determine the severity level of the alarm. You must specify a variable whose possible values are enumerated and directly correspond to the numeric severity levels used by CA Spectrum (identified in the first column in this table).
  • Conditional
    Color-coded condition: N/A; evaluates to a severity that has a color-coded condition.
    Lets you assign an alarm severity that is based on the value of a variable binding. You can also select the set of enumerated values and corresponding CA Spectrum alarm severity levels to use. The Color coded condition is useful if, for example, the variable binding defines a set of alarm severity levels that differ from those used in CA Spectrum.
    To use this option, do the following:
    • For Severity, select Conditional.
    • For Event Variable, specify the ID of the event variable that stores the variable binding value to use to determine the severity level of the alarm. Specify a variable whose possible values are enumerated. The actual value in the event variable is used as the key to look up a corresponding CA Spectrum alarm severity level in a severity mapping file.
    • Below the severity level drop-down list, select the file that contains the user-defined mappings of variable binding values and CA Spectrum alarm severity levels. 

Enable or Disable Alarms of a Severity Type

Alarms use a large amount of resources such as memory and processing time. CA Spectrum lets you disable an alarm of a severity type to reduce the impact on system performance. The disabled alarm is available internally but you cannot view it in the user interface. The disabled alarm does not support alarm attributes like discriminators. By default, alarm types with severity levels Initial and Suppressed are set as disabled. All other alarm types continue to exist as regular alarms.

Note: Normal severity alarms do not support discriminators.

To disable an alarm of a severity type:

  1. Select the VNM Model.
  2. Click the Information tab and expand the Alarm Management section.
  3. Right-click the alarm and select Disable.
    The alarm is disabled and the change takes effect immediately. The existing alarms of the selected severity type continue to be regular or internal alarms until they are cleared.

To enable an alarm of a severity type:

  1. Select the VNM Model.
  2. Click the Information tab and expand the Alarm Management section.
  3. Right-click the alarm and select Enable.
    The alarm is enabled and the change takes effect immediately. The existing alarms of the selected severity type continue to be regular or internal alarms until they are cleared.
  • Even after enabling alarms, verify that the client-side filters are adjusted, before you can view the alarm in the client applications.
  • We do not recommend enabling the Suppressed alarm type as it can affect performance adversely.

Specify an Alarm Cause Code

An alarm cause code is an 8-digit, hexadecimal code that identifies the probable cause of the alarm. As you save the event and associated alarm to a landscape, a mapping between the event code and the associated alarm code is added to the event configuration file that determines how to process the event, referred to as the event disposition file. This mapping is the mechanism by which CA Spectrum identifies whether or not to generate an alarm for an event, and if so, which one.

As a convention, events that generate alarms typically use their event codes as alarm cause codes, and for this reason, the event code of the event is the default alarm cause code of any alarm. However, you can change the alarm cause code if desired. For example, you want to change the alarm cause code, if you have a more generic existing alarm and want it to be generated whenever the event occurs.

The alarm cause code is also used to name the underlying probable cause file that contains the alarm-related messages (symptoms, causes, and recommended actions) to display in OneClick when the alarm occurs. Each probable cause file is named Prob<alarm_cause_code>, where <alarm_cause_code> is the code you specify on the Alarms tab in Event Configuration.

To specify an alarm cause code, do one of the following:

  • Accept the default code, which readily identifies the alarm with the event that generates it. If the supporting probable cause file does not exist, it is created automatically by Event Configuration when you save the event and alarm changes to a landscape.
  • Click Browse, and in the Select Alarm Cause Code dialog, select an existing code. The displayed list includes all of the alarm cause codes for all loaded events that generate alarms. In this case, the supporting probable cause file is updated automatically when you save the event and alarm changes to a landscape.
  • Enter a new 8-digit, hexadecimal value. If the supporting probable cause file does not exist, it is automatically created by Event Configuration while saving the event and alarm changes to a landscape.
Note: If you create an alarm-generating event, save it to one or more landscapes and later, change the alarm cause code to a new code and then save the changes to the landscapes. Event Configuration automatically creates a new probable cause file that is named based on the new alarm cause code. However, to remove the probable cause file that is named using the old code (if it is not used by any other alarm-generating events), you must remove it manually.

About Specifying Symptoms, Causes, and Recommended Actions

If an event generates an alarm, you must supply several plain text messages that describe the symptoms, probable causes, and recommended corrective actions for the alarm. These messages are displayed on the Alarm Details tab in OneClick, as shown in the following image.

spec--ec--alarmdetails--OTH

The text messages that you enter for the symptoms, probable causes, and the recommended corrective actions for an alarm, are stored in an alarm configuration file referred to as a probable cause file. The fields that support traps get auto-populated. For example, when you create a new alarm the trap-specific Alarm Title is auto-populated assuming the MIB in which the trap is defined is found in the MIB database.

Specify Alarm Options

You can specify the following advanced options for an alarm:

  • Alarm is Persistent
    If this option is selected, the alarm is retained in memory, in case the SpectroSERVER is shut down and restarted.
  • Alarm is User Clearable
    If this option is selected, users can clear the alarm
  • Generate a Unique Alarm for Each Event
    By default, CA Spectrum does not generate a new alarm each time the same event occurs if an alarm already exists for the event on the model.
    If this option is selected, a unique alarm is generated each time the same event occurs.

Using Event Variable Discriminators to Generate Alarms

When an event triggers an alarm in a model, CA Spectrum does not generate a separate alarm if the same event recurs on the model. This default behavior prevents an event that can occur multiple times due to the same condition. You can however, configure multiple alarms to occur when the conditions of the event change. You can specify this behavior using event variable discriminators.

Event variable discriminators are numeric values that refer to the IDs of the event variables in an event. In turn, the event variable IDs are mapped (in the AlertMap file) to the OIDs of the variable bindings that are sent with the trap. The discriminators let CA Spectrum determine to generate alarms for multiple instances of the same event, that is based on the values of variable bindings that are sent with the traps.

You can configure an event to generate an alarm and also specify one or more discriminators. The alarm is generated when the values of the referenced event variables are different. You can thus, specify alarms to be generated for distinct event instances (with the same event code) in spite of an existing alarm in the model.

For example, to generate alarm 0x3b10011 you have configured event 0x3b10011, and have specified that event variables 1 and 3 are event variable discriminators. This configuration means that, if an alarm 0x3b10011 already exists on the model, another alarm is not generated.

However if the following condition is met, a new alarm is generated:

The values for both event variables 1 and 3 in the new event instance are different compared to current alarms on the model that is generated from the same event.

When you are configuring an alarm, specify the event variable discriminators by entering a comma-separated list of IDs, for example:

1,3,5
You must enter each ID; ranges of IDs are not supported.
Note: The Event discriminators cannot be specified for normal, maintenance, suppressed, or initial severity alarms.

Creating Dynamic Alarm Title

The alarm title is taken from the PCause files ($SPECROOT/SG-Support/CsPCause).

In OneClick, whenever the dynamic alarm title attribute has any value, the dynamic string is displayed instead of the static alarm title from the probable cause file. If there is no value in the dynamic alarm title attribute, the static alarm title is displayed by default, .

You can use the dynamic alarm title variable to create a dynamic alarm title. The dynamic varbind id is 76620 (or 0x12b4c). Once you set the dynamic alarm title variable, you see more information about the alarm in the title. To use the functionality, you can create an event which has that varbind set to any value for e.g. by mapping a trap variable to that ID in an alert map file. You can also copy some other event variable through an event rule, and then map the event to an alarm using that ID as a discriminator.

Example: Create a Dynamic Alarm Title

You can either create 0x050e1106 through an alert map or through the condition rule. This example maps an alert to an event, copying over one alert variable (1.3.6.1.10.1.2) as a dynamic alarm title. The dynamic varbind id is 76620 (or 0x12b4c).

1.3.6.1.4.4.1.6.3 0x050e1106 1.3.6.1.4.1.10.1.1(1,0)\ 1.3.6.1.4.1.10.1.2(76620,0)

You can also use an event rule to copy over a varbind (here ID 7 from event 0xffff0000) to be used as dynamic title id in the new event (0x050e1106).

0xffff0000 E 50 R CA.EventCondition, “default”, “0x050e1106 7:76620”

For both cases, you can create a minor alarm which shows the dynamic title, discriminating on the dynamic value ID. This condition shows an individual alarm for each value.

0x050e1106 E 50 A 1,0x050e1106,76620

Example: Clear a Dynamic Alarm Title

This example shows how to clear a dynamic alarm title using the Dynamic ID value.

0x050e1107 E 50 C 0x050e1106, 76620

Note: You do not have to use the dynamic alarm title attribute as discriminator. In this case, there is only one alarm, with one title, with the value from the first event which created the alarm. All subsequent events are attached to that alarm, even when you have different dynamic title values. If they use the discriminator, then they get one alarm per title value. This variable uses the regular discriminator feature.

Configuring Alarm Severity Mappings for the Conditional Severity Level

A severity mapping file is an ASCII file that is used to determine the actual severity of an alarm instance to generate when the alarm configuration specifies an alarm severity of Conditional.

The Conditional alarm severity lets you assign the alarm severity that is based on the value of a variable binding that is sent with the trap which triggered the event. It also allows you to select the set of mappings between values and alarm severity levels to use when determining the actual alarm severity.

The severity mapping file defines the mappings between possible variable binding values and CA Spectrum alarm severity levels. You can create severity mapping files and can customize the ones that are provided by default with CA Spectrum.

Create Alarm Severity Mappings for the Conditional Severity Level

If you create a severity mapping file, the file is installed in the following location when you save the change to a landscape:

<$SPECROOT>/custom/Events/<vendor_directory>/SeverityMaps/<file name>

Where <vendor_directory> is the directory and <file_name> is the file name that you specified when you created the mapping file using Event Configuration. If you do not specify a directory while creating the file, it is installed in the following folder instead:

<$SPECROOT>/custom/Events/CA/SeverityMaps/<file name>

Important! Custom severity mapping files override those Severity files provided with CA Spectrum, the latter of which are located in <$SPECROOT>/SS/CsVendor/<vendor_directory>/SeverityMaps.

To create an alarm severity mapping file

  1. Display the event that generates the alarm, and click the Alarms tab.
  2. If you have not already done so, do the following:
    1. For Severity, select Conditional.
    2. For Event Variable, enter or select the event variable that contains the variable binding value to use to determine the alarm severity.
  3. Select any severity mapping file and click Configure.
    The Configure Conditional Alarm Severity dialog opens, displaying the contents of the selected severity mapping file.
  4. Click SPEC--create_ICO.
    The severity mapping file add dialog opens.
    spec--ec--conditionalalarmseverity2--SCR
  5. Complete the fields as follows:
    • Directory
      Specifies the directory in which to save the severity mapping file.
    • Name
      Specifies a name for the severity mapping file; ideally the name of the variable binding whose values are enumerated in the file.
  6. Add the mappings between the string representations of the variable binding values and CA Spectrum alarm severity levels (described in Specifying an Alarm Severity) as follows: 

    Note: For Alarm Severity value zero (‘0’), Spectrum generates a normal alarm along with an event. So, if you do not want a normal alarm to be generated for the Severity value zero, do not include the string in the Severity Maps file.

    • To add a mapping, enter a unique string value for String, select a severity for Severity, and click Add.

      If you want the alarm to be cleared -- instead of generated -- if the corresponding variable binding value is sent, select Clear.
    • To change a mapping, select the mapping, change the value for String or for Severity (or both), and click Modify.
    • To remove a mapping, select the mapping, and click Remove. 

      Note: Spectrum treats the entries in SeverityMap file as regular expressions. To match the exact variable binding value to a CA Spectrum alarm severity level, we recommend that you use word boundary characters ('\b') before and after the varbind value string in SeverityMap file.

  7. Click OK twice.

Modifying Alarm Severity Mappings for the Conditional Severity Level

You can modify your custom severity mapping files and the mapping files provided by default with CA Spectrum at any time.

If you modify a severity mapping file provided with CA Spectrum, a customized version of the file is installed in the following location when you save the change to a landscape:

<$SPECROOT>/custom/Events/<vendor_directory>/SeverityMaps/<file name>

Important! Custom severity mapping files override those provided with CA Spectrum, the latter of which are located in <$SPECROOT>/SS/CsVendor/<vendor_directory>/SeverityMaps.

To modify an alarm severity mapping file, Follow these steps:

  1. Display the event that generates the alarm, and click the Alarms tab.
  2. If you have not already done so, do the following:
    1. For Severity, select Conditional.
    2. For Event Variable, enter or select the event variable that contains the variable binding value to use to determine the alarm severity.
  3. Select the severity mapping file to use to determine the actual severity level of the alarm, and click Configure.
    The Configure Conditional Alarm Severity dialog opens, displaying the contents of the selected severity mapping file.
  4. Click SPEC--editbutton_ICO.
    The severity mapping file edit dialog opens.
  5. Modify the mappings between the string representations of the variable binding values and CA Spectrum alarm severity levels as follows: 

    • To change a mapping, select the mapping, change the value for String or for Severity (or both), and click Modify.

      Select Clear to clear the alarm -- instead of generating it -- if the corresponding variable binding value is sent.
    • To add a mapping, enter a unique string value for String, select a severity for Severity, and click Add.
    • To remove a mapping, select the mapping, and click Remove. 

      Note: Spectrum treats the entries in SeverityMap file as regular expressions. To match the exact variable binding value to a CA Spectrum alarm severity level, we recommend that you use word boundary characters ('\b') before and after the varbind value string in SeverityMap file.

  6. Double-click OK.

Configure Events to Clear Alarms

You can specify that the currently selected event clears one or more alarms using the Alarms tab in the Details panel, which is shown in the following image.

spec--ec--configalarmclear--SCR

When you configure an event to clear alarms and then save that change to a landscape, you create a mapping between the event and the alarms to be cleared in a configuration file referred to as an event disposition file.

Follow these steps:

  1. Select the event in the Navigation panel, and then click the Alarms tab in the Details panel.
  2. Under Cleared Alarm(s), click spec--addalarms_ICO (Adds an alarm to the list).
    The Add Cleared Alarm dialog displays the alarm cause codes for all alarms that are loaded into Event Configuration.
  3. Click Browse, and in the Select Alarm Cause Code dialog, select the alarm cause code of the alarm to clear.
    To help you identify the desired alarm, enter a text string in the Filter text box. The list is filtered to include only the alarms with displayed properties that contain the text string.
  4. Click OK.
  5. If the alarm that you want to clear was generated based on event variable discriminators, select Clear Options, and then specify how the alarm is cleared. Select one of the following options:
    • All Alarms
      The event clears all existing instances of the alarm, regardless of whether the values in the alarm-clearing event match the values that are stored in the alarm instances.
    • Event Variable Discriminators
      The event clears existing instances of the alarm that is based on the values of the alarm variables (which are copied from the alarm-generating event to the alarm when the alarm is generated). Then enter a comma-separated list of event variable IDs (for example: 1,3,5). You must enter each ID separately; ranges of IDs are not supported.
      If the values in event match the values stored in the alarm, the alarm-clearing event clears the alarm.

      For examples of using event discriminators to clear alarms, see Clearing Alarms.
  6. Click OK.
  7. (Optional) Repeat the preceding steps to add additional alarms to be cleared.

Modify Events

You cannot delete the events that CA authors and provides with CA Spectrum. However, you can customize them to meet your requirements simply as you would any other events.

In addition, you can undo any customizations that you make to a CA-authored event by deleting the event. For CA-authored events only, this action does not delete the event but instead reverts it to its default configuration.

When you delete (revert) a CA-authored event, the author of the event changes from “Custom” back to “CA.” To identify the author of an event, add the Author column to the table of events in the Navigation panel, as described in Adding and Removing Columns from the Events Table.

To modify events.

  1. Select the event in the Navigation panel.
    The event details are displayed in Contents and Details panels.
  2. Modify the event details.
    The event is displayed in bold. The Modification column displays Edited.

    Note: The event is marked Edited. However, the event is not saved. You can make more updates such as create more events, modify existing events, or delete events, and save all the updates at one time.
  3. Do one of the following:
    1. Go to File, Save All.
      All marked events in the Navigation panel are saved.
    2. Select the desired events in the Navigation panel, and go to File, Save Selected.

      Note: You can select multiple events using the Shift key.

      The selected events are saved.

    The events are modified. The events appear in the normal font and are not marked in the Modification column.

Delete Custom Events

You can delete any event that CA did not author. To identify the author of an event, add the Author column to the table of events in the Navigation panel.

Important! Do not delete an event until you are certain it is no longer required. If you delete an event that generates a needed alarm, CA Spectrum is unable to inform you about a problem in the network infrastructure.

To delete events.

  1. To delete events, select the event in the Navigation Panel, and click SPEC--clearalarms_deleteusers_ICO (delete).
    The event is displayed in italics. The Modification column displays Deleted.

    Note: The event is marked Deleted. However, the event is not deleted until you save the changes. You can make more updates such as create more events, modify existing events, or delete events, and save all the updates at one time.
  2. Do one of the following:
    1. Go to File, Save All.
      All marked events in the Navigation panel are saved.
    2. Select the desired events in the Navigation panel, and go to File, Save Selected.

      Note: You can select multiple events using the Shift key.

      The selected events are saved.

    The events are deleted. The events appear in the normal font and are not marked in the Modification column.
Was this helpful?

Please log in to post comments.

  1. Shane Ryan
    2018-11-13 12:22

    the following is written incorrectly

    0x050e1106 E 50 A 1,0x 050e1106, 76620

    it should be 0x050e1106 E 50 A 1,0x050e1106,76620

    1. Sarah Gideon
      2018-11-16 02:10

      Thanks Shane

      I've made the correction. The spacing was the issue here. 

      Regards, 

      Sarah