SPECTRUM custom event from trap not displaying varbind values (Legacy KB ID CNC TS31400 )

Document ID : KB000051853
Last Modified Date : 14/02/2018
Show Technical Document Details
The following is what the Event Format file should look like:


{d "%w- %d %m-, %Y - %T"}- model '{m}' of type '{t}' reports that managed object {S 2} (part of {S 3}) is outside of the configured traffic rate threshold. It is {S 4}.  The threshold is {I 5} {S 7}, the actual usage is {I 6} {S 7}. Arbor alert {I 1}. (event [{e}])


After making the above changes the following is the event created in SPECTRUM:


Severity Created On Name Event Event Type Created By Cleared On Cleared By
 Mar 10, 2009 1:45:46 PM EDT lab-B1 model 'lab-B1' of type 'Rtr_Cisco' reports that managed object Level 3 (part of peer ) is outside of the configured traffic rate threshold. It is High.  The threshold is 300000000 bps, the actual usage is 307030880 bps. Arbor alert 60897. 0xffffffff System  



Related Issues/Questions:
SPECTRUM custom event from trap not displaying varbind values

Problem Environment:
SPECTRUM 08.00.00.00
SPECTRUM 08.01.00.00
SPECTRUM 09.00.00.00
All versions of SPECTRUM
Event Format
Data Types
varbind


The following is the raw trap data being received by the SpectroSERVER: 


Trap: 596564
        Fri Feb 13 13:33:52 2009
        Src IP: 128.91.63.7
        Agent: 0.0.0.0
        Trap Type: Vendor Specific
        Specific Type: 20
        Enterprise: 1.3.6.1.4.1.9694.1.4.3.0
        Object:1.3.6.1.4.1.9694.1.4.1.18 Value:60897
        Object:1.3.6.1.4.1.9694.1.4.1.25 Value:Level 3
        Object:1.3.6.1.4.1.9694.1.4.1.26 Value:peer
        Object:1.3.6.1.4.1.9694.1.4.1.24 Value:High
        Object:1.3.6.1.4.1.9694.1.4.1.27 Value:300000000
        Object:1.3.6.1.4.1.9694.1.4.1.28 Value:307030880
        Object:1.3.6.1.4.1.9694.1.4.1.29 Value:bps



Causes of this problem:
The cause of the issue was the data types used for the varbinds in the Event Format file were incorrect.


The following is the Event Event Format file being used:


{d "%w- %d %m-, %Y - %T"}- model '{m}' of type '{t}' reports that managed object {s 2} (part of {s 3}) is outside of the configured traffic rate threshold. It is {s 4}.  The threshold is {u 5}{s 7}, the actual usage is {u 6}{s 7}. Arbor alert {u 1}. (event [{e}])


The following is the event created using the above Event Format file:


EventMessage:     Thu 05 Mar, 2009 - 10:09:57- model  'arbor1.dccs.upenn.edu' of type 'GnSNMPDev' reports that managed  object '' (part of '') is outside of the configured traffic rate  threshold. It is ''.  The threshold is '''', the actual usage is  ''''. Arbor alert ''. (event [0x01c2ffb6])



Additional Information:
The data types for the varbind values in the Event Format must be compatible to the varbinds sent with the trap. This can be verified by either looking at the raw trap data or from the vendors trap mib.
The varbind data type definitions are case sensitive. For example:


{o #} - A lower case letter "o" inserts an object ID.
{O #} - An upper case letter "o" inserts an octet string.


In the initial Event Format file, the user specified a lower case letter "s" and "u" which have no corresponding data type definition.


The SPECTRUM 9.0 Event Configuration User Guide and the SPECTRUM 8.1 Event Configuration Editor User Guide have detailed information about the proper syntax for the varbind data types in the Event Format file.


(Legacy KB ID CNC TS31400 )