Syslog events generate alarms but there is not an event to automatically clear them. How can SPECTRUM automatically clear an alarm after a specified period of time?

Document ID : KB000016567
Last Modified Date : 14/02/2018
Show Technical Document Details
Introduction:

Customer is getting a syslog trap that generates a major alarm (0x21001b). How can Spectrum clear it after a specific interval time?

Question:

How can Spectrum clear an alarm after a specific interval time? 

Environment:
any
Answer:

You can use the Alarm Age Out functionality to do this, but it is limited to an hourly limit.  If you would like to specify a different time period, (like less than an hour) then this functionality can be achieved by using an Event Pair Rule. 

Assuming you want to automatically clear the major alarm generated by the event 0x0021001b after 30 seconds it was generated, you can do as follows:

1) Define a "false" event. This is an event that exists in Event Configuration but that is just used in the Event Pair Rule to trigger an new event to clear the alarm.

Open Event Configuration click on + to define a new event and create a new event eg. 0xfff9999 as follows:

Capture1.PNG

2) Create an event that is triggered by the Pair Rule after x time that the alarm exists and that is used to clear the alarm 0x21001b.

eg. the event 0xff21001b is used to clear the alarm 0x21001b

Capture2.PNG

3) Open event 0x0021001b that raises a major alarm and associated to it an event Pair Rule. Click on Event Rule, click on + and select Pair Rule as follows:

Capture3.PNG

In the interval time you can specify days and also hours/min/secs. 

So the event 0x0021001b generates a major alarm and for the Event Pair Rule after the interval time specified (eg. 30 sec) It also generates a new event 0xff21001b that, as defined above, will automatically Clear the alarm.

Additional Information:

See Working with Event Rules on https://docops.ca.com/ca-spectrum/10-2-2/en/managing-network/event-configuration/working-with-event-rules