Event Configuration Editor User s Guide

Transcription

1 Titlepage Event Configuration Editor User s Guide SPECTRUM Enterprise Manager SPECTRUM Management

2 Notice Aprisma Management Technologies, Inc. (Aprisma) reserves the right to make changes in specifications and other information contained in this document without prior notice. The reader should in all cases consult Aprisma to determine whether any such changes have been made. The hardware, firmware, or software described in this manual is subject to change without notice. IN NO EVENT SHALL APRISMA, ITS EMPLOYEES, OFFICERS, DIRECTORS, AGENTS, OR AFFILIATES BE LIABLE FOR ANY INCIDENTAL, INDIRECT, SPECIAL, OR CONSEQUENTIAL DAMAGES WHATSOEVER (INCLUDING BUT NOT LIMITED TO LOST PROFITS) ARISING OUT OF OR RELATED TO THIS MANUAL OR THE INFORMATION CONTAINED IN IT, EVEN IF APRISMA HAS BEEN ADVISED OF, KNOWN, OR SHOULD HAVE KNOWN, THE POSSIBILITY OF SUCH DAMAGES. Copyright November, 2000 by Aprisma Management Technologies, Inc. All rights reserved. Printed in the United States of America. Order Number: Aprisma Management Technologies, Inc. 121 Technology Way Durham NH SPECTRUM, the SPECTRUM IMT/VNM logo, DCM, IMT, and VNM are registered trademarks, and SpectroGRAPH, SpectroSERVER, Inductive Modeling Technology, Device Communications Manager, and Virtual Network Machine are trademarks of Aprisma or its affiliates. C++ is a trademark of American Telephone and Telegraph, Inc. UNIX is a trademark of UNIX System Laboratories, Inc. OSF/Motif and Motif are trademarks of the Open Software Foundation, Inc. X Window System is a trademark of X Consortium, Inc. Ethernet is a trademark of Xerox Corporation. Virus Disclaimer Aprisma makes no representations or warranties to the effect that the Licensed Software is virusfree. Aprisma has tested its software with current virus checking technologies. However, because no anti-virus system is 100% reliable, we strongly caution you to write protect and then verify that the Licensed Software, prior to installing it, is virus-free with an anti-virus system in which you have confidence. Event Configuration Editor User s Guide Page 2

3 Restricted Rights Notice (Applicable to licenses to the United States Government only.) 1. Use, duplication, or disclosure by the Government is subject to restrictions as set forth in subparagraph (c) (1) (ii) of the Rights in Technical Data and Computer Software clause at DFARS Aprisma Management Technologies, Inc., 121 Technology Way, Durham, New Hampshire (a) This computer software is submitted with restricted rights. It may not be used, reproduced, or disclosed by the Government except as provided in paragraph (b) of this Notice or as otherwise expressly stated in the contract. (b) This computer software may be: (1) Used or copied for use in or with the computer or computers for which it was acquired, including use at any Government installation to which such computer or computers may be transferred; (2) Used or copied for use in a backup computer if any computer for which it was acquired is inoperative; (3) Reproduced for archival or backup purposes; (4) Modified, adapted, or combined with other computer software, provided that the modified, combined, or adapted portions of the derivative software incorporating restricted computer software are made subject to the same restricted rights; (5) Disclosed to and reproduced for use by support service contractors in accordance with subparagraphs (b) (1) through (4) of this clause, provided the Government makes such disclosure or reproduction subject to these restricted rights; and (6) Used or copied for use in or transferred to a replacement computer. (c) Notwithstanding the foregoing, if this computer software is published copyrighted computer software, it is licensed to the Government, without disclosure prohibitions, with the minimum rights set forth in paragraph (b) of this clause. (d) Any other rights or limitations regarding the use, duplication, or disclosure of this computer software are to be expressly stated in, or incorporated in, the contract. (e) This Notice shall be marked on any reproduction of this computer software, in whole or in part. Event Configuration Editor User s Guide Page 3

4 Contents Introduction 6 What Is the Trap, Event, Alarm Process?... 6 Files and Directories for Mapping Traps, Events, Alarms... 8 What Is the Event Configuration Editor? ECEditor Main Window 13 Accessing the ECEditor Accessing the ECEditor from the Command Line Setting the Display Environment Overview of the Main Window The Main Menus File Menu View Menu Show Toolbar Show Toolbar Labels Show Tool Tips Show Status Help Connection Status Events Menu Alarms Menu Traps Menu Options Menu Preferences Connection Display ECEditor Clear User Preferences Help Menu What s This? About Event Configuration Editor Online Manuals Defining Global and Default Event Processing 28 Event Configuration Editor User s Guide Page 4

5 Contents Contents Frequency and Persistent Event Processing Frequency and Persistent Event Syntax Frequency Event Syntax Order of Directives Persistent Event Syntax Configure Trap Mappings 32 The Trap Mappings Process The Configure Trap Mappings Dialog Box Trap Mappings Table Filter/Search Trap Mapping Actions Trap Data Table Trap Map Entry Actions Configuring Event Messages 54 The Event Messages Process The Configure Event Messages Dialog Box Event Codes/Messages Event Mapping/Event Message Format Pages Event Mapping Event Message Formats/Table Configuration Page Event Actions Configure Alarm Messages 80 The Alarm Messages Process The Configure Alarm Messages Dialog Box Alarm Probable Cause ID/ Probable Cause Title Filter/Search Tabbed Pages Alarm Actions Glossary of Terms and Acronyms 97 Index 107 Event Configuration Editor User s Guide Page 5

6 Introduction This section describes the trap, event, alarm process and the files and directories used in the process. What Is the Trap, Event, Alarm Process? The process usually begins with a trap. A trap is generated by an intelligent network device when an interesting event occurs on its LAN. The interesting event can be an inoperable hub or something as simple as a disconnected printer, any extraordinary occurrence that happens to any device that is managed by the network. Traps are received from these devices when they have exceeded a threshold or a predefined situation. Traps are received by the SpectroSERVER and need to be mapped to various SpectroGRAPH views and cause various actions. This process is handled by SPECTRUM through several text files which are user definable. The following files and subdirectories affect SpectroSERVER and SpectroGRAPH as follows: SpectroSERVER AlertMap (~/SS/CsVendor/<Developer-Name>/<ModelType Name) Event Disposition (~/SS/CsVendor/<Developer-Name/EventDisp) SpectroGRAPH Event Text (~/SG-Support/CsEvFormat) Probable Cause (~/SG-Support/CsPCause) When a trap is received it is mapped to an event through an AlertMap. This event is identified by an Event Code. The Event Code, specified in the AlertMap file, identifies the CsEvFormat file, which determines the content of the text that is displayed in the Event Log window. An optional handle in the EventDisp file, the Alarm-Cause, is used to map the event to an alarm. When an alarm is generated, all interested users are notified by means of an alarm message. Event Configuration Editor User s Guide Page 6

7 Introduction Figure 1 shows the process a trap goes through as it accesses the files and directories in SPECTRUM to become an event and, when needed, an alarm. Figure 1: Traps, Events, Alarms Process SNMP Managed Device Trap Generated Trap Type Trap Variables SpectroGRAPH Model Icon SpectroSERVER Event or Event/Alarm Information Event Log Alarm View Trap Type Trap Variables Event Code Event Code Event or Event/Alarm Information Event Code Event Message Text Alarm Info Probable Cause Message Text Trap Type Event Code Trap Type Event Code Trap Type Event Code Trap Type Event Code Trap Type Event Code Trap Type Event Code Trap Type Event Code 00x E 00x E 50 A 00x E 30 00x E A 00x E 50 A 00x E 30 00x E A Event Event Event Event a Event b Event c Prob Prob Prob Prob a Prob b Prob c AlertMap File EventDisp File CsEvFormat Directory CsPCause Directory Event Configuration Editor User s Guide Page 7

8 Introduction Files and Directories for Mapping Traps, Events, Alarms The following shows the files and directories used through the trap/event/alarm configuration process by showing where a trap originates and what files are updated as a trap makes its way through SPECTRUM to become an event and to possibly generate an alarm. SNMP MIB Description The data from the Management Information Block (MIB) is used to identify the type of trap. The MIB consists of a collection of managed objects. The MIB specifies the variables a host or gateway must keep and the operations allowed on each. Example of a MIB: port Segmenting TRAP-TYPE ENTERPRISE cabletron VARIABLES { rptrportgrpmgmtgrpid, rptrportmgmtportid } DESCRIPTION When a port goes from operation to segmented, a trap will be generated. For these purposes, the port state will be sampled every XXX seconds, thus it will be statistically possible to miss oscillating circuits. ::= x0101 Event Configuration Editor User s Guide Page 8

9 Introduction SNMP Trap A trap is unsolicited information about a managed device that is either broadcast or directed to SPECTRUM network management stations. Example of a Trap: Enterprise: Generic Trap Code: 6 Specific Trap Code: 257 Variable 1: OID = value = 5 Variable 2: OID = value = 10 Event Configuration Editor User s Guide Page 9

10 Introduction The files and directories that are updated when a trap is mapped to an event: Example of an AlertMap file x (1,2)\ (3,4) Example of an EventDisp file 0x E 50 A 1,0x Example of an Event file NOTE: The items without a value are specific to the model for which the event is generated. <model handle> <model type handle> <event type> = 0x10601 <severity>=50 <model name> <model type name> <user name> <var data>=<index>/<value>=1/5 2/5 3/10 4/5.10 Event Configuration Editor User s Guide Page 10

11 Introduction What Is the Event Configuration Editor? The files and directories that are updated when an event is mapped to an alarm: Example of a file in CsEvFormat directory {d %w- %d %m-, %Y - %T } -Port {I 3} (Instance ID {O 4}) on board in slot {I 1} (Instance ID {O 2}) of {t} (name - {m}) has segmented. (Trap type: 0x0101) - (event [{e}]) Example of a file in CsPCause directory PORT SEGMENTED SYMPTOMS: device. A portsegmenting trap was received from the PROBABLE CAUSES: A port has changed from operational to segmented. RECOMMENDED ACTIONS: None. What Is the Event Configuration Editor? The Event Configuration Editor (ECEditor) allows creation, deletion, modification, and browsing of the following information in SPECTRUM: Alert Map, Event Disposition, Event Format, and Alarm Probable Cause files. The main window has a menu bar, toolbar, status information area, and two sections in the control area: a User Information display and a Server Information display. The ECEditor s major benefits include the following: Provides ease of use and ease of learning Allows completion of all configuration tasks in one application Event Configuration Editor User s Guide Page 11

12 Introduction Satisfies the users needs for a consistent data presentation and data entry scheme The ECEditor provides you with the following options, available from the ECEditor s main window; Configure Trap Mappings: To modify, add, copy, or delete trap mappings. Configure Event Messages: To map events To correlate messages into events To modify, add, copy, or delete event messages. Configure Alarm Messages: To modify, add, copy, or delete alarm messages. The ECEditor provides you with full functionality to map traps, map event messages, and map alarm messages in a single application. The ECEditor is a standalone application that can be run independently from the command line or accessed from the Control Panel. Event Configuration Editor User s Guide Page 12

13 ECEditor Main Window This section details and describes the menu items that are accessed from the Event Configuration Editor (ECEditor) Main Window. Accessing the ECEditor You can access the ECEditor from the Control Panel by selecting Configure > ECEditor. This will open the Select SpectroSERVER window shown in Figure 2. Figure 2: Select SpectroSERVER Select SpectroSERVER Select initial SpectroSERVER to connect to. Available Servers: <SERVER NAME> Filter Show this dialog at startup Next OK Exit Select a <SERVER NAME> and OK to open the Event Configuration Editor main window. The ECEditor contacts the SERVER to access Developer and Security information. If you have a loaded developer ID, you can open the SERVER against the developer ID, which will be listed in the Select SpectroSERVER dialog box under DEFAULT. Event Configuration Editor User s Guide Page 13

14 ECEditor Main Window Overview of the Main Window Accessing the ECEditor from the Command Line To run the ECEditor as a standalone application from the command line, cd to the SG-Support/CsExtProcess directory and type the following command: ECEditor -vnm <vnm name> Example: <SPECTRUM Directory path>/sg- Support/CsExtProcess ECEditor -vnm senna Setting the Display Environment If you are operating the ECEditor without SpectroGRAPH, you must set up your environment before starting the application. In your SPECTRUM directory, navigate (cd) to the Install-Tools directory. Within this directory are the setup.csh (for C shell) and setup.ksh (for Korn shell) files. You need to source the appropriate file, depending on which shell you are using, by typing the following from the SPECTRUM Install-Tools directory: source setup.csh or. setup.ksh Example: <SPECTRUM directory path> /Install-Tools source setup.csh Overview of the Main Window The ECEditor main window, shown in Figure 3, is used to access all the selections that will help you configure event messages, alarm messages, and trap mappings. This chapter describes each of the main menu selections by giving you an overview of the information each provides and the tasks you can perform. Event Configuration Editor User s Guide Page 14

15 ECEditor Main Window In addition, there is an Options menu where you can set preferences and a Help menu that allows you to access online manuals and hints about how to use the ECEditor. Figure 3: Example of the ECEditor Main Window Toolbar Icons Menu Bar Event Configuration Editor: Main File View Events Alarms Traps Options Help Update Event Alarm Trap User Information What s This? Server Information User: Administrator Connected To Server: corporate.com Permissions: Browse & Edit Accessing Local Install: C:\usr\spectrum\ Developer: DEFAULT 0xffff0000 View or modify trap mappings Servers Status Help Connection Status The ECEditor Main window consists of the following: Menu Bar - described under The Main Menus. Toolbar Icons - described under View Menu. User Information - this panel contains the following: User - the name of the user who is running the ECEditor. Event Configuration Editor User s Guide Page 15

16 ECEditor Main Window The Main Menus Permissions - the access permissions for the user which include Browse & Edit (Admin) or Browse (Non-Admin). See the Security and User Maintenance guide for more information about permissions. Developer - the developer name as recorded in the SpectroSERVER. Server Information - this panel contains the following: Connected to Server - the SpectroSERVER the ECEditor is connected to. Accessing Local Install - the installation area where the files and directories that the ECEditor uses reside. Status Help - a one line description for the item you move your mouse over. Connection Status - described under View Menu. The Main Menus Figure 4 shows the main window where you can access several menu selections. These selections are described in more detail below. Figure 4: ECEditor Main Menu Selections View Show Toolbar Show Toolbar Labels Options Show Tool Tips Alarms Show Status Help Preferences... Ctrl+Y Connection Status Configure Messages... Clear User Preferences Event Configuration Editor: Main File File View Events Alarms Traps Options Help Update SpectroSERVER Close Alt+F4 Events Configure Messages... Traps Configure Mappings... Help What s This? About Event Configuration Editor... Online Manuals Event Configuration Editor User s Guide Page 16

17 ECEditor Main Window File Menu To update the server with the latest AlertMap and EventDisp information, select Update SpectroSERVER menu pick. This causes SpectroSERVER to re-read these files immediately and process events using the new processing directive. Exit the ECEditor from the File menu. Select Close (or key combination Alt+F4) to close the ECEditor window and exit the ECEditor. View Menu The Toolbar, the Tool Tips, the Status Help, and the Connection Status Information are accessed from the View menu (see Figure 5). If you wish to activate each of these so that you can use the toolbar and view the toolbar labels, the tool tips, the status help, or the connection status information, be sure the button next to each selection on the View menu is selected (recessed). Figure 5: View Menu Selections Event Configura File View Events Alarms Traps Op button will be recessed if selected View Show Toolbar Show Toolbar Labels Show Tool Tips Show Status Help Connection Status Event Configuration Editor User s Guide Page 17

18 ECEditor Main Window Show Toolbar Figure 6: Show Toolbar This option allows you to show or hide the toolbar icons. The Toolbar (shown in Figure 6) consists of five icons that offer alternative ways of activating the functions that are accessible from the menu bar. The toolbar will remain hidden until you select View > Show Toolbar. The first icon (counter-clockwise arrows) is the equivalent of the File menu s Update SpectroSERVER option. The second icon (lightening bolt) is the equivalent of the Event s menu s Configure Messages option. The third icon (gong-style alarm) is the equivalent of the Alarms menu s Configure Messages option. The fourth icon (red flag) is the equivalent of the Traps menu s Configure Mappings option. The fifth icon (arrow and question mark) is the equivalent of the Help menu s What s This? option. Show Toolbar Labels This option lets you show/hide the labels for each of the toolbar buttons. The toolbar button labels are: Update, Event, Alarm, Trap, and What s This?. To hide the Toolbar labels, shut off Show Toolbar Labels (button is up). Event Configuration Editor User s Guide Page 18

19 ECEditor Main Window Show Tool Tips This option allows you to show or hide the tool tips. When this option is selected, placing the mouse pointer on any of the toolbar icons will display a short description of the icon s function as shown in Figure 7. Figure 7: Show Tool Tips Configure Trap Mappings Show Status Help This option allows you to show or hide status help. As you move your mouse over an icon, the Status Help line displays a brief description of what the icon will do if you select it. When this option is selected, the Status Help line in the lower left corner of the main window (Figure 8), will display a description of whichever icon the mouse pointer is positioned above. Figure 8: Show Status Help and Connection Status View or modify trap mappings Servers Status Help Connection Status Connection Status This option opens the Connection Status dialog box (Figure 9). You can also access this dialog box by clicking the Servers button in the bottom Event Configuration Editor User s Guide Page 19

20 ECEditor Main Window right corner of the ECEditor main window. This dialog box records the state of the VNM (if connection is up, VNM is active) and the date and time the VNM was terminated and reestablished. Figure 9: Connection Status Event Configuration Editor:Connection Status State Machine Service up sammy Landscape Connection Log for tulip Landscape Date/Time Message Apr 06 15:40:11 Connection reestablished Close Events Menu This menu currently offers a single option, Configure Messages, which opens the Configure Event Messages dialog box where you can create, modify, or delete event messages. Refer to the section, Configuring Event Messages on Page 54, for more information. Alarms Menu This menu currently offers a single option, Configure Messages, which opens the Configure Alarm Messages dialog box where you can create, modify, or delete alarm messages. Refer to the section, Configure Alarm Messages on Page 80, for more information. Event Configuration Editor User s Guide Page 20

21 ECEditor Main Window Traps Menu This menu currently offers a single option, Configure Mappings, which opens the Configure Trap Mappings dialog box where you can create, modify, or delete trap mappings. Refer to the section, Configure Trap Mappings on Page 32, for more information. Options Menu This menu currently offers two options; Preferences, which opens the Application Preferences dialog box shown in Figure 10, and Clear User Preferences. Preferences This menu selection opens the Application Preferences dialog box where you can change specific preference information for future use. Tabbed pages provide you with three selections. The first tabbed page, Connection, allows you to modify Connection information, the second tabbed page, Display, allows you to iconify the ECEditor at startup, and the third tabbed page, ECEditor, allows you to change the CsVendor directory location. Event Configuration Editor User s Guide Page 21

22 ECEditor Main Window Figure 10: Application Preferences Dialog Box - Connection Page Event Configuration Editor: Preferences Connection Display ECEditor Connection Confirmation Interval (milliseconds) Connection Confirmation Timeout (milliseconds) Connection Retry Timeout (milliseconds) Disable Queue Send Mail Queue Send Mail Response Timeout (milliseconds) Max Send Batch Size Make Changes Permanent Current User: root OK Cancel Apply Defaults What s This? Connection This tabbed page (Figure 10) lets you view and modify the server/client connection parameters listed in Table 1. The default values are shown in parentheses. Field Table 1: Connection Confirmation Interval (60000ms/60 seconds) Connection Confirmation Timeout (60000ms/60 seconds) Connection Preferences Description The number of milliseconds between requests to the server asking if it is still responding. The number of milliseconds to wait for an answer from the server confirming it is still responding. Event Configuration Editor User s Guide Page 22

23 ECEditor Main Window Table 1: Field Connection Preferences (Continued) Description Connection Retry Timeout (20000) Connection Time Limit (milliseconds) Disable Queue Send (selected) Mail Queue Size (512) Mail Response Timeout (600000) Max Send Batch Size (512) Route Message Timeout (1000) Show SpectroSERVER Selection Dialog At Startup SpectroGRAPH Machine (defaultmachine) SpectroGRAPH Machine Port (0xbeaf) Unsolicited Queue Size (512) Time for the client to wait for SpectroSERVER to establish the initial connection before returning an error. The timeout in milliseconds for connection to the VNM. Disables queue to send request to the SpectroSERVER. Maximum number of outstanding Mail Service requests that an application can make. Minimum time (in milliseconds) Mail Service waits for response from SpectroSERVER before a request is canceled. Maximum number of requests that are batched together. Time (in milliseconds) to wait for landscape update before canceling requests that cannot be routed. Initial SpectroSERVER selection dialog for connections. Hostname on which the target SPECTRUM UI is running. TCP port number on which the SPECTRUM UI is accepting connections. Maximum number of unsolicited registrations supported. Event Configuration Editor User s Guide Page 23

24 ECEditor Main Window Display This tabbed page (Figure 11) contains several buttons that are described in Table 2. Figure 11: Application Preferences Dialog Box - Display Page Event Configuration Editor: Preferences Connection Display ECEditor Enable Sort From Column Headers Filter/Search Delay (milliseconds) Iconify At Startup Save Column Widths Save Settings At Exit Save Shown Column Order Save Sorting Criteria Make Changes Permanent Current User: root OK Cancel Apply Defaults What s This? Table 2: Display Preferences Field Enable Sort From Column Headers Filter/Search Delay (milliseconds) Iconify At Startup Description Enable or disable sorting by clicking on column headers. The time delay after typing the last character in the table s local filter/search field to perform the specified filter or search. If selected, the main window is iconified at startup. Event Configuration Editor User s Guide Page 24

25 ECEditor Main Window Table 2: Field Display Preferences (Continued) Description Save Column Widths Saves any changes made to column widths when ECEditor is exited. Save Settings At Exit Saves any settings made to the View menu and Options menu when ECEditor is exited. Save Shown Column Order Save Sorting Criteria Table Column Header Font Table Data Font Visible Rows Saves any changes made to column order and visibility when ECEditor is exited. Saves any changes made to the sorting criteria when ECEditor is exited. Font to display the column headers in. Font to display the data in. Indicates the number of rows to display at startup. ECEditor The ECEditor page (Figure 12) allows you to change the location of the CsVendor directory. The default location for the CsVendor directory is SS/CsVendor. If you have installed SpectroGRAPH only, you must change the location to SG-Support/CsVendor. Event Configuration Editor User s Guide Page 25

26 ECEditor Main Window Figure 12: Application Preferences Dialog Box - ECEditor Page Event Configuration Editor: Preferences Connection Display ECEditor Vendor Directory SS/CsVendor 50 Make Changes Permanent Clear User Preferences This menu selection will immediately clear the user preferences for the application that is stored in the SERVER. It also removes the.prf file from the user s home directory. Help Menu The following selections are available from the Help menu. What s This? Click on this menu selection to access the What s This? help mode, indicated by a question mark added to the cursor. While in this mode, click on an area of the screen or a tool bar button to get brief help text on that item. About Event Configuration Editor Brings up a dialog box that identifies the ECEditor release number and displays a copyright warning message. Event Configuration Editor User s Guide Page 26

27 ECEditor Main Window Online Manuals You must have Acrobat Reader and the documentation CD loaded to open the documentation roadmap for all online manuals. Event Configuration Editor User s Guide Page 27

28 Defining Global and Default Event Processing SPECTRUM promotes event processing by supporting the dynamic reload of the EventDisp and AlertMap files without having to shutdown and restart SpectroSERVER. Frequency and Persistent Event Processing In order to define both global and default Event processing you simply need to place an EventDisp file in the directory that shares the same name for that model type. For example, all EventDisp entries at the SS/CsVendor/<vendor> level defines event processing directives that work for all models regardless of vendor or model type. So, if an EventDisp file exists at the SS/CsVendor/<vendor>/<mtype> level then the entries in that file are for models of that type only. Note: All EventDisp entries for any given event code should be the same across all EventDisp files in the <vendor> directory. The event does not need to be listed, but if it is then it needs to match the other values that exist at the <vendor> level. Failure to do so will result in a conflict and only one EventDisp will be used arbitrarily as a default. Frequency Event Directives These are rules you create to detect if an event is being received on a single model type for an excessive number of times. The occurrence limit, occurrence time period and resulting frequency event can be set. Event Configuration Editor User s Guide Page 28

29 Defining Global and Default Event Processing Persistent Event Directives These are rules you create to detect if a model has received an event that is expected as part of a pair of events. SPECTRUM looks for this second event. If the first event occurs but the second event does not occur within the expected time period, a third (persistent) event is generated. Frequency and Persistent Event Syntax To create Frequency and Persistent Event directives you must manually edit the appropriate EventDisp file. You can also create a new entry for an Event code that was not previously listed in the file. Frequency Event Syntax The event syntax for a Frequency Event is as follows: ÔFÕ <occurrence limit> <duration> <frequency event> ÔFÕ is the flag that identifies a frequency processing directive. <occurrence limit> is the threshold for occurrences of the original event. <duration> is the number of seconds to count occurrences in. <frequency event> is the event that will be generated if the threshold is exceeded. This syntax must be appended to a line in the EventDisp file that begins with an Event code, though it is not needed to immediately follow the Event code. The following three examples illustrate this syntax: Example 1: 0x1234 F xabcd If the event 0x1234 occurs 3 times in 60 seconds, then generate event 0xabcd. Event Configuration Editor User s Guide Page 29

30 Defining Global and Default Event Processing Example 2: 0x5555 F x6666 If the event 0x5555 occurs 5 times in 10 seconds, then generate event 0x666. Example 3: 0x2222 E 50 F x3333 In this example, the value, E 50 tells the VNM that event 0x2222 should be logged and that it has an event severity of 50. Order of Directives There is no order between event processing directives. Thus in Example 3, the E 50 and the F x3333 could be swapped to read: 0x2222 F3 20 0x3333 E 50 Persistent Event Syntax The event syntax for a Persistent Event is as follows: ÔDÕ <2nd event> <duration> <duration event> ÔD is the flag that identifies a duration processing directive. <2nd event> is the event code of the corresponding event. <duration> is the number of seconds to count <duration event> is the event that will be generated if the 2nd event is not received in the duration period. Example 1: 0x888 D 0x xffff In this example, if the event 0x8888 is received and event 0x9999 is NOT received in the next 60 seconds, then generate event 0xffff. Event Configuration Editor User s Guide Page 30

31 Defining Global and Default Event Processing Note: Both the Frequency and Persistent Event Directives are on a per model basis. This means that the event counts and instances are done per model. For a Frequency Event, the same model would need to receive the event X times. For a Persistent Event, the same model would be looking to receive event A and event B in the time period. If not, then event C is generated. Event Configuration Editor User s Guide Page 31

32 Configure Trap Mappings This section details how to use the ECEditor with SpectroSERVER and SpectroGRAPH to configure trap mappings. The Trap Mappings Process The Configuring Trap Mappings menu item from the main window provides you with a dialog box where you can create new trap mappings, or copy, modify, or delete existing trap mappings. The following describes the trap mapping process in SPECTRUM: A trap is an extraordinary occurrence that is either broadcast or directed to network management stations (SPECTRUM) notifying them of device or network problems. The content of a trap message is specific to the management protocol that is sending the trap. SNMP traps contain a combination of generic trap information and enterprise-specific trap information. When an SNMP-managed object sends a trap to SPECTRUM, it can also send the values for certain variables, called trap variables. A trap variable consists of four parts: an object ID (OID), a type, a length, and a value. SPECTRUM translates the values of trap variables into event variables and makes them part of the event in the Event Log and in the Event Message. Trap variable mappings appear in AlertMap files as Trap to Event OID Maps (referred to in SPECTRUM as OID-Maps.) In addition to defining the object ID of trap variables, the OID Maps also specify where to place trap variable values in an Event Message. There should be one AlertMap file for each managed object that is capable of sending a trap. Event Configuration Editor User s Guide Page 32

33 Configure Trap Mappings When SPECTRUM receives a trap from an SNMP-managed object, it searches for the AlertMap file for that object. If a map does not exist for the trap, an UNKNOWN TRAP event is generated, and an Event Message is sent to the user. If an AlertMap is found, the event to which it is mapped is examined. If the event code is zero, this trap is ignored. If the event code is non-zero, SPECTRUM builds an Event Message for the event code and begins mapping trap variable values to event variables. SPECTRUM translates the variable as follows: 1 Scans the AlertMap to find an OID Map whose OID either exactly matches the trap variable s OID or is a prefix of the trap variable s OID. Chooses the OID with the longest prefix (best match) if more than one OID Map has an OID that is a prefix of the trap variable s OID. 2 If an OID Map is found, examines its Variable Data Index to decide whether to translate the trap variable s value into an event variable. If not found, ignores alert variable. 3 If Variable Data Index is zero, ignores trap variable s value. Otherwise, an event variable is constructed and inserted into the Event Message. The type, length, and value of the event variable is obtained from trap variable and its ID is as specified by Variable Data Index. 4 Examines OID Maps to decide whether to translate trap variable s instance ID into an event variable. a b c If Instance Variable ID in the parameter is zero, trap variable s value is ignored. If OID in OID Map exactly matches trap variable s OID, there is no instance ID to translate. If there is an instance ID and Instance Variable ID is non-zero, another event variable is constructed and inserted into Event Message. Event Configuration Editor User s Guide Page 33

34 Configure Trap Mappings The Configure Trap Mappings Dialog Box The Configure Trap Mappings Dialog Box The Configure Trap Mappings dialog box shown in Figure 13 identifies all the areas that are used to create, modify, and delete trap mappings. An explanation of what each area does and how to use this menu item follows. Figure 13: Example of the Configure Trap Mappings Dialog Box ECEditor: Configure Trap Mappings Developer Model Type Trap ID Event Code 3ComTokenRing Hub3ComSSTR 0.0 0x ComTokenRing Hub3ComSSTR 1.0 0x ComTokenRing Hub3ComSSTR 2.0 0x ComTokenRing Hub3ComSSTR 3.0 0x Ctron_CAT Ctron_CAT Ctron_CAT Ctron_CAT Ctron_CAT Ctron_CAT Ctron_CAT SwCat1200 SwCat1200 SwCat1200 SwCat1200 SwCat1200 SwCat1200 SwCat x x011c0000 0x011c0000 0x011c0001 0x011c0001 0x011c0002 0x011c0003 Search All Prev Next Edit New Copy Delete Trap Variable OID Variable ID Instance ID Edit New Copy Delete Close What s This? Event Configuration Editor User s Guide Page 34

35 Configure Trap Mappings Trap Mappings Table The Trap Mappings Table shows all the fields that are included when mapping a trap. Figure 14 shows an example of the Trap Mapping Table. Sort the Developer, Model Type, and Trap ID columns manually low to high or high to low by clicking on the column header. Figure 14: Example of a Trap Mappings Table ECEditor: Configure Trap Mappings Developer Model Type Trap ID Event Code 3ComTokenRing Hub3ComSSTR 0.0 0x ComTokenRing Hub3ComSSTR 1.0 0x ComTokenRing Hub3ComSSTR 2.0 0x ComTokenRing Hub3ComSSTR 3.0 0x Ctron_CAT Ctron_CAT Ctron_CAT Ctron_CAT Ctron_CAT Ctron_CAT Ctron_CAT SwCat1200 SwCat1200 SwCat1200 SwCat1200 SwCat1200 SwCat1200 SwCat x x011c0000 0x011c0000 0x011c0001 0x011c0001 0x011c0002 0x011c0003 Search All Prev Next Edit New Copy Delete Trap Variable OID Variable ID Instance ID Developer The developer identification for the developer who created the model type. Model Type The name of the model type for which the AlertMap file applies. Trap ID A string that uniquely identifies the kind of trap within the model type to which it applies. Event Configuration Editor User s Guide Page 35

36 Configure Trap Mappings Event Code A hex number that uniquely identifies the instance of the event in SPECTRUM. It has a 0x prefix and an 8-digit hex number. Imbedded in the Event Code is the Developer ID. Filter/Search The Filter/Search button (Figure 15) allows you to look for a particular trap mapping. You can enter either a string of numbers to locate a Trap ID, Event ID, or Trap OID Variable, or enter text to locate a Developer or a Model Type. If you select Filter, only the trap containing the string of numbers or text that you entered in the text area to the right of the button will be displayed. If you select Search, the first trap containing the string of numbers or text that you entered in the text area to the right of the button will be displayed. Then, using Next or Prev (Previous), you can view the next match or go back to a previous match. Next and Prev are used only with Search. Figure 15: Filter/Search Area Search Choice box Search Shown Prev Next Filter Developer Event Code Model Type Trap ID All text area Event Configuration Editor User s Guide Page 36

37 Configure Trap Mappings Filter/Search Click Filter and enter a string of numbers or text in the text area to select only traps containing the string of numbers or text that you entered in the text area. The trap you are filtering on will appear in the Trap Identification Area. Click Search and enter a string of numbers or text in the text area to find the first traps containing the string of numbers or text that you entered in the text area. The trap you are searching for will appear in the Trap Identification Area. Shown Select one of the available choices from the Search Choice box to determine the string or text to filter on or search from the list of trap mappings. Possible choices are as follows: Developer Event Code Model Type Trap ID Shown All Allows you to search or filter on the Developer. Allows you to search or filter on the Event Code. Allows you to search or filter on the Model Type. Allows you to search or filter on the Trap ID. Allows you to search or filter on the columns that are shown (Developer, Model Type, Trap ID, Event Code). Allows you to search or filter on all columns. Event Configuration Editor User s Guide Page 37

38 Configure Trap Mappings Tip: If you have selected All from the Search Choice box and find that the search is taking too long, you might want to try narrowing your search by highlighting just one of the column selections (Developer, Model Type, Trap ID, or Event Code) and then entering the search text in the text area. Trap Mapping Actions The Trap Mapping Actions, located under the Filter/Search Area, is where you can modify an existing trap mapping, create a new trap mapping, copy a trap mapping, or delete a trap mapping. You can also access the Configure Event Messages dialog box from here. Figure 16 displays the Trap Mapping Actions. Figure 16: Trap Mapping Actions Edit New Copy Delete Edit Highlight the trap mapping from the Configure Trap Mappings dialog box, Figure 13 (Page 34), that you want to modify and click Edit to make changes to the selected trap mapping. The Edit Trap Mapping dialog box Event Configuration Editor User s Guide Page 38

39 Configure Trap Mappings opens. Using the instructions in the Task, Creating a New Trap Mapping, you can modify the data for the highlighted trap mapping. New Click New to create a new trap mapping. The New Trap Mapping dialog box, Figure 13 (Page 34), opens. For detailed information about each field, see the instructions under the Task, Creating a New Trap Mapping on Page 40. Copy Highlight the trap mapping from the Configure Trap Mappings dialog box, Figure 13 (Page 34), that you want to copy and click Copy to create an exact duplicate of the trap mapping. The Copy Trap Mapping dialog box opens. For detailed information about each field, see the instructions under the Task, Creating a New Trap Mapping on Page 40. Delete Highlight the trap mapping from the Configure Trap Mappings dialog box, Figure 13 (Page 34), that you want to delete and click Delete to remove the selected trap mapping from the list and the database. For more detailed information, see the instructions under the Task, Deleting a Trap Mapping on Page 45. Click the Event icon to open the Configure Event Messages dialog box where you can create, modify, copy, or delete Event Messages as described in the section, Configuring Event Messages on Page 54. The Event Configuration Editor User s Guide Page 39

40 Configure Trap Mappings Event Code that corresponds to the currently selected trap mapping from the Configure Trap Mappings dialog box will be selected. Close Click Close to exit the Configure Trap Mappings dialog box and return to the ECEditor main menu. What s This? Click What s This? to access the online help messages. Place the question mark that appears over the text or item that you want to see help for. A pop-up window will describe the item that you click on. Task Creating a New Trap Mapping If a trap ID for a particular developer and model type does not exist, you will want to create one. Before you create a new trap mapping, search through the Trap IDs to find if one already exists for the type of trap mapping you are looking for. If one does exist, see Copy under Trap Mapping Actions. If one does not exist, follow the steps below to create a new trap mapping: 1. Click New in the Trap Action Area in the Configure Trap Mappings dialog box. The New Trap Mapping dialog box opens. See Figure 17 below. Event Configuration Editor User s Guide Page 40

41 Configure Trap Mappings Figure 17: New Trap Mapping Dialog Box ECEditor: New Trap Mapping Developer: Model Type: Trap ID: Maps to Event Code: Browse Browse Browse Disable Mapping OK Cancel What s This? 2. Select a developer by clicking the Browse button to open the Select a Developer dialog box (Figure 18). Click OK to return to the New Trap Mapping dialog box. Choose a developer for the model type you select. Use the Filter/Search button to look for a particular developer. For more complete instructions on using the Filter/Search button, see Filter/Search on Page 36. The trap mapping will be placed in the AlertMap file for the model type for the selected developer. The developer you select will then appear in the New Trap Mapping dialog box when you click OK in the Select a Developer dialog box. Event Configuration Editor User s Guide Page 41

42 Configure Trap Mappings Figure 18: Example of the Select a Developer Dialog Box ECEditor: Select a Developer Cabletron Calypso_Softw1 Calypso_Softw2 Calypso_Softwa Cascade_Comm Cayman_Rtr Chem_Abstracts CinBelInfoSys2 CinBelInfoSys3 Corning Cross_Comm Filter Next OK Cancel What s This? Text Box 3. Select a model type by clicking the Browse button to open the Select a Model Type dialog box (Figure 19). Choose a model type for the developer you selected. Use the Filter/Search button to look for a particular model type. For more complete instructions on using the Filter/Search button, see Filter/Search on Page 36. The model type you select will be placed in the AlertMap file for the model type for the selected developer. The model type you select will then appear in the New Trap Mapping dialog box when you click OK. Event Configuration Editor User s Guide Page 42

43 Configure Trap Mappings Figure 19: Example of the Select a Model Type Dialog Box ECEditor: Select a Model Type Bdg_CSI_SNB20 Bdg_CSI_SNB20 Bdg_CSI_SNB25 IcmpPif NA_Nov_LANMIM NA_Nov_LANtern PC_CSI_DNICard PC_CSI_TRDNI Pingable SS_API_PIF SnmpPif data_relay_prt Filter Next OK Cancel What s This? Text box 4. Enter the Trap ID from the MIB object ID for the trap. This must be a dot-separated OID string. Example: Select an Event Code to map the trap to by clicking the Browse button to open the Select an Event dialog box (Figure 20). Although the Select an Event dialog box looks identical to the Configure Event Messages dialog box you can only select an event and then return to the New Trap Mapping dialog box. Choose Configure Event Messages from the ECEditor main window if you want to modify an event message. Event Configuration Editor User s Guide Page 43

44 Configure Trap Mappings Figure 20: Select an Event Dialog Box ECEditor: Select an Event Event Code: 0x00e x00e x00e x00e x00e x00e x00e50008 Search Event Mapping Shown Event is mapped Event is logged Event Message: Gauge Threshold has been exceeded. The port is {l 1}.{l 3}, with an error of {l 5}, where 3=HiCollisionRate 5=HiCRCErrRate 6=HiAlignmentErrRate 7=HiTrafficRate 8=HiJabberErrRate 9=HiCarrierSenseErrRate. (event Event Message Formats/Table Configuration Event Priority: Event generates Alarm Alarm Condition: Critical Alarm Probable Cause ID: 0x00e50005 Browse Alarm Probable Cause Description: A GAUGE THRESHOLD HAS BEEN EXCEEDED SYMPTOMS: A rate trap has been received from the device. PROBABLE CAUSES: Prev Next New Copy Delete Save Undo Alarm Trap Advanced Select Close What s This? 6. Click Disable Mapping to prevent the creation of an event that would be associated with this trap. By turning Disable Mapping on (the button is recessed), the user can selectively log events. 7. Click OK to save the changes and exit the New Trap Mapping dialog box. Event Configuration Editor User s Guide Page 44

45 Configure Trap Mappings OK Click OK to permanently update any changes you have made and return to the Configure Trap Mapping dialog box. Cancel Click Cancel to close the New Trap Mapping dialog box without saving any changes and return to the Configure Trap Mapping dialog box. What s This? Click What s This? to access the online help messages. Place the question mark that appears over the text or item that you want to see help for. A pop-up window will describe the item that you click on. Task Deleting a Trap Mapping To delete a trap mapping, follow these steps: 1. Highlight the Trap ID from the Configure Trap Mappings dialog box, Figure 13 (Page 34), you want to delete and click Delete. The Confirm Delete dialog box in Figure 21 will open. Event Configuration Editor User s Guide Page 45

46 Configure Trap Mappings Figure 21: Confirm Delete Dialog Box ECEditor: Confirm Delete DELETIONS CANNOT BE UNDONE. All trap data belonging to the selected trap(s) will be deleted from the list and from the associated alert map file. OK Cancel 2. Click OK in the Confirm Delete dialog box to delete the selected entry. To cancel without deleting an entry and return to the Configure Trap Mappings dialog box, click Cancel. Trap Data Table The Trap Data Table includes all the fields that are used to create new trap entries or add more trap entries to a trap mapping. The Trap ID and related information that you selected from the Configure Trap Mappings table is displayed in the Trap Mapping Table section, but this section is grayed out. You can only modify Trap Map entries here. To create, edit, or copy Trap Mappings, use the Trap Mappings Table. Event Configuration Editor User s Guide Page 46

47 Configure Trap Mappings Figure 22: Example of the Trap Data Table Developer: Model Type: Trap ID: Maps to Event Code: ECEditor: New Trap Map Entry 3ComTokenRing Hub3ComSSTR 0.0 0x Browse Browse Browse Disable Mapping Trap Data Configuration Trap Variable OID: Variable ID: Instance ID: OK Cancel What s This? Trap Variable OID The object ID of a trap variable that can be sent with this trap message. The format is a sequence of decimal numbers separated by dots. Example: Variable ID The event variable ID that is used to store the value of this trap variable. If variable ID is 0, then this trap variable s value is not put into the event message as an event variable. Event Configuration Editor User s Guide Page 47

48 Configure Trap Mappings Instance ID The event variable ID that is used to store the unmatched portion of the trap variable s OID. If variable ID is 0, then the unmatched OID is not put into event message as an event variable. Trap Map Entry Actions The Trap Map Entry Actions are available for adding, editing, copying, or deleting trap map entries from the trap mappings. Edit New Delete Copy Edit Highlight the trap entry from the Configure Trap Mappings dialog box, Figure 13 (Page 34), that you want to modify and click Edit to make changes to the selected trap entry. The Edit Trap Map Entry dialog box opens. Using the instructions in the Task, Creating a New Trap Map Entry, you can modify the data for the highlighted trap mapping. New Click New to create a new trap map entry. The New Trap Map Entry dialog box, Figure 23 (Page 51), opens. For detailed information about each field, see the instructions under the Task, Creating a New Trap Map Entry on Page 52. Event Configuration Editor User s Guide Page 48