DX NetOps

Expand all | Collapse all

NFA alerts to Spectrum Alarms

  • 1.  NFA alerts to Spectrum Alarms

    Posted Oct 10, 2014 03:32 PM

    Hello to All,

     

    I have a CA NFA with alerts defined but want send to Spectrum and display them as alarms, I have defined the destination in the watchdog in NFA. I need to do in Spectrum to interpret the traps from NFA?.

     

    Thanks to all!



  • 2.  Re: NFA alerts to Spectrum Alarms

    Broadcom Employee
    Posted Oct 10, 2014 03:36 PM

    The "Watchdog Settings" trap destination in NFA is only going to send Watchdog Trap events to Spectrum, it will not send the Alerts configured under the Admin->Alerts page of NFA, such as Threshold Violations.

     

    To set the Trap destination for this go to Admin->Application settings and set the Trap Destination IP here as well.

     

    You will likely need to import the Reporter.mib file into Spectrum if it has not been done already in order to interpret the traps.

    You can find this file on your NFA console in the \CA\NFA\REPORTER\mib directory.



  • 3.  Re: NFA alerts to Spectrum Alarms

    Posted Oct 10, 2014 03:41 PM

    Christopher, thank you for response.

     

    traps will be sent to Spectrum for alerts thresholds defined in NFA?

     

    Regards,

     

    Manuel



  • 4.  Re: NFA alerts to Spectrum Alarms
    Best Answer

    Broadcom Employee
    Posted Oct 10, 2014 03:49 PM

    NFA Interface Threshold based Alerts are setup here:

     

    The trap destination IP is set here:

     

    Pages 102-108 covers Traps start to finish for NFA

    https://support.ca.com/cadocs/0/CA%20Network%20Flow%20Analysis%209%202%200-ENU/Bookshelf_Files/PDF/NFA_Administrator_Gui…



  • 5.  Re: NFA alerts to Spectrum Alarms

    Posted Oct 10, 2014 03:53 PM

    Thank you!



  • 6.  Re: NFA alerts to Spectrum Alarms

    Posted Oct 10, 2014 05:08 PM

    manueltdicl, please mark Christopher_Walsh, answer as correct.



  • 7.  Re: NFA alerts to Spectrum Alarms

    Posted Oct 10, 2014 09:13 PM

    If I import the reporter.mib file into Spectrum, what information will Spectrum now give me regarding that trap from NFA?



  • 8.  Re: NFA alerts to Spectrum Alarms

    Posted Oct 10, 2014 11:35 PM

    It would be able to decide the bindings in the mib. I'm not a spectrum guy so I can't tell you how to make it work in spectrum. If you open the mib in notepad you can see the description for each oid. 



  • 9.  Re: NFA alerts to Spectrum Alarms

    Posted Oct 13, 2014 03:21 AM

    Once imported in Spectrum you can use the Spectrum MIB Tools (where you also import the mib) to define alarms based on the traps which are defined in the mib.



  • 10.  Re: NFA alerts to Spectrum Alarms

    Posted Oct 15, 2014 01:52 PM

    Then, you can define thresholds NFA, for example, use 15% of total traffic and display it in Spectrum? I've compiled the MIB in Spectrum, which is the next step ?.



  • 11.  Re: NFA alerts to Spectrum Alarms

    Posted Oct 15, 2014 01:59 PM

    If it goes over the threshold, NFA should send a trap to Spectrum where it can be turned into an alarm. This is done based on the configuration you do in the MIB Tool.

     

    So with traps you will see in Spectrum if something has gone over the threshold, you will not see the current value (just the value at the time the trap was sent). If you want to see a current value, that's a completely different type of integration.



  • 12.  Re: NFA alerts to Spectrum Alarms

    Posted Oct 15, 2014 02:03 PM

    That is, if I set up a trap in NFA for all interfaces shall not exceed 15% of the traffic, I just know that one of the interfaces or source - destination exceeded the threshold, for example if to interface interface specifies I should identify the trap and set it to send the MIB tools to make it look the way I want the trap ?.



  • 13.  Re: NFA alerts to Spectrum Alarms

    Posted Oct 15, 2014 02:12 PM

    That depends on the information NFA will send with the trap. I expect NFA will include information about which interface has violated the threshold. What is sent in the trap should be defined in the mib file and can also be seen in the MIB Tool when you look at the MIB definition there. You can use event format files in Spectrum to display this information with the event that causes the alarm. If you want more information about how the trap to alarm process in Spectrum work, you can read my document on Spectrum trap mapping. This describes the configuration files Spectrum uses from trap to event to alarm and some of the options there are. You can create/edit these files manually or by using the GUI event configuration tools in Spectrum OneClick.