DX NetOps

Good day,

We had a failure on power supply and fan on a Cisco devices, this was not triggered as an alarm on Spectrum, the only way we picked up this was through Spectrum Information tab in Cisco environment monitor information. I need help in generating this information as an alarm. Please help.

See attached syslog message and Cisco environment monitor information screenshots for fan failure.

Regards

Morongwa

Hi,

You will need to enable SNMP traps on cisco devices. here is the link to configure traps:

http://www.cisco.com/c/en/us/td/docs/ios/netmgmt/command/reference/nm_book/nm_18.html

Once enabled spectrum will receive these traps as event and you have to convert these events into Alarms.

Please check following CA Spectrum guides for configuration on spectrum side:

1- Event Configuration User Guide

2- Cisco Device Management Guide

Hope this help.

Regards,

Waqar

Thanks Waqar for your response, it does confirm what I had in mind all along.

But is traps the only way of getting alarms, someone menthened SpectroWatches, would this work for fan and power supply as well or only for CPU memory utilization?

The reason I am asking is that my client does not want to go with enabling snmp traps, he is thinking Spectrum should cater for this as out of the box functionality.

Regards

Morongwa

Traps are the usual and easiest way to go, but it is possible to use a watch as long as you can find a value you can monitor using snmp. Usually there would be an OID that will show the status of a fan or power supply. Let's say that it has a value of 0 when everything is fine and values 1, 2 and 3 are defined to indicate various problems. You could then use a watch to look for a value >0 on the attribute and generate an alarm or multiple watches (or use event rules) to generate alarms with specific descriptions for each of the problems.

Thanks Michiel,

I am fairly new to Spectrum Watches, can I ask that I get a direction or document as to how, I would prefer watches that event configuration.

Regards

Morongwa

you can check CA Spectrum watches guide.

There is a guide for watches. This is the link for the 9.3 online version, or you can take the one from your own installation: https://support.ca.com/cadocs/0/CA%20Spectrum%209%203%200-ENU/Bookshelf_Files/PDF/Spectrum_Watches_User_ENU.pdf

Thanks for the link.

Can this be done on a global level or is it on a device level?

You link the watch to a model type and it can be made inheritable. You can also decide if it should be active by default or if you want to activate it manually for specific models/devices.

Thanks Michiel,

I found that.

Now I am trying to figure out the expression to use for fan and power supply.

Have you already found which attribute you need?

If you just want to monitor the value of an attribute, the expression will just be the attribute. The result of the expression, in this case the value of the attribute, is what you set the watch threshold on.

Good day,

I was referring to the the model inheritance when I said I"Ifound it"

This is more complex than I thought, I think of opening a case with CA to get assistance on this as I don't fully understand how to implement this. I would appreciate any kind of help.

Regards

Morongwa

Once you know how it works, it doesn't have to be very difficult. But snmp traps would be much easier to implement and is still the standard in my opinion.

In short, this is what you have to do to set up a watch:

• Find the attribute you want to watch, for example chassisFanStatus from the ciscoStackMIB, and note the attribute type (Integer in this case). Make sure the attribute is mapped to an attribute ID in Spectrum (this can be done with MIB tools)
• Select a device of the model type for which you want to create the watch
• Open the Watches view under Thresholds and Watches on the Information tab
• Click the create watch button:
• Enter a name for the watch (for example "Cisco Fan Status") and select the correct data type
• Click the Attributes button and find the attribute you want to watch. If you can't find the attribute, make sure you selected the right model and that the attribute was mapped to a Spectrum attribute ID
• Once you click ok, your create watch screen should look something like this:
  
• On the properties tab, set the appropriate settings. For example Active By Default and Evaluate By Polling with a 300 second poll interval
• On the Threshold tab, select Attach a Threshold
• If you just want to look for a "not OK" value, you can set Threshold violated if value != 2 (the MIB defines values 2=ok, 3=minorFault, 4=majorFault, 1=other).
• In the Notification section, you can enable Generate Alarm. You can leave the default description, select an existing one from another alarm or create your own.
• You could remove the User clearable option in this case, since alarm will automatically reset once the fan status goes back to OK.
• Your threshold configuration would look something like this then:
  
  
  

Hope that helps.

Thank you so much for this, let me try it on my lab and see how it works

I've also converted this into a document for the wiki here: Configuring a simple Watch in Spectrum

Let me know if you find anything that needs clarification and should be updated. The document is open for changes, so feel free to add or update anything you think would be useful.

I want to do this watch as well but I am not sure how to do it for all my Cisco routers globally. Also what other examples of watches on routers can I do if I am not doing traps

Opnet,

Watches are configured based on model types. These watches can also be inherited to their derived model types. Watches are primarily used on the oid's or attributes which provide the value from the MIb through polling.

We can also configure nested watches so that one watch can be used as a source in othe watch. Are you looking to configure any specific watch?

Regards

Kalyan

I like the idea of the Cisco environment watches but I am disappointed that something like that is not enabled out of the box.  But nonetheless I like the capability of watches but honestly I am not sure where I should start. Are there any example of Cisco watches other than a fan? I have a very large Cisco environment and it would be really nice for Spectrum to start leaving up to its promises.

Can I do BGP watches to send out an alert whenever one of our routers has a neighbor change? Is there somewhere that I can find all the Cisco watches I can do?

Using a watch to dynamically monitor for a change compared to a previous value would be tricky. Typically that would be something the router sends a trap about which you would handle with Spectrum. Watches are more something to trigger on a threshold. Doesn't mean that it can't be done, but it would get complicated quickly.

Is there anything specific you are looking for?

With a watch you can monitor any OID value or calculation on one or more values. So if it can be polled through SNMP, you can use it in a watch. You just have to create an attribute for it, which can be done fairly easy using the MIB Tool in Spectrum.

Hi Michiel,

Sorry to respond late. I tried creating the watch for ciscoEnvMonFanState, when I checked, it is not mapped to the attribute ID. What do I do in this case.

Regards

Morongwa

Hi Morongwa,

Open the MIB Tools (Tools -> Utilities menu) and find the MIB that includes the attribute you want to watch. In case of ciscoEnvMonFanState, this would be the CISCO-ENVMON-MIB. Select the MIB in the Navigation pane and then open the Map tab in the Contents pane. Select the attribute(s) you want to monitor and then click the create attributes button (the green leaf with the + on it) to create attribute ID's and you can then use the attribute in a watch.

Regards,

Michiel

Thanks Michiel,

I now managed to create one.

It needed me to use an instance list or range because I had multiple fans, so I used ciscoEnvMonFanState.# as attribute. It is now working and I will be creating power supply watch as well.

Just to make sure I have everything covered, is there a list of events/watches that do not have out-of-the-box alarms that I can check against to make sure watches are created for them so that we don't miss an important event that should be generated as an alarm.

Regards

Morongwa

I don't think there is a list of things which do not have alarms configured. The best you could do is look at the Event Format and Probable Cause files to see which events/alarms do exist. But those will probably almost all be based on trap, so if you are not using traps it basically means you will have to create everything yourself as watches. In that case the MIB files provide the list of everything you could monitor and you can decide what you want to create watches for based on the available attributes.

PS: if this thread now has everything you need to answer you initial question, please mark it as such so it can also be recognized as an answered question by other users. This can be done by marking one post as correct and post with additional information as helpful.

Thanks guys for all your help, I really leant a lot from this. Much appreciated!

Regards

Morongwa

> Find the attribute you want to watch, for example chassisFanStatus from the ciscoStackMIB, and note the attribute type (Integer in this case). Make sure the attribute is mapped to an attribute ID in Spectrum (this can be done with MIB tools)

Could enyone guide me how to remove attribute ID to OID mapping?

The problem I have is double ID for the same OID prefix (Cisco ACE cslbxStatsCurrConnections):

When I try to create a new watch it says "duplicate attribute names":

I used a method described above to create watch for Cisco ASA active sessions monitoring, but stucked when tried to configure the same for Cisco ACE - somehow in my environment there was an attribute ID already mapped to parameter name cslbxStatsCurrConnections OID 1.3.6.1.4.1.9.9.254.1.1.1.1.3

MIB Tools map for ASA cfwConnectionStatValue:

MIB Tools map for ACE cslbxStatsCurrConnections:

Regards,

Daniel

Hi Michiel,

I have done my watches for fan and poswer supply using Rtr_Cisco as a parent model type (I have 2 types, Rtr_Cisco and SwCiscoIOS), but when I check other devices with model type of SwCiscoIOS, they didn't inherit the watch. I had a look at all the parent model types trying to find the generic one that I can apply, see screen shot attached, I am not sure which one to use so the both  Rtr_Cisco and SwCiscoIOS inherit the watch. Can you advice please.

Thanks in advance

Morongwa

I tested with Cisco_Gen and it got inherited on all model types.

Thanks

Morongwa

That would have been my second guess

My first guess would be the CiscoIOSDerPt (Cisco IOS Derivation Point) as a common parent model type, but I don't know the exact structure and currently don't have access to a system where I can check it.

Any know how to set up a watch for system uptime to alarm when it exceeds 200 days?