DX NetOps

I'm curious the timeframe over which these alarms are evaluated. These alarms indicate that a particular client is using over X bytes of upload or download capacity. However, without knowing the timeframe, it's sort of useless. Is it over 1 minute? Or 1 hour? Or 1 day? If I have a client doing 2000MB of data (which is more than the default threshold for these alarms), does that mean 2000MB in one day or 2000MB in one minute? The timeframe has a huge impact on the implication of the alarm. Is the timeframe mentioned somewhere and I'm just not seeing it?

I don't find you can define any time frame for this threshold monitoring. However, if you want to set time frame and do the threshold monitoring you can utilize SpectroWATCH. The following two OIDs are used to calculate Download/Upload volume of Mobile Stations within WLC.

1. bsnMobileStationBytesReceived OBJECT-TYPE
        SYNTAX Counter64 (0 .. 9223372036854775807)
        ACCESS read-only
        STATUS current

        DESCRIPTION
         "Bytes received from Mobile Station"
        ::= { bsnMobileStationStatsEntry 2 }

-- 1.3.6.1.4.1.14179.2.1.6.1.2

2. bsnMobileStationBytesSent OBJECT-TYPE
        SYNTAX Counter64 (0 .. 9223372036854775807)
        ACCESS read-only
        STATUS current

        DESCRIPTION
        "Bytes sent to Mobile Station"
        ::= { bsnMobileStationStatsEntry 3 }

-- 1.3.6.1.4.1.14179.2.1.6.1.3

Please also refer to https://www.ca.com/us/services-support/ca-support/ca-support-online/knowledge-base-articles.TEC1336663.html

I know timeframes can be defined when using CA eHealth (or probably CA Performance Manager now) but Spectrum uses traps or polling to generate alarms so I think your best bet is to use SpectroWATCH as suggested by Widjaja.

Let me get this straight:

We can't figure out CA's out of the box solution. Our options are to disable CA's out of the box functionality and either 1) use a different tool (UIM, eHealth, NV, SolarWinds, WUG, etc.) or 2) configure a watch to do the same thing that the OOTB solution should be doing.

If that's all we can do, CA has an opportunity to fill a gap here.  kiran_diwakar

Folks, 

bsnMobileStationBytesReceived

bsnMobileStationBytesSent

These attribute OIDs are not defined based on time frame. Since attributes are of counter type-Counter64 (i.e. increases till it reaches max allowed data type range), we believed that, the values are calculated from the time when client latched to that WLC.

But we need to confirm this from Cisco side, as there was no much description given anywhere. We will confirm and get back to this group. 

Thanks,

Nagesh 

Please do. This is turning into yet another alarm that is enabled out of the box that has no real clear indication of problem or cause. Reading this, i could eventually get an alarm for every wifi client that stays on for a long period of time. Every time Spectrum vomits another inactionable alarm, CA loses face here.

 Nagesh_Jaiswal  Is there any update?

Haha, they're "Broadcom" now. Don't expect much of anything from CA for a while. They're dealing with the fallout from the merger.