AnsweredAssumed Answered

This is about CA SPECTRUM CORRELATION

Question asked by BRUN on Mar 6, 2019

Hello Community

This is about CA SPECTRUM CORRELATION.

 

I tried to implement some correlation rules on losses routers (neighbors OSPF)… with results that are not … “good”.

Here is my working plan.

 

 

  • Here the first Event from DEVICE A (loss 10.250.136.210)

  • Second Event from DEVICE B (loss 10.250.136.210)

 

  • The result

  • Event from DEVICE C ... no worry.

Now My Problem, discriminator problem ...

bellow, 3 new SNMP Notifications for an another router loss (10.250.136.177)

    • DEVICE B

 

    • DEVICE A (10.250.136.177)

    • I got only one alarm on the OSPF_NEIGHBOR_STATE_CHANGE_DOMAIN with the first IP Address loss 10.250.136.210

    No Alarm for the loss of 10.250.136.177

Only one alarm

0xfff00120 and Var Bind 2 (ospfNbrIpAddr) as Discriminator.

 

 

 

The discrimination did not work and I don’t understand why?

Can someone explain to me what I did wrong please?

 

Bellow how I built the Correlation:

  • Symptom Condition X

  • Symptom Condition Y

  • The root cause è 0xfff00120

  • The Rule

Furthermore, I add … despite having checked the box “Clear Symptom conditions if Implied condition is cleared” this is not what is happening.

When the major alarm is cleared on the Domain Correlation, all minor alarms reappear.

I admit I don’t understand how it works...

 

 

In advance, Thank you for yours returns.

Regards 

 

##

Outcomes