Just wanted to say thanks to several folks on the list who sent suggestions and
to share with others. In this case variable 7 is the IP address of the neighbor
which went down and will be used as a discriminant.
# BGP BOUNCED - Minor - then look for more than 3 occurrences within 5 minutes
and bump up to a Major if seen
0xfff0002a E 50 A 1,0xfff0002a R {7} CA.EventRateWindow, 3, 300, "0xfff0002d
-:-", "0xfff0002e -:-"
# BGP FLAPPING - Major
0xfff0002d E 50 A 2,0xfff0002d
# BGP FLAPPING has STOPPED - Normal
0xfff0002e E 50 A 0,0xfff0002e
2e gets triggered after 5 minutes where the 3 in 5 minutes rate is not
exceeded. It could be used to clear the alarm if desired. For the time being, I
wanted to leave it visible.
Thanks to Peter Robinson and John Cordero for their suggestions!
Al
>-----Original Message-----
>From: Sorrell, Al [mailto:[email protected]]
>Sent: Thursday, August 16, 2012 10:39 AM
>To: spectrum
>Subject: [spectrum] Event rule help
>
>I have a couple of situations where we might get either EIGRP or BGP up/down
>notifications from Cisco
>routers. These typically appear as events that come in as traps. I've got
>rules already that can
>create new events based on whether or not the message is an UP (generates
>0xfff00022)or a DOWN
>(0xfff00021). I then have an EventSequence rule which looks for an UP after a
>DOWN within 300
>seconds; if so, it generates a BOUNCE event (0xfff0002a). If not, I generate a
>DOWN event and set it
>as a MAJOR alarm. (we also then handle the up and clear).
>
>Normally, I just Alarm the BOUNCE event as a minor (our paging rules don't
>send notifications on
>minor events).
># BGP BOUNCED
>0xfff0002a E 50 A 1,0xfff0002a
>
>Now, though, we have a requirement to set a MJOR alarm and page if we get
>multiple BOUNCE messages
>(FLAPPING) on the same device within a given period of time - say 3 in 5
>minutes. I'm puzzled how to
>do this and retain the functionality we have now; An EventRateWindow rule
>would seem to handle the
>issue of generating the FLAPPING event, but is there any way to do that and
>still retain the BOUNCED
>capability without having the BOUNCED even generate a separate new event which
>I then track with
>EventRateWindow? According to the doc, it looks like the LowRateEventCode
>doesn't get generated
>unless it has already generated a high event .
>
>Thanks,
>Al
T. Rowe Price (including T. Rowe Price Group, Inc. and its affiliates) and its
associates do not provide legal or tax advice. Any tax-related discussion
contained in this e-mail, including any attachments, is not intended or written
to be used, and cannot be used, for the purpose of (i) avoiding any tax
penalties or (ii) promoting, marketing, or recommending to any other party any
transaction or matter addressed herein. Please consult your independent legal
counsel and/or professional tax advisor regarding any legal or tax issues
raised in this e-mail.
The contents of this e-mail and any attachments are intended solely for the use
of the named addressee(s) and may contain confidential and/or privileged
information. Any unauthorized use, copying, disclosure, or distribution of the
contents of this e-mail is strictly prohibited by the sender and may be
unlawful. If you are not the intended recipient, please notify the sender
immediately and delete this e-mail.
---
To unsubscribe from spectrum, send email to [email protected] with the body:
unsubscribe spectrum [email protected]
