Since I had no suggestions, but a few people who were interested in the method,
let me share what I found that does work. I make no guarantees that this is the
most elegant or efficient method, but it does work (Spectrum 9.2.1).
Al
# CSS event comes as 0x03cc0008- text in var 5
# Examples of var 5 text:
# Service Transition - Service:papp42:29730 State:alive
# Service Transition - Service:papp41:29730 State:down
# Service Transition - Service:preg12:389 State:susp
# Create a new event with the "Service:<server>:<port> info into VAR 6 which
will eventually
# become the discriminant
0x03cc0008 P \
"CreateEventWithVariables( \
{ C CURRENT_MODEL }, \
{ H 0xfff01600 }, \
SetEventVariable( \
GetEventVariableList( { C CURRENT_EVENT } ), \
{ U 6 }, \
GetRegexp( \
{ v 5 }, \
{ S \"(Service:.*)
(.*)\" }, \
{ U 1 } )))"
# Take the newly generated event (0xfff01600) and create new events based on
the state of
# the service - 'down', 'susp' or 'alive'.
# Copy the service info generated in Var 6 above to Var 1 for discrimination.
# Copy the entire original message (V 5) into the magic variable 76620 for
dynamic title info
# Should never get event 0xfff01604 which is for message without 'down', 'susp'
or 'alive'.
0xfff01600 E 50 R CA.EventCondition, \
"regexp({ v 5 }, { S \".*down.*\" })", "0xfff01601 6:1, 5:76620", \
"regexp({ v 5 }, { S \".*susp.*\" })", "0xfff01602 6:1, 5:76620", \
"regexp({ v 5 }, { S \".*alive.*\" })", "0xfff01603 6:1, 5:76620", \
"default", "0xfff01604 -:-"
0xfff01601 E 10 A 2,0xfff01601,1
0xfff01602 E 10 A 2,0xfff01602,1
0xfff01603 C 0xfff01601,1 C 0xfff01602,1
0xfff01604 E 10 A 2,0xfff01604
>-----Original Message-----
>From: Sorrell, Al [mailto:[email protected]]
>Sent: Wednesday, November 21, 2012 5:24 PM
>To: spectrum
>Subject: [spectrum] Event rule
>
>I have the need to take a fairly generic trap and change it into a more
>specific trap with
>the ability to clear based on a portion of the trap and provide a dynamic
>alarm title as
>well. (If interested, this is a Cisco CSS services alarm). The alarm begins
>life as
>follows
>
>$SPECROOT: /SS/CsVendor/Cisco_CSS/CiscoCSS/AlertMap:
># apSvcTransitionTrap # apSvcTrapEventText
>1.3.6.1.4.1.9.9.368.1.15.1.6.1 0x3cc0008 1.3.6.1.4.1.9.9.368.1.15.10(5,0)
>
>$SPECROOT: /SS/CsVendor/Cisco_CSS/EventDisp
>0x3cc0008 E 30
>
>The Event Text looks like this:
> Service Transition - Service:papp42:29730 State:alive
> Service Transition - Service:papp41:29730 State:down
> Service Transition - Service:preg12:389 State:susp
>
>I'd like to create two events, an alarm and a clear using the
>"Service:<server>:port>" as
>both the discriminator and the dynamic alarm title. (I haven't tried the code
>below since
>I'm running out of time before Thanksgiving). Is this a reasonable way to
>approach the
>problem?
T. Rowe Price (including T. Rowe Price Group, Inc. and its affiliates) and its
associates do not provide legal or tax advice. Any tax-related discussion
contained in this e-mail, including any attachments, is not intended or written
to be used, and cannot be used, for the purpose of (i) avoiding any tax
penalties or (ii) promoting, marketing, or recommending to any other party any
transaction or matter addressed herein. Please consult your independent legal
counsel and/or professional tax advisor regarding any legal or tax issues
raised in this e-mail.
The contents of this e-mail and any attachments are intended solely for the use
of the named addressee(s) and may contain confidential and/or privileged
information. Any unauthorized use, copying, disclosure, or distribution of the
contents of this e-mail is strictly prohibited by the sender and may be
unlawful. If you are not the intended recipient, please notify the sender
immediately and delete this e-mail.
---
To unsubscribe from spectrum, send email to [email protected] with the body:
unsubscribe spectrum [email protected]
