Dave Young Acclaimed Contributor.
Acclaimed Contributor.

Re: OSPF trap correlation

Jump to solution

Hi,

  Many thanks for the examples - this makes the testing so much easier.  So here is the configuration I have put together:

For the OspfNbrStateChange trap  the dampening tab has the following configuration:

    AND
        ciaName = .1.3.6.1.2.1.14.10.1.6
        ciaValue = 1

This is enabled and has a 3 minute interval configured.

I created a Pairwise configuration where both incidents were the OspfNbrStateChange trap, the window is 0, the action is "close"  and the following tabs are configured

First:

    AND
        ciaName = .1.3.6.1.2.1.14.10.1.6
        ciaValue = 1

Second

     AND
        ciaName = .1.3.6.1.2.1.14.10.1.6
        ciaValue = 8

Matching Criteria:

   .1.3.6.1.2.1.14.10.1  v     .1.3.6.1.2.1.14.10.1
   .1.3.6.1.2.1.14.10.3  v     .1.3.6.1.2.1.14.10.3

   With this configuration if the two are paired within the 3 minute dampened window then the two will come out of the window period in a closed state and will then subsequently be deleted.   If they are more than 3 mins apart then the down will come out in the registered state but will be paired and closed with the UP when it comes in.

  I hope this helps resolve your configuration.  Let me know if you still have problems.

  All the best

Dave Y 

 

 

 

 

 

 

 

MicroFocus Support
Viewed the Support tips? Search for "(NNMi) Support Tips" and order by Date to get the list
The views expressed in my contributions are my own and do not necessarily reflect the views and strategy of MicroFocus
If you find this or any post resolves your issue, please be sure to mark it as an accepted solution.
0 Likes
Highlighted
Established Member.. HHirt
Established Member..

Re: OSPF trap correlation

Jump to solution

Thanks Dave,

Pairwise was exactly as is, but dampening wasn't. I modified it and will test it when I have a chance and keep you posted.

Regards

0 Likes
Established Member.. HHirt
Established Member..

Re: OSPF trap correlation

Jump to solution

Dear Dave,

I verified the behavior yesterday and the result is good, thanks a lot for your additional help.

Last question, would it be possible to have a status change when the pairwise is correlated from status "registered" to "closed" that the event disappear automatically from the open incidents view? (Enrichment maybe?)

Thanks

 

0 Likes
Dave Young Acclaimed Contributor.
Acclaimed Contributor.

Re: OSPF trap correlation

Jump to solution

Hi,

  You have two options here. 

1) The first is to use one of the "Open" incident views such as "Open Key Incidents" or "Custom Open incidents" as these by default have a filter that does not include closed incidents.  You could use the Open Incidents view and configure it with a filter so that Closed incidents are not displayed.  If you check the default filter you will see that "Dampened" incidents are not displayed by default - this is why you don't see them.  The drawback with this approach is that the filter does need to be configured initially, although these days its alot more "sticky" and is remembered via a cookie in the browser.

2) The other option you have is to check the box "Delete when canceled" within the pairwise configuration.   Again this does exactly what it says.  Rather than closing the two incidents it will actually delete them. 

The choice you make will depend on whether you want a record of the incidents kept for later review, or if you are happy for them to just be removed.

  Hope this helps

Dave Y

Ps.  When you are happy the thread is complete please close it by clicking on the "Accept as solution" button next to the appropriate entry.

MicroFocus Support
Viewed the Support tips? Search for "(NNMi) Support Tips" and order by Date to get the list
The views expressed in my contributions are my own and do not necessarily reflect the views and strategy of MicroFocus
If you find this or any post resolves your issue, please be sure to mark it as an accepted solution.
0 Likes
Established Member.. HHirt
Established Member..

Re: OSPF trap correlation

Jump to solution

Ok, for me the idea was to ensure that when the correlation took place that NNMi change the status from Registered to Closed.

Apparently by reading your comment, it seems that this is done by default, am I right?

Regarding the second proposal, with deleting the incident, would it be totally gone from NNMi or we can still see if in the "incidents browsing > SNMP Traps" ?

Thanks

0 Likes
Dave Young Acclaimed Contributor.
Acclaimed Contributor.

Re: OSPF trap correlation

Jump to solution

Hi,

  Correct.  The default mode of operation for PairWise is to "close" the paried incidents.  However with the check box setting you can delete them if you want to.

  If you delete an incident either via suppression, the delete command in the UI, trimming them or pairwise then the two incidents are removed from the database and you won't see them again.

  If you need to have a record of them then option 1 is what you will want to use.

  All the best

Dave Y

MicroFocus Support
Viewed the Support tips? Search for "(NNMi) Support Tips" and order by Date to get the list
The views expressed in my contributions are my own and do not necessarily reflect the views and strategy of MicroFocus
If you find this or any post resolves your issue, please be sure to mark it as an accepted solution.
0 Likes
Established Member.. HHirt
Established Member..

Re: OSPF trap correlation

Jump to solution

great, all is clear, thanks again for your valuable support.

0 Likes
The opinions expressed above are the personal opinions of the authors, not of Micro Focus. By using this site, you accept the Terms of Use and Rules of Participation. Certain versions of content ("Material") accessible here may contain branding from Hewlett-Packard Company (now HP Inc.) and Hewlett Packard Enterprise Company. As of September 1, 2017, the Material is now offered by Micro Focus, a separately owned and operated company. Any reference to the HP and Hewlett Packard Enterprise/HPE marks is historical in nature, and the HP and Hewlett Packard Enterprise/HPE marks are the property of their respective owners.