Perl-based NerveCenter Informs

greenbeansneedlesSoftware and s/w Development

Dec 13, 2013 (3 years and 10 months ago)

115 views

Perl
-
based NerveCenter Informs

2

Why Perl Informs?


Control over…


Varbinds in the inform (actually, attributes)


When to send (or not)

3

Perl Informs


Example 1


“Why
can’t

I send sysName and ifDescr?”


“I have to send a trap to myself and what?...”


“If only I could send this descriptor then I could make a generic
event message…”

4

Perl Informs (cont’d)


Send generic “node down” inform

my $inform_number = 120002;

my $attr1 = "";

# Set the device type.

if ($NodePropertyGrp =~ /$router/i) { $attr1 = "Device Type=Router"; }

elsif ($NodePropertyGrp =~ /$switch/i) { $attr1 = "Device Type=Switch"; }

elsif ($NodePropertyGrp =~ /$hub/i) { $attr1 = "Device Type=Hub"; }

elsif ($NodePropertyGrp =~ /$remote_access/i) { $attr1 = "Device Type=Remote
access device"; }

elsif ($NodePropertyGrp =~ /$load_balancer/i) { $attr1 = "Device Type=Load
balancer"; }

elsif ($NodePropertyGrp =~ /$unknown/i) { $attr1 = "Device Type=Device"; }

else { $attr1 = "Device Type=Device"; }

# Send the inform to Netcool.

&netcool_inform($inform_dest, $inform_number, 1, $attr1);

5

Perl Informs (cont’d)


NerveCenter probe rule


#


# EVENT NC_Node_Down


#


case "120002":


$device = extract($VarBind1, ".*=(.*)")


@Identifier = $MessageType + $ServerID + $NodeName + $MesgID


@AlertGroup = $ServerID + $NodeName + "120001"


@Summary =
$device + " " + $NodeName + " down."


@Severity = 5


@Type = 1

6

Perl Informs (cont’d)


Example 2


Interface going up and down


Already sending “interface down” and “interface up”, over and
over and…


Build a super
-
fantastic alarm that “measures” the rate of
down/up’s and decides “it’s bouncing”


Send a “bouncing” inform, squelch the down/up’s


Unsquelch the down/up’s if the interface no longer meets the
“bouncing” criteria

7

Perl Informs (cont’d)


Squelch up/down’s

my $index = "$NodeName:$TriggerInstance";

[stuff deleted]

# If the number of bounces is over the threshold

# and hysteresis is on then the interface is still

# bouncing. Make sure hysteresis is on and squelch the

# constant down and up interface events.

#


elsif (($total >= $bounce_count_threshold{$index}) &&
($hysteresis{$index})) {


$hysteresis{$index} = 1; # turn on hysteresis


$bounce_count_threshold{$index} = $bounce_threshold_lo;


$if_inform_squelch{$index} = 1;


FireTrigger("IfBouncing");


}

8

Perl Informs (cont’d)


Send the bouncing inform

my $attr1 =
"ifIndex
\
.".$TriggerInstance."=".$TriggerInstance;

my $index = "$NodeName:$TriggerInstance";

my $if_descr = $ifdescr{$index};

my $attr2 =
"ifDescr
\
.".$TriggerInstance."=".$if_descr;

&netcool_inform($inform_dest, 101901, 2, $attr1,
$attr2);

9

Perl Informs (cont’d)


Don’t send the down/up inform

my $index = "$NodeName:$TriggerInstance";

if (! $if_inform_squelch{$index}) {


my $attr1 = "ifIndex
\
.".$TriggerInstance."=".$TriggerInstance;


my $if_descr = $ifdescr{$index};


my $attr2 = "ifDescr
\
.".$TriggerInstance."=".$if_descr;


&netcool_inform($inform_dest, 101005, 2, $attr1, $attr2);

}

10

Perl Informs (cont’d)


Unsquelch up/down’s

my $index = "$NodeName:$TriggerInstance";

[stuff deleted]

#

# If the number of bounces does not exceed

# the threshold and hysteresis is on then

# the interface was bouncing and is now not

# bouncing enough to say it's bouncing.

#


elsif (($total < $bounce_count_threshold{$index}) &&
($hysteresis{$index}) && ($total != 0)) {


$hysteresis{$index} = 0; # make sure hysteresis is off


$bounce_count_threshold{$index} = $bounce_threshold_hi;


$if_inform_squelch{$index} = 0;


}

11

Perl Informs (cont’d)


Send me email if you’d like a copy of the code to the Perl
inform


Please make it better if you’d like


Please share the results if you can

x2sparke@southernco.com

12

Open Discussion