Summary
Question
With the new Wireless Access Point monitoring feature introduced in Network Node Manager i-series (NNMi) 10.50 the following two traps are used to indicate an Access Point (AP) has moved from one Wireless Lan Controller (WLC) to another:
APAssociated : .1.3.6.1.4.1.14179.2.6.3.7
APDisassociated : .1.3.6.1.4.1.14179.2.6.3.8
Since the two traps are related to the same AP it can be useful to have the two traps "linked" in order for operators to be able to follow the movement of the AP.
This document will provide two solutions as to how this can be achieved.
Note, this is applicable to NNMi versions 10.50 and above.
Answer
alt="image text" height="323" width="648"ach://5ac76884001370ac81554188:CausalRule.jpg:kmdocument:KM03137451"font-family: arial;">There are two solutions to "linking" these two traps and each is documented under the following headings.
Custom Correlation
A custom correlation rule will correlate (link) the two traps and this will be seen in the Analysis Pane Child/Parent tab of the trap.
To configure the rule perform the following steps
- In the "Configuration" workspace click on "Custom Correlation"
- In the "Custom Correlation" tab click on the "*" to add a new rule
-
Enter a name for the rule
Enable the rule by checking the box
Set the Parent Incident to be "APAssociated"
Set the Child Incident to be "APDisassociated"
Set the Correlation Window Duration to a suitable value e.g. 1 minute -
In the "Correlation Filter" tab add the following filter
- Save the configurations
When the two traps are displayed in NNMi they will look something like the following. Note the Children tab for the APAssociate trap that correlates the child APDisassociate trap:
Causal Rule
A causal rule will create a new "parent" incident and correlate the two traps under it. They will be seen in the Analysis Pane Children tab of the new incident.
To configure the rule perform the following steps
- In the "Configuration" workspace click on "Custom Correlation"
- In the "Causal Rules" tab click on the "*" to add a new rule
-
Enter a name for the rule
Configure the Parent Incident (*), either by creating a new one, or entering an existing one
Set the Common Child Incident Attribute to be ${valueOfCia(\Q.1.3.6.1.4.1.14179.2.2.1.1.3\E)} - which is the name of the AP
Set the "Correlation Window Duration" to be 60 seconds -
In the "Child Incidents" tab create two entries.
a. Set the Name to be "APAssociated"
Set the Child Incident to be "APAssociated"
In the Forward Child Custom Incident Attributes enter: cia.address,.1.3.6.1.4.1.14179.2.2.1.1.3
Check the boxes "Use Child Incident's Source Object for Parent" and "Use Child Incident's Source Node for Parent"
b. Set the Name to be "APDisassocaited"
Set the Child Incident to be "APDisassociated"
In the Forward Child Custom Incident Attributes enter: cia.address
Don't check either of the boxes - Save the configurations all the way out.
(*) For the message of the parent incident you could have something like:
Wireless Access Point $.1.3.6.1.4.1.14179.2.2.1.1.3 has moved from $cia.address to $cia.address_1
however at the time of writing the use of $cia.address_1 did not substitute the correct second address.
The resulting traps are shown in the "All incidents" view as follows. However the parent is a "Root Cause" while the two child traps are now "Symptoms" which means while the parent can be seen in the Root Cause view the child traps can only be seen in the "All Incidents" view.
