ONMS 23.0.4 running on Centos 7
We are monitoring several devices that use varbinds in the traps to indicate the severity of the event. A single trap OID can be assigned a severity of Warning, Minor, Major or Critical based on the value of one varbind. This same varbind is also used to indicate when the alarm has been Cleared. I have written each event xml rule and added the severity-specific varbind and value in the mask to set the severities. But, in order to use a single clearing event, I assigned the exact same uei for all of the different severity events so that I can reference it in the clear-key of the alarm-data of the clearing xml rule.
When I have tested this using spoofed traps, the alarm list gui in ONMS will show the last spoofed trap that I send since the uei is the same for each regardless of severity. For example, if I send a Critical version of the trap, the Critical alarm is displayed. If I send the Warning version of the trap, the Critical is replaced by the Warning. This functionality is acceptable in my environment. Regardless of which alarm severity is currently active, the clear trap clears that active alarm.
This seems to work in limited testing, but I’m wondering if this is the best way to go about using a single trap to clear several different alarm events. Any guidance will be appreciated…