DFM: MajorAlarm | cswStackMemberRemoved

Unanswered Question
Mar 30th, 2009

We lost a switch that was part of a stack and are getting DFM traps and Cisco syslog messages into our CIC netcool console. When we lost the switch we received both a DFM cswStackmemberRemoved event and also a Cisco STACKMGR SWITCH-REMOVED syslog msg.

Our question is which event is better to use in this case to generate a Critical Alert in CIC. The syslog message gives the switch number but would require rule work to match the switch added msg to the switch removed message. the DFM event we assumed is a polled event that will automatically generate a clear to CIC when the switch is again added.

Which event would be best to use in CIC ?


I have this problem too.
0 votes
  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 4 (1 ratings)
Joe Clarke Mon, 03/30/2009 - 09:24

DFM (at least newer versions) actually use the CISCO-STACKWISE-MIB traps to handle stack changes. Therefore, for consistency, I would recommend going with the trap in CIC. If you've got a powerful event management system like CIC, traps are also nicer to deal with since they are well-documented, and typically don't require regular expressions to parse out the useful bits.

GERARD PUOPLO Mon, 03/30/2009 - 10:41

So DFM isn't polling when it generates a cswStackMemberRemoved event. It's just articulating the cswStackMemberRemoved trap. Question #1: Is that right ?

If so , do you know what logic DFM uses to clear the cswStackMemberRemoved event. Question#2: Does DFM just age out the cswStackMemberRemoved event or does DFM clear it when it receives a cswStackNewMember trap with a matching switch num in the trap varbind ?

Thanks as always for your responses.

Joe Clarke Mon, 03/30/2009 - 10:52

Yes, DFM uses the CISCO-STACKWISE-MIB traps to detect stack issues rather than relying on polling.

DFM ages out the events. All of the traps are given a critical severity except cswStackNewMember which is given an informational severity.

GERARD PUOPLO Tue, 03/31/2009 - 06:26

In regards to "DFM ages out the events" in regards to trap based events like cwsStackmemberRemoved ... what is the age timer ? Also is there a way to modify the age out timer ?


This Discussion