Looking for ideas on how to correlate between an updown trap event like the one shown below - would be nice to have the duration of the outage and how to correlate up/down from the same host
thx
2017-06-13 11:23:32 :
DISMAN-EVENT-MIB::sysUpTimeInstance = Timeticks: (10) 0:00:00.10 SNMPv2-MIB::snmpTrapOID.0 = OID: SNMPv2-SMI::enterprises.12028.4.15.0.63 SNMPv2-SMI::enterprises.12028.4.15.1.101 = INTEGER: 2 SNMPv2-SMI::enterprises.12028.4.15.1.102 = INTEGER: 4 SNMPv2-SMI::enterprises.12028.4.15.1.103 = STRING: "Device: HOSTANAMEA - Device Down AP is down (SNMP Trap - wlsxNAPMasterStatusChange from x.x.x.x)." SNMPv2-SMI::enterprises.12028.4.104 = IpAddress: x.x.x.x SNMPv2-SMI::enterprises.12028.4.103 = STRING: "x:x:x:x:x:x" SNMPv2-SMI::enterprises.12028.4.101 = STRING: "HOSTNAMEA"
2017-06-13 12:42:01 :
DISMAN-EVENT-MIB::sysUpTimeInstance = Timeticks: (10) 0:00:00.10 SNMPv2-MIB::snmpTrapOID.0 = OID: SNMPv2-SMI::enterprises.12028.4.15.0.15 SNMPv2-SMI::enterprises.12028.4.15.1.101 = INTEGER: 2 SNMPv2-SMI::enterprises.12028.4.15.1.102 = INTEGER: 1 SNMPv2-SMI::enterprises.12028.4.15.1.103 = STRING: "Device: HOSTANAMEA - Device Up Device Type is Access Point." SNMPv2-SMI::enterprises.12028.4.104 = IpAddress: x.x.x.x
As it turns out, I just wrote this with a client TODAY! Try this:
... | streamstats count(eval(searchmatch("Device Down"))) AS sessionID count AS _serial BY host
| eval sessionID = sessionID - if((searchmatch("Device Down")), 1, 0)
| stats first(_time) AS _time range(_time) AS downtime count first(_serial) AS _serial BY sessionID host
| rename COMMENT AS "Account for a DOWN event without a matching/later UP event"
| eval downtime = case((count=1 AND _serial=1), now()-_time,
(count=1 AND _serial>1), null(),
true(), downtime)
| sort 0 _time
| rename COMMENT AS "Above is what you asked, everything below is BONUS, baby; run for 'Today'"
| streamstats sum(downtime) AS accum_downtime BY host
| timechart max(accum_downtime) AS accumulated_downtime_seconds BY host
| filldown *
| untable _time key downTimeSeconds
| eval baseTime=relative_time(now(), "-0d@d")
| eval dayTimeSeconds=_time-baseTime
| eval efficiency=100*(1 - downTimeSeconds/dayTimeSeconds)
| fields - *Time*
| xyseries _time key efficiency
| timechart values(*) AS *