Designing and Managing Behavior Models - Alarm Actions - Alarm Counter -
Action Router      Beep

Alarm Counter

Suppose that you want to write an alarm to detect more than five authentication-failure traps from a node within five minutes. A possible state diagram for this problem is shown in First Solution to Authentication-Failure Problem.

First Solution to Authentication-Failure Problem

Presumably, the trigger authFail is fired by a trap mask that detects generic authentication-failure traps. Also, on the transition from Ground to Alert1, the trigger authClear is fired on a five minute delay. This trigger is cleared on the transition from Alert5 to Intrusion.

With seven states, this diagram doesn't look too bad. But what if you had been asked to write an alarm that detected more than twenty authentication failures? Clearly, a better approach is needed.

The NerveCenter feature that you can use to simplify this type of state diagram is the Alarm Counter alarm action. This action enables you to loop in an alert state until you're ready to move to the Intrusion state. Thus, a revised state diagram might look like Solution Using the Alarm Counter Action:

Solution Using the Alarm Counter Action

The firing and clearing of the authClear trigger are handled as they were in the previous example. The new actions in this state diagram are Alarm Counter actions on both the transition from Alert to Alert and the transition from Alert to Ground.

The Alarm Counter action associated with the circular transition from Alert to Alert:

• Creates a counter variable if it does not already exist.
• Increments the counter. (The initial value of the counter is zero.)
• Checks to see whether the value of the counter is 5. (The test is for 5 instead of 6 because one authorization failure has to occur for the alarm to reach the Alert state.)
• Fires the trigger intrusion if the value of the counter is greater than 4.

The Alarm Counter action associated with the transition from Alert to Ground:

• Creates the counter if it does not already exist.
• Sets the value of the counter to 0.

This example shows both of the main uses of the Alarm Counter action: to set up a loop in which a trigger is fired when the counter reaches a certain value and to set or reset the value of the counter.

---

   You can use the Counter() Function in a Perl subroutine or Action Router rule to get the value of a counter associated with a particular transition. For more information, see Counter() Function.
You can also use the NC::AlarmCounters Perl object in Perl subroutines. However, the NC::AlarmCounters object is completely seperate from the Counter() function and does not share data with the Counter () function. For more details about the NC::AlarmCounters, see the Release Notes.

---

 
  To create an alarm counter:

1. In the Transition Definition window, select the New Action button.

   A pop-up menu of actions is displayed.

2. Select Alarm Counter from the pop-up menu.

   The Alarm Counter Action dialog is displayed.

   

3. Type a counter name in the Counter Name text field, or select a counter name from the Counter Name drop-down list.

   The drop-down list will contain values only if another transition in the same alarm has already defined an alarm counter.

   The scope of the alarm counter name is the alarm instance in which the counter is created.

4. To set up a loop -- that is, you want to fire a trigger after a transition has occurred a certain number of times -- perform these steps:
   1. Select either the Increment or Decrement radio button.

      Obviously, this choice determines whether the counter will be incremented or decremented when the Alarm Counter action is performed. Normally, you increment a counter because the counter is initialized to 0. However, it is possible to set the counter to a nonzero value in one Alarm Counter action and then to decrement it in another.

      The counter is incremented or decremented before it is used in any comparison.

   2. Type an integer in the when counter equals field.

      The Alarm Counter action can fire a trigger when the counter equals this value.

   3. Type the name of a new trigger in the Fire Trigger field, or select an existing trigger from the Fire Trigger drop-down list.

      If you do not enter a trigger name, any value you enter in the "when counter equals" field is lost when you save the alarm.

5. To set or reset the value of a counter, perform these steps:
   1. Check the Set Counter checkbox.
   2. Enter an integer in the Value field.

      The counter will be set to this value when the Alarm Counter action occurs.

6. Select the OK button in the Alarm Counter Action dialog.
7. Select the OK button in the Transition Definition window.
8. Select the Save button in the Alarm Definition window.