10 CHAPTER Prime Performance Manager allows you to view alarms and events that occur in your network. The following topics provide information about displaying network alarms and events: Displaying Active Alarms and Event History, page 10-1 Managing Alarms and Events, page 10-3 Displaying Active Alarms and Event History You can view active network alarms and historical events. Each alarm and event includes parameters to help you understand the alarm, its cause, and its history. Alarms and events are displayed from the Prime Performance Manager Performance menu: Alarms/Events Alarms/Events > Event History Alternatively, you can view alarms for a device by displaying the device and choosing Active Alarms. Table 10-1 shows the alarm and event parameters. Not all parameters are displayed by default. To display them, see Creating and Editing Device Polling Groups, page 9-14. Table 10-1 Column Internal ID 1 Ack Name Alarm Nature 1 Active Alarms and Event History Description Internal ID of the alarm or event. The internal ID is a unique ID that Prime Performance Manager assigns for its own internal use. This ID can also be used when the Cisco Technical Assistance Center must debug problems. Indicates whether the alarm or event is acknowledged. The alarm or event name. The alarm nature, which is determined when the alarm is created. Valid values: ADAC Automatically detected and automatically cleared ADMC Automatically detected and manually cleared Undefined Undefined 10-1
Displaying Active Alarms and Event History Chapter 10 Table 10-1 Active Alarms and Event History (continued) Column Alarm Type 1 Probable Cause 1 Element Name 1 Category 1 Severity Original Severity 1 Description The alarm type. Alarm types include: Communications Processing Error Environmental QOS Equipment Undefined The alarm or event probable cause. The network element name associated with the event. The event category. Categories include: Create Creation event, such as the creation of a seed file. Delete Deletion event, such as the deletion of an object or file. Discover Discovery event, such as Discovery beginning. Edit Edit event. A user has edited an object. Ignore Ignore event. A user has ignored a link or linkset. Login Login event. A user has logged into Prime Performance Manager. LoginDisable LoginDisable event. Prime Performance Manager disabled a user s access because of too many failed attempts to log in. LoginFail LoginFail event. An attempt by a user to log into Prime Performance Manager failed. Logout Logout event. A user logged out of Prime Performance Manager. Network Events pertaining to managed elements. OverWrite OverWrite event. An existing file, such as a seed file or route file, has been overwritten. Poll Poll event, such as an SNMP poll. Purge Purge event. A user has requested Discovery with Delete Existing Data selected, and Prime Performance Manager has deleted the existing Prime Performance Manager database. Status Status change message generated. System Events pertaining to Prime Performance Manager. Request A request is created for every user-initiated action that generates a request from the gateway to a unit. TCA Threshold crossing alarm. The alarm or event severity. Severities include: Critical, Major, Minor, Warning, Normal, Indeterminate, Informational Note You cannot change the severity of an event. The original severity of the event. 10-2
Chapter 10 Managing Alarms and Events Table 10-1 Active Alarms and Event History (continued) Column Count Note 1 Create Time (gateway time zone) 1 Create Time 1 Change Time (gateway time zone) 1 Change Time 1 Ack By 1 Ack Time (gateway time zone) 1 Ack Time 1 Device Device type 1 Clear By 1 Clear Time (gateway time zone) 1 Clear Time 1 Message Description The number of events in the event sequence for an alarm. Indicates whether a note is associated with the event. The time, in the gateway time zone, when this event was received. This column is displayed by default in the Event History window and the Events tab. The time, GMT, when the event was received. The time, in the gateway time zone, when this event was last updated. The time, GMT, when the event was last updated. The user who last acknowledged the alarm or event, or, user-based access is not implemented, the device name that last acknowledged the event. If not acknowledged, this field is blank. The time, in the gateway time zone, when the event was acknowledged. The time, GMT, when the event was acknowledged. Name of the device associated with the alarm or event. If no device is associated, None is displayed. The device type. User who cleared the event. The time, in the gateway time zone, when the event was cleared. The time, GMT, when the event was cleared. Message associated with the alarm or event. 1. Not displayed by default. To display hidden properties, see Adding and Removing Properties from Property Views, page 3-9. Managing Alarms and Events Prime Performance Manager provides many functions to filter and change the alarms and events display. Most functions are performed from the Active Alarms and Event History toolbar. Table 10-2 lists the tools and their functions. 10-3
Managing Alarms and Events Chapter 10 Table 10-2 Alarms and Event History Toolbar Name Tool Description Modify Event Filter Opens the Prime Performance Manager Alarm and Event Filter dialog box. See Filtering Alarms and Events, page 10-5. Remove Filter Activates and deactivates the event filter specified in the Prime Performance Manager Alarm and Event Filter dialog box. If the filter is activated, Prime Performance Manager shows only those alarms or events that pass the filter. If the filter is deactivated, Prime Performance Manager shows all alarms or events. If you activate a filter in an object s Recent Events table in the Prime Performance Manager main window, the filter is activated in all Recent Events tables in the Prime Performance Manager main window for all other objects. Archived Displays archived events or alarms. The tool operates as a toggle, so you can use it to switch back and forth. Caution You can change the number of rows in the archived events table by editing the MaxArchivedRecords property in the etc/sgmeventlimits.conf file. The default value is 200,000. Increasing it can significantly impact server performance. Refresh Refreshes the Active Alarms or Event Archive display. Pause or Resume Pauses or resumes the display of new alarms or events. When paused, Prime Performance Manager does not display new alarms or events (unless you apply a filter or edit your preferences). When resumed, all new alarms or events that occurred after the table was paused are added to the display. If alarms or events are deleted while active alarms or events are paused, they are not removed. Instead, they are dimmed and cannot be acknowledged or edited. Deleted alarms or events are removed when you resume the active alarms or events display. Total (alarm count) Displays all alarm and event severities. Critical (alarm count) Filters the page to display only the alarms with Critical severity. (alarm percentage) 1 Major (alarm count) Filters the page to display only the alarms with Major severity. (alarm percentage) 1 Minor (alarm count) Filters the page to display only the alarms with Minor severity. (alarm percentage) 1 Warning (alarm count) (alarm percentage) 1 Filters the page to display only the alarms with Warning severity. Informational (alarm count) (alarm percentage) 1 Indeterminate (alarm count) (alarm percentage) 1 Normal (alarm count) (alarm percentage) Filters the page to display only the alarms with Informational severity. Filters the page to display only the alarms with Indeterminate severity. Filters the page to include only the alarms with Normal severity. 10-4
Chapter 10 Managing Alarms and Events Table 10-2 Alarms and Event History Toolbar (continued) Name Tool Description Acknowledge Acknowledges the selected alarms or events. Unacknowledge Unacknowledges the selected alarms or events. Clear 2 Clears the selected alarms. When you clear an alarm, it no longer affects the object severity (its severity changes to normal), but the alarm remains in the Active Alarms table. Delete Deletes the chosen alarms or events. When you delete an alarm or event, you remove it from the table, and Prime Performance Manager archives the alarm or event in its database. The alarm or event no longer affects the severity of the object. Clear and Delete 2 Clears and deletes the selected alarms from the Active Alarms table. Use this tool if you need to designate an alarm as Manually Cleared before deleting it. After you clear and delete an alarm, Prime Performance Manager changes the object alarm severity to normal, sends an alarm log message to /opt/cscoppm-gw/logs/messagelog.txt, and sends a trap to the northbound host to indicate that the alarm cleared. Event Properties Opens the Prime Performance Manager Alarm and Event Properties window with the alarm properties displayed. See Displaying Alarm and Event Properties, page 10-7. Events for Alarm Opens the Prime Performance Manager Alarm and Event Properties window with the alarm events displayed. See Displaying Alarm Events, page 10-9. Edit Notes Opens the Prime Performance Manager Alarm and Event Properties window with the alarm notes displayed. See Adding Notes to Alarms or Events, page 10-8. Time Difference Displays the time difference in days, minutes, hours, and seconds between two alarms or events. To show a time difference: Export the report as a CSV file Help for Event Report for Event In the client interface, use the Ctrl key to select two alarms or events, or In the web interface, check the check boxes of two alarms or events. Click the Time Difference tool. Exports the alarms and events related table data to a report with comma-separated values (CSV) file. You can save this file to disk or open it with an application that you choose (for example, Microsoft Excel). Displays context-sensitive help for the chosen alarm or event in a separate browser window. For TCAs for Administrator users, the Edit Threshold dialog is displayed; for other users, the View Threshold dialog is displayed. If a TCA is selected, launches the associated report. 1. Alarm count and the alarm percentage are not displayed in the Event History table. 2. Not displayed for events. Filtering Alarms and Events You can use the Modify Event Filter to change the alarm or event information appears. To change the alarms or events display, in the navigation tree, choose Active Alarms or Event History, then click the Modify event filter tool. The Prime Performance Manager Alarm and Event Filter dialog box appears. The dialog box allows you to set filtering options based on three areas: Categories 10-5
Managing Alarms and Events Chapter 10 Severities Other Use the Categories pane to specify the alarm or event categories you want to display. The following categories are available: System Prime Performance Manager alarms and events. Network Managed element alarms and events. TCA Threshold crossing alarts. All categories are checked by default. You can click Deselect All, or Select All to select or deselect all categories. Note These are the default categories; additional categories might be defined by the Prime Performance Manager system administrator. The Severities pane allows you to specify which alarm/event severities you want to display. Severities include: Informational Normal Indeterminate Warning Critical Minor Major The Alarm and Event Filter dialog box Other pane allows you to further define the alarms and events filter. These settings are applied to all alarms/events displays in the current view. Table 10-3 describes the options in the Other pane. Table 10-3 Alarm and Event Filter Dialog Box Other Pane Field Acknowledged Unacknowledged Time Before Time Before Time After Description Indicates whether only acknowledged alarms/events appear in the Active Alarms or Event History window. This check box is checked by default. Indicates whether only unacknowledged alarms/events appear in the Active Alarms or Event History window. This check box is checked by default. Indicates whether only alarms/events that Prime Performance Manager logs before a specified date and time, appear in the Active Alarms or Event History window. This check box is unchecked by default. Specifies the date and time prior to which alarms/events that Prime Performance Manager logs appear in the Active Alarms or Event History window. This field is dimmed unless the Time Before check box is checked. Check box indicating whether only alarms/events that Prime Performance Manager logs after a specified date and time, appear in the Active Alarms or Event History window. This check box is unchecked by default. 10-6
Chapter 10 Managing Alarms and Events Table 10-3 Alarm and Event Filter Dialog Box Other Pane (continued) Field Time After Name or Message Matches Match Case Match Regex Suppress for unmanaged devices Description Specifies the date and time after which alarms/events that Prime Performance Manager logs appear in the Active Alarms or Event History window. This field is dimmed unless the Time After check box is checked. Indicates whether only alarms/events that contain the specified message text appear in the Active Alarms or Event History window. This check box is unchecked by default. The Name or Message Matches field value is retained after a message filter is set. Indicates whether only alarms/events that match the case of the text in the Name or Message Matches field should appear in the Active Alarms or Event History window. This field is dimmed unless Name or Message Matches is selected. Match Case default is not selected by default if Name or Message Matches is selected. Match Case is disabled if Match Regex is selected. The Active Alarms or Event History table is filtered properly, based on the text entered in the Name or Message Matches text box (case sensitive), if Match Case is selected. The Match Case selection is retained after a message filter is set. Indicates whether only alarms/events that match the regular expression of the text in the Name or Message Matches field should appear in the Active Alarms or Event History window. This field is dimmed unless the Name or Message Matches check box is checked. Match Regex is unchecked by default, if the Name or Message Matches check box is checked. Match Regex is disabled if the Match Case check box is checked. The Active Alarms or Event History table is filtered properly, based on the regular expression entered in the Name or Message Matches text box (case-sensitive), if the Match Regex check box is selected. The check box Match Regex is selected after a message filter is checked. Note If invalid regex is provided, then Active Alarms or Event History table does not contain any rows. Suppresses alarms/events for any objects that have been set to the unmanaged state. To suppress alarms/events for unmanaged objects, check the check box. To retain alarms/events for unmanaged objects, uncheck the check box. Note If you are viewing alarms/events for a specific object in the navigation tree of Prime Performance Manager main window, this button is not available. Displaying Alarm and Event Properties Not all alarm or event properties are displayed in the Active Alarms or Event History windows. While you can choose to display the properties not displayed by default in the Active Alarms and Event History window, you can quickly view all parameters for individual alarms and events. To view the properties for an individual alarm or event: Step 1 From the Network menu, choose Alarms/Events. 10-7
Managing Alarms and Events Chapter 10 Step 2 Step 3 Do one of the following: In Active Alarms window, check the alarm whose properties you want to view or, Click Event History and check the event whose properties you want to view. From the Active Alarms or Event History window toolbar, click Event Properties. The Prime Performance Manager Alarm and Event Properties window Properties tab displays the all properties listed in Table 10-1. Related Topics Adding Notes to Alarms or Events, page 10-8 Displaying Alarm or Event Details, page 10-9 Displaying Alarm Events, page 10-9 Displaying Daily Alarm and Event Archives, page 10-10 Adding Notes to Alarms or Events Prime Performance Manager allows you to add notes to alarms and events, for example, you might want to add information about an alarm for others to know or as reminders, for example, the alarm or event s associated object, what triggered the alarm or event, how often it has occurred, and so on. To add a note to an alarm or event: Step 1 Step 2 Step 3 Step 4 From the Network menu, choose Alarms/Events. Do one of the following: In Active Alarms window, check the alarm to which you want to add a note or, Click Event History and check the event to which you want to add a note. From the Active Alarms or Event History window toolbar, click Edit Notes. The Prime Performance Manager Alarm and Event Properties window Notes tab is displayed. Any previously added notes are displayed. The date and time the notes were last updated is displayed in the Last Updated field. (If no notes have been added, the Last Updated field displays Not Set.) To add a new note, type the text in the note page, then click Save Note on the Notes toolbar. Related Topics Displaying Alarm and Event Properties, page 10-7 Displaying Alarm or Event Details, page 10-9 Displaying Alarm Events, page 10-9 Displaying Daily Alarm and Event Archives, page 10-10 10-8
Chapter 10 Managing Alarms and Events Displaying Alarm or Event Details Prime Performance Manager includes additional details for some alarms and events that are not included in the alarm or event message text or properties. For example, the SchedulerQueueSize alarm might display the following message: Unit: unitname - The PPM scheduler queue size is over threshold which indicates a possible performance problem. The Alarm and Event Properties window Details tab might display additional details, such as: QSize 110 QMax 155 QMin 0 QThreshold 100 QAvg 105 isalarm True UnitEventId 468002 To display alarm or event details: Step 1 Step 2 Step 3 From the Network menu, choose Alarms/Events. Do one of the following: In Active Alarms window, check the alarm whose details you want to view or, Click Event History and check the event whose details you want to view. From the Active Alarms or Event History window toolbar, click Event Properties, then click the Details tab. Additional alarm or event details, if present, will be displayed. Related Topics Displaying Alarm and Event Properties, page 10-7 Adding Notes to Alarms or Events, page 10-8 Displaying Alarm Events, page 10-9 Displaying Daily Alarm and Event Archives, page 10-10 Displaying Alarm Events To assist you in analyzing any individual alarm, you can view the events that comprise it. The events can be displayed chronologically, or sorted by other criteria such as device, severity, or message text. The collection of events provide a more detailed profile of any give alarm. To display alarm events: Step 1 Step 2 Step 3 From the Network menu, choose Alarms/Events. In Active Alarms window, check the alarm whose events you want to view. From the Active Alarms window toolbar, click Events for Alarm. The alarm events are displayed. 10-9
Managing Alarms and Events Chapter 10 Step 4 From the Events for Alarm tab you can perform any event function described in Table 10-2 on page 10-4. Related Topics Displaying Alarm and Event Properties, page 10-7 Adding Notes to Alarms or Events, page 10-8 Displaying Alarm or Event Details, page 10-9 Displaying Daily Alarm and Event Archives, page 10-10 Displaying Daily Alarm and Event Archives Prime Performance Manager archives alarms and events every night. The archive process gathers all the events and alarms for that day and places them in a file-based archive. The daily archives can be stored back as far as several months, if needed. Eventually, you can move the daily archives out of your database and into compressed-file-based archives for long term storage. To display the daily archive: Step 1 Step 2 Step 3 Step 4 From the Network menu, choose Alarms/Events. From the Active Alarms window, click Daily Archives. The message archive is displayed. The daily archive is named Status+Alarms.archivedate. To display the archive, click the archive link. In the archive you can do any of the following to change the archive display: Limit the number of events displayed per page by clicking 10/Page (10 events per page), 20/Page, 50/Page, 100/Page, 200/Page, 300/Page, 400/Page, or 500/Page. In addition, you can: Click Max/Page to display all archive events on one page. Click DefPrefs to return to the default archive display. Click Reload to reload the archive. Display only alarms and events with a particular severity level by clicking Critical, Major, Minor, Warning, Informational, Admin, Error, Normal, Indeterminate, AlarmsOnly, AllEvents. Related Topics Displaying Alarm and Event Properties, page 10-7 Adding Notes to Alarms or Events, page 10-8 Displaying Alarm or Event Details, page 10-9 Displaying Alarm Events, page 10-9 10-10
Chapter 10 Managing Alarms and Events Displaying Alarms by Device From the Alarms Window You can display alarms by device from the Prime Performance Manager Alarms window or the Devices window. To display alarms by device from the Alarms window, choose Alarms/Events from the Network menu, then click Alarms by Device. For a description of alarms by device parameters, see Table 9-3 on page 9-5. 10-11
Managing Alarms and Events Chapter 10 10-12