User Guide for Cisco Unified Operations Manager 2.2
Monitoring Alerts and Events
Downloads: This chapterpdf (PDF - 959.0KB) The complete bookPDF (PDF - 13.05MB) | Feedback

Monitoring Alerts and Events

Table Of Contents

Monitoring Alerts and Events

How to Use the Alerts and Events Display

Selecting Views for Alerts and Events

Filtering Alerts and Events

Resetting Filters on the Alerts and Events Display

Starting the Alerts and Events Display

Understanding the Layout of the Alerts and Events Display

Getting Alert Details Using the Alerts and Events Display

Getting Alert and Event Details

Starting the Alert Details Page

Event Processing for the Alerts and Events Display During High CPU Utilization

Understanding the Layout of the Alert Details Page

Command Button Area

Viewing Events Associated with an Alert

Viewing Event Details

Getting Device Information

Starting the Detailed Device View

Understanding the Layout of the Detailed Device View

Viewing Device Elements in Detail

Information Shown in the Detailed Device View

Suspending Device Monitoring

Suspending/Resuming Devices

Suspending/Resuming a Device Component

Responding to Alerts

Responding to Alerts Using the Alerts and Events Display

Clearing an Alert—Using the Alerts and Events Display

Acknowledging an Alert—Using the Alerts and Events Display

Responding to Alerts Using the Alert Details Page

Acknowledging an Alert—Using the Alert Details Page

Clearing an Alert—Using the Alert Details Page

Annotating an Alert

Sending E-Mail in Response to an Alert

Responding to Events

Responding to Events Using the Alert Details Page

Acknowledging an Event—Using the Alert Details Page

Clearing an Event—Using the Alert Details Page

Annotating an Event

Sending E-Mail in Response to an Event

Responding to Events Using the Events Details Page

Acknowledging an Event—Using the Event Details Page

Clearing an Event—Using the Events Details Page

Closing the Event Details Page


Monitoring Alerts and Events


These topics describe monitoring Alerts and Events:

How to Use the Alerts and Events Display

Getting Alert Details Using the Alerts and Events Display

Getting Alert and Event Details

Getting Device Information

Suspending Device Monitoring

Responding to Alerts

Responding to Events

How to Use the Alerts and Events Display

The Alerts and Events display provides real-time information about the operational status of your network. The displays are designed so that you can set them up and leave them running, providing an ongoing monitoring tool that signals you when something needs attention. When a fault occurs in your network, Cisco Unified Operations Manager (Operations Manager) generates an event or events that are rolled up into an alert. If the alert occurs on an element in your active view (a logical grouping of device groups), it is shown on your Alerts and Events display.

After setting up a view, you can customize your Alerts and Events display by selecting specific views and using filters:

Views control the events for device groups that appear on the Alerts and Events display. See Selecting Views for Alerts and Events.

Filters control the specific device types you monitor, along with alert severities and their status. See Filtering Alerts and Events.

You can also change the names of Operations Manager events to names that are more meaningful to you. These customized names are reflected in both the Alerts and Events display and any Alert History reports you generate. Alert History and Alerts and Events displays reflect customized names. For information on changing Operations Manager event names using Notification Customization, see Customizing Events, page 15-26.

You can monitor all devices that Operations Manager supports, once you have added those devices using Device Management and ensured that the devices are in your view.


Note All Alert History reports generated from within the Alerts and Events display provide information from the past 24 hours. To generate an Alert History report on time spans beyond the last 24 hours, use Alert History from the Reports tab by selecting Reports > Alerts and Event History. For more information, see 24-Hour Context-Based Alert and Event History Reports, page 12-3.


Selecting Views for Alerts and Events

When you select Monitoring Dashboard > Alerts and Events to open the Alerts and Events display, all available views are listed in the view pane on the left side of the display. If the views shown do not meet your needs, you can create a new view as described in Managing Views, page 6-1.

The view pane is updated every two minutes. You can have up to 18 views in the view pane in a single Alerts and Events display. See Activating and Deactivating a View, page 6-2.

Filtering Alerts and Events

Filters allow you to manipulate the Alerts and Events display to show alerts based on their severity, status, and originating device.


Note Once you use an alert filter, the filter is applied to all of your views until you change the filter; other clients are not affected. When you close the Alerts and Events display, your filters are lost. Filters do not affect severity icons in the view pane.



Step 1 Select Monitoring Dashboard > Alerts and Events. The Alerts and Events display opens.

Step 2 Click the filtering button in the tool button area at the top-right of the Alerts and Events display.

Figure 3-1 shows the Alert Filters page. You can populate the Device Type box by selecting device types from the button to the right of the Device Type box. By default, all device types are selected.

Figure 3-1 Alerts and Events—Alert Filters Dialog Box

Step 3 To see all device types that you can filter, click the button to the right of the Device Type box. A Device Types popup window opens, as shown in Figure 3-2.

Figure 3-2 Alerts and Events—Device Types Dialog Box

Step 4 Verify that only the filtering criteria you want to use are selected.

Step 5 Click OK.


Resetting Filters on the Alerts and Events Display

From the Alerts and Events display, you can clear any filters that you have set. As a result, all alerts in the currently selected view are displayed.


Step 1 On the Alerts and Events display, click Reset Filter. A confirmation dialog box appears.

Step 2 Click Yes. The Alerts and Events display refreshes, displaying all alerts in the view.


Starting the Alerts and Events Display

To start the Alerts and Events display, select Monitoring Dashboard > Alerts and Events. Figure 3-3 shows an example of an Alerts and Events display.


Tip After you become familiar with the Alerts and Events display, you can edit the information it provides as described in Selecting Views for Alerts and Events and Filtering Alerts and Events.


Figure 3-3 Alerts and Events Display

1

View pane. See View Pane.

4

Window tools area. See Window Tools Area.

2

Launch information and view status bar area. See Launch Information and View Status Bar Area.

5

Command button area. See Command Button Area.

3

Tabular display pane. See Tabular Display Pane.

   

Understanding the Layout of the Alerts and Events Display

These topics provide details about the information in the Alerts and Events display.

View Pane

The view pane lists the currently available views. Views must be created and activated before they are shown in the Alerts and Events display. By default, two views—All Alerts and Suspended Devices—are always shown, and cannot be deleted from your Alerts and Events display. (To create and activate a view or remove an unwanted view from your display, see Managing Views, page 6-1.)

The current view is highlighted in the view pane. The contents of the current view are shown in the tabular display pane to the right of the view pane. To select another view, simply click the view name in the view pane.

Figure 3-4 shows four active views; the current view is All Alerts. Icons next to the views indicate the severity of the alerts received from devices in those views, signaling you that the devices may need attention.

Figure 3-4 Alerts and Events Display—View Pane and Severity Icons

For the current view, All Alerts, severity icons also appear next to the alerts in the tabular display, as shown in Figure 3-4, to help you quickly locate a specific alert.

The view pane is updated every two minutes. You can have up to 18 views in the view pane in a single Alerts and Events display.

Launch Information and View Status Bar Area

The launch information area shows the current time on the server when the Alerts and Events display is being viewed.

The view status bar lists the selected view, which is shown in the tabular display pane, and the number of alerts in that view.

Tabular Display Pane

The tabular display pane is the core of the Alerts and Events display. It contains a list of all alerts that are occurring on the devices in your current view. This pane is refreshed every 60 seconds. For an explanation of all of the items in the tabular display, see Getting Alert Details Using the Alerts and Events Display.

Icons alert you to what needs attention; for example:

The severity icons indicate which views and alerts require attention.

The diamond symbols in the Latest Event Time column indicate which alerts have experienced recent activity. When no diamonds appear in the Latest Event Time column, it indicates that the alert is older than 45 minutes. The presence of three stars indicates that the alert is older than 15 minutes; two stars that it is older than 30 minutes; and one star that it is older than one minute.

The tabular display pane is scrollable and can store up to 1,000 records.

Window Tools Area

The top-right corner of the Alerts and Events display contains available tools buttons. All buttons are described in Table 3-1.

Table 3-1 Alerts and Events Display—Window Tools Buttons 

Icon
Meaning
Described in...

Exports the current display to a PDF file.

Exporting Data from a Display or Report, page 1-21

Opens the Filter page, for refining the tabular display in the Alerts and Events display.

Filtering Alerts and Events

Opens a printer-friendly version for printing.

Printing Displays or Reports, page 1-22

Opens an Alert History report.

Understanding the Alert History Report, page 12-10

Opens the online help.

Using Help, page 1-18


Command Button Area

The command buttons on the Alerts and Events display provides you ways to respond to alerts and reset filters.

Table 3-2 Alerts and Events Display—Command Buttons 

Button
Action

Refresh

Refreshes the Alerts and Events display.

Reset Filters

Resets the filters set on the Alerts and Events display.

Clear

Clears the alert. See Clearing an Alert—Using the Alert Details Page.

Acknowledge

Changes the alert's status to Acknowledged. See Acknowledging an Alert—Using the Alert Details Page.

Close

Closes the Alerts and Events display.


Table 3-3 Alerts Details Page—Command Buttons 

Button
Action

Refresh

Refreshes the contents in the Alerts Details page manually.

Reset Filters

Resets the filters set on the Alerts and Events display.

Clear

Clears the alert. See Clearing an Alert—Using the Alert Details Page.

Acknowledge

Changes the event status to Acknowledged. See Acknowledging an Alert—Using the Alert Details Page.

Close

Closes the Alerts and Events display.


Getting Alert Details Using the Alerts and Events Display

Use the tabular display in the Alerts and Events display to obtain more information about the alerts that are occurring in your current view. In the tabular display, as shown in Figure 3-3, alerts are grouped by their severity: critical, warning, or informational. Within these severity groupings, or buckets, alerts with the latest change are listed first.

When an alert is generated, it remains in the Alerts and Events display until it cleared.  While the alert is in the display, if any events occur or get updated, the alert is updated. If a cleared event recurs, a new event with a new event ID is shown.


Note When using the Alerts and Events display, remember the following:

If a monitored device is removed from the network, it will continue to be in the Monitored state until the next inventory collection occurs, even though the device is unreachable. The only way that you will know that this device is unreachable, is when an unreachable alert appears for this device in the Alerts and Events display.

When a device becomes unresponsive, all existing events for that device become cleared and one unresponsive event is generated for the device.


Table 3-4 defines the Alerts and Events tabular display elements. All elements are updated every 60 seconds.


Tip You can generate a 24-hour Alert History report on all alerts that occurred on devices in your view by opening Alert History from the window tools area of the Alerts and Events display.


Table 3-4 Alerts and Events Tabular Display—Contents 

Heading
Description

 

Severity of alert

Critical

Warning

Informational/Unidentified Trap Alert

ID

Alert identifier number. Clicking this link opens an Alert Details page (see Starting the Alert Details Page).

Device Type

Type of device. Inventory Collection in Progress indicates that Operations Manager was discovering the device when the alert occurred. The actual device type is reflected when new events occur. The device type is displayed as N/A during inventory collection. For more information, see Using Device Management, page 16-1.

Device Name

Device name or IP address. Clicking this link opens the Detailed Device View (see Viewing Device Elements in Detail).

Alert Age

Time span since alert creation, depending upon alert status.

Latest Event Time

Date and time alert last occurred or was changed. Diamonds indicate alert activity, such as a new event, alert acknowledgement, new user annotation, and so forth; no diamonds indicates that the alert is stale. Alerts are grouped by severity, and within severities, alerts with the latest change are listed first.

Alert was updated within last 15 minutes.

Alert was updated within last 16-30 minutes.

Alert was updated within last 31-45 minutes.

No diamonds

Alert was updated 46 or more minutes ago.

Latest Event Category

Event category, one of the following: Application, Connectivity, Environment, Interface, Other, Reachability, and System Hardware. For alerts containing multiple events, the tabular display shows the category of the event with the most recent change.

Status

Alert status, based on last polling:

Active

Alert is live. (Note that alerts on suspended devices remain active; see Sending E-Mail in Response to an Alert.)

Cleared

Alert is no longer live.

Acknowledged

Alert was manually acknowledged by a user (from Alert Details page).


Getting Alert and Event Details

These topics address how to start and use the Alert Details page to get detail information on events:

Starting the Alert Details Page

Understanding the Layout of the Alert Details Page

Viewing Events Associated with an Alert

Viewing Event Details

Starting the Alert Details Page

The Alert Details page provides information about all of the events that were rolled up into a specific alert.


Note The Alert Details page can also be opened from the Service Level View. See Viewing Alert Information, page 2-21.



Step 1 Select Monitoring Dashboard > Alerts and Events. The Alerts and Events display opens.

Step 2 Locate the alert you want to investigate and click the alert ID. The Alert Details page opens.


Figure 3-5 Alert Details Page

1

Alerts status bar. See Alert Status Bar.

5

Tools column list. Select a tool, such as Event History. See Tools Column.

2

Launch information area. See Launch Information Area.

6

Command button area. See Command Button Area.

3

Tabular display pane. See Tabular Display Pane.

7

Notes pane. See Notes Pane.

4

Window tools area. See Window Tools Area.

   

Event Processing for the Alerts and Events Display During High CPU Utilization

During periods of high CPU utilization and alert buildup, Operations Manager stops processing events. This action is based on the maximum allowed event count settings. A message appears in the view status bar of the Alerts and Events display notifying you when this occurs. The message states that alert processing is being controlled, and not every alert is being displayed. An example of this type of message follows:

21 May 2009|12:16:03.984|ERROR|Event|EventBinder|EventBinder|processNormalizedEvent|null| Event Dropped for component: 172.25.109.221 ; Reason :-> Exceeded limit for eventStatus = Active

The excess Alerts and Events display events are written to the NMSROOT\logs\itemlogs\EPM\EPMDroppedEvents.log file, and these events:

Do not appear on the Alerts and Events display.

Are not stored in the Alerts and Events history database.

Are not sent out as notifications.


Note NMSROOT is the directory where Operations Manager is installed on your system. If you selected the default directory during installation, it can be entered as "C:\Program Files\CSCOpx" or C:\PROGRA~1\CSCOpx.


There are also cases when events may floodOperations Manager. If an event flood is detected, dropped events are logged in FloodDroppendEvents.log.

In the Alerts and Events display, the following message displays for the device warning about the event flood: All Alerts, X records (Alert processing is being controlled. For details, click here.). To view additional information about the flood, click on the hotlink or view the FloodDroppedEvents.log for details. For more information on event flooding, see Understanding Event Flooding Control, page E-67.

Understanding the Layout of the Alert Details Page

These topics provide details about the information on the Alert Details page. These panes are illustrated in Figure 3-5.

Alert Status Bar

The alert status bar lists details about the alert with which the listed events are associated. Table 3-5 explains the contents of the alert status bar area.

Table 3-5 Alert Details  Page—Alert Status Bar Contents 

Field
Description

Device Name

Device name or IP address.

Device

Device type.

Status

Alert status, based on last polling.

Active

Alert is live. (Note that alerts on suspended devices remain active; see Sending E-Mail in Response to an Alert.)

Cleared

Alert is no longer live.

Acknowledged

Alert was manually acknowledged by a user (from the Alert Details page).

Alert ID

Alert identifier number

Alert Age

Time span since alert creation, depending upon alert status:

Active or Acknowledged

Time span between alert creation and current server time.

Cleared

Time span between alert creation and Last Change time (the Last Change time may also represent when the alert was cleared).

Last Change

Time and date of last alert update (indicates activity, such as an event recurrence, alert acknowledgement, the addition of an annotation, and so forth). Alerts are grouped by severity, and within severities, alerts with the latest change are listed first.

Launch Tools

You can launch Operations Manager tools and external applications.

Alert Details—Opens the Alert Details page (see Starting the Alert Details Page).

Alert History—Opens an Alert History report (see Understanding the Alert History Report, page 12-10).

Associated Phones—Opens an Associated Phones report (see Viewing Associated Phones, page 2-22).

Detailed Device View—Opens a Detailed Device View for the device (see Starting the Detailed Device View).

Performance—Shows performance monitoring (see How to Use Performance Graphs, page 7-1).

Name of Synthetic Test—Opens the Create Synthetic Test page (see Creating Synthetic Tests, page 9-6). The options that appear depend on the device. For synthetic test details, see Getting Started with Synthetic Tests, page 9-1.

Node-To-Node Test—Opens the Node-To-Node Test Configuration page (see Creating a Single Node-To-Node Test, page 11-2).

SRST Test—Opens the SRST Test Configuration page (see Configuring a Single SRST Test as Needed, page 18-9).

Polling Parameters—Opens the Polling Parameters: Edit page (see Editing Polling Parameters, page 19-13).

Threshold Parameters—Opens the Managing Thresholds: Edit page (see Editing Operations Manager Thresholds, page 19-29).

Administrative Pages—Opens the administrative page of the device. The options that appear depend on the device; some examples are Gateway Administration, Unity Administration, Cisco Unified Communications Manager Serviceability, or Cisco Unified Communications Manager Trace Configuration.

Connectivity Details—Opens the Connectivity Detail View (see Working with the Connectivity Detail View, page 2-9).

Path Analysis Tool—Opens the Path Analysis Tool (see Launching the Path Analysis Tool, page 2-23).

Operations Manager Device Center—Opens the Device Center page of the Operations Manager Server (see Using Device Management, page 16-1).


Launch Information Area

The launch information area shows the current time on the server when the Alerts and Events display is being viewed.

Tabular Display Pane

On the Alert Details page, the tabular display pane contains a table that lists details about events. These events are associated with the alert listed in the alert status bar. You can refresh the display by clicking Refresh at the bottom of the pane. For an explanation of all of the items in the table, see Getting Alert and Event Details.

The tabular display is scrollable and can store up to 1,000 records. See Viewing Events Associated with an Alert for actions you can perform from this page.

Window Tools Area

The top-right corner of the Alert Details page contains a printer tool button and an Operations Manager Tools button, as described in Table 3-6.

Table 3-6 Alert Details Page—Window Tools Buttons

Icon
Meaning
Described in...

Opens a printer-friendly version for printing.

Printing Displays or Reports, page 1-22

Opens the Operations Manager online help.

Using Help, page 1-18


Tools Column

The tools column includes Alert History. Selecting Event History opens a 24-hour Event History report on the component. See 24-Hour Context-Based Alert and Event History Reports, page 12-3.

Notes Pane

The notes pane lists any alert annotations that users have entered. The notes pane is a convenient tool for making sure that all users see alert information. You can add an annotation by clicking the Annotate button. Adding an annotation is described in Annotating an Alert.

Command Button Area

In addition to the Annotate button in the notes pane, the command button area provides other ways to respond to alerts.

Table 3-7 Alert Details  Page—Command Buttons 

Button
Action

Refresh

Refreshes the tabular display.

Acknowledge

Changes the event status to Acknowledged. See Acknowledging an Alert—Using the Alert Details Page.

Clear

Clears the Alert. See Clearing an Alert—Using the Alert Details Page.

Notify

Sends e-mail notification of the alert. See Sending E-Mail in Response to an Alert.

Close

Closes the Alert Details page.


Viewing Events Associated with an Alert

Use the tabular display in the Alert Details page to obtain more information about all of the events associated with a specific alert. In the tabular display, as shown in Figure 3-6, events with the latest change are listed first.

Events remain on the Alert Details page until the parent alert expires.


Note If you suspend a device, all the events move to cleared state and not an active state. The alert also moves to cleared state.


If an event recurs, the existing event is not updated. Instead, the recurrence is shown as a new event with a new event ID.

Figure 3-6 provides an example of an Alert Details table. This table is refreshed every 60 seconds.

Figure 3-6 Alert Details Page—Tabular Display

Table 3-8 defines the table elements. Click Refresh at the bottom of the pane to refresh the table contents.


Tip Remember that you can generate a 24-hour Alert History report on all events that occurred on a selected component by opening Alert History from the window tools area of the Alerts and Events display.


Table 3-8 Alert Details Tabular Display—Contents 

Column
Description

Event ID

Event identifier number. Clicking this link opens the Event Details page (see Viewing Event Details). Note that this event ID is not the same as the event code provided by Notification Services. For more information, see Customizing Events, page 15-26.

Description

Operations Manager event name (as described in Events Processed, page E-1). You can also change the names of Operations Manager events to names that are more meaningful to you. For information on changing Operations Manager event names using Notification Customization, see Customizing Events, page 15-26.

Component

Device element on which the event occurred.

Time

Time at which the event occurred.

Status

Event status, based on last polling.

Active

Event is live. (Note that alerts on suspended devices remain active; see Sending E-Mail in Response to an Alert.)

Cleared

Event is no longer live.

Tools

Links to tools that allow you to perform additional tasks. For example:

Open an Event History report (see Understanding the Event History Report, page 12-12).

Performance (see How to Use Performance Graphs, page 7-1).

Edit threshold settings (see Editing Operations Manager Thresholds, page 19-29).


Viewing Event Details

The Event Details page provides additional details about the event, such as event name, component, reason for clearing (if available), values of MIB attributes at the time of the event, polling and threshold information, and utilization information. The Event Details page also provides ways to respond to events by adding annotations, acknowledging, or clearing the event.


Step 1 Select Monitoring Dashboard > Alerts and Events. The Alerts and Events display opens (see Figure 3-3).

Step 2 Locate the alert you want to investigate and click the alert ID. The Alert Details page appears (see Figure 3-5).

Step 3 Locate the event you want to investigate, and click the event ID. The Event Details page appears (see Figure 3-7).


Figure 3-7 shows a typical Event Details page.

Figure 3-7 Event Details Page

The information that is shown in the Event Details page depends on the event description. Table 3-9 describes the Event Details contents. Table 3-10 describes the Event Details page command buttons.

Table 3-9 Event Details  Page—Windows Contents 

Field
Description

Event Name

Event name.

Component

Device component responsible for the event.

Detail

Provides details on cluster, node, and event.

Reason for Clear (displays only with cleared events)

User cleared event from display

Displays when the event is cleared by a user.

User cleared alert from display

Displays when alert has been cleared by a user. All corresponding events for that alert move into the UserCleared state.

User suspended device

Displays when device is suspended by a user. All events for the alert for that device move into the Cleared state.


Note Some events are cleared due to a clear coming from underlying modules. These events will not display a Reason for Clear.


Aged event auto-cleared

Displays when the events are autocleared.

Cleared By

 

User responsible for event activity.

Cisco Unified Operations Manager

Displays only when the events are auto-cleared by Operations Manager.

More Info

Link to event details and recommended actions. See Supported Events, page E-2.


Table 3-10 Event Details  Page—Command Buttons 

Button
Action

Acknowledge

Changes the event status to Acknowledged. See Acknowledging an Event—Using the Alert Details Page.

Clear

Moves the event status to UserCleared. See Clearing an Event—Using the Alert Details Page.

Notify

This helps to send email. See Sending E-Mail in Response to an Alert.

Close

Closes the Alerts Details page.

Help

Opens the online help.

Annotate

Add details for other users about event information. See Annotating an Alert.


Getting Device Information

The Detailed Device View provides extensive information on the devices and device components listed in Starting the Detailed Device View. You can view information on devices that Operations Manager is currently monitoring, as well as devices whose monitoring you have suspended.

In the Detailed Device View, you can do the following:

View hardware and software information on system, environment, connectivity, and interface components

View hardware and software information on subcomponents of aggregate devices

View application status for Cisco Unified Communications Manager, Voice Services, Work Flow, and Synthetic Tests.

Suspend or resume management of a device or a device component so the device is no longer polled, or polling is resumed

Launch other Operations Manager tools

Starting the Detailed Device View

You can start the Detailed Device View from within the Alerts and Events display, either by clicking a device link, or by starting the Alert Details page and selecting Detailed Device View from the Launch Tools pull-down list.


Note The Detailed Device View page can also be opened from the Service Level View (see Viewing Device Information, page 2-22), as well as from several other locations in Operations Manager. In many reports or pages in Operations Manager, clicking a device name (that is blue) opens a Detailed Device View for the device.



Note You cannot display a Detailed Device View for unidentified trap devices. For more information on unidentified traps, refer to Processed SNMP Traps, page C-1.



Step 1 From the Alerts and Events display, click a device in the Device Name column. The Detailed Device View opens. (See Figure 3-8 for an example.)

Step 2 In the component categories pane, select an item from the device tree. The system information pane is populated with information about the selected item.

If the item you select is the subdevice of an aggregated device, the Detailed Device View displays the subdevice's managed state and device capability. To display a complete Detailed Device View of the subcomponent, click the Launch New DDV for This Device button.

Step 3 If you want to suspend a managed device so it is no longer polled and its traps are no longer processed (or if you want to resume a suspended device):

Click Suspend to change the device's managed state to Suspended. Operations Manager no longer polls any device components, nor does it process any traps. All events and corresponding alerts are moved to the Cleared state. The device alert is moved to the Suspended Devices view. Subsequent events (including traps) are ignored and no longer processed.

Click Resume to change the device's managed state to Active. Operations Manager resumes polling and trap processing on the device, and the device alert is moved out of the Suspended Devices view and back into its previous view.


Note When you resume a device, you must also perform the apply changes action in Polling and Thresholds (see Applying Changes, page 19-61).


Click Refresh to redisplay the page.


Figure 3-8 provides an example of a Detailed Device View.

Figure 3-8 Detailed Device View

1

Component categories pane. See Component Categories Pane.

4

Windows tool bar. See Window Tools Area.

2

System information pane. See System Information Pane.

5

Command button area. See Command Buttons Area.

3

Tools. See Launch Tools.

6

Record count. See Record Count.


Understanding the Layout of the Detailed Device View

These topics provide details about the information in the Detailed Device View.

Component Categories Pane

The component categories pane lists the components of the device or cluster. Selecting a component allows you to view detailed information pertaining to that component, such as CPU usage for a processor, TotalUsedMemory for memory, and so forth.

If the device you are viewing is an aggregate device, the subdevice also appears in the component categories pane. To display a complete Detailed Device View of the subcomponent, click the Launch New DDV for This Device button. This button appears after you select the subdevice from the device tree.

System Information Pane

The system information pane provides information such as the system name, IP address, SysUnified Communications ID, system contact, and so forth. Table 3-13 lists the Detailed Device View information you will see for each device type. See Viewing Device Elements in Detail.

If the system information pane lists an attribute with no value, it is because of one of the following reasons:

The attribute is not populated.

The attribute is not configured correctly.

The attribute does not apply to the device.

You can suspend or resume device or component monitoring by clicking the Suspend or Resume button (the button shown depends on the component's current managed state). These functions are described in these sections:

Suspending/Resuming Devices

Suspending/Resuming a Device Component

Launch Tools

The Launch Tools pull-down list enables you to launch other Operations Manager tools as well as external applications from the Detailed Device View. The tools that are available to you may vary depending on the device type and its configuration.

The following options can be seen in the Launch Tools menu:

Alert Details—Opens the Alert Details page (see Starting the Alert Details Page).

Alert History—Opens an Alert History report (see Understanding the Alert History Report, page 12-10).

Performance—Shows performance monitoring (see How to Use Performance Graphs, page 7-1).

Name of Synthetic Test—Opens the Create Synthetic Test page (see Creating Synthetic Tests, page 9-6). The options that appear depend on the device. For synthetic test details, see Getting Started with Synthetic Tests, page 9-1.

Node-To-Node Test—Opens the Node-To-Node Test Configuration page (see Creating a Single Node-To-Node Test, page 11-2).

SRST Test—Opens the SRST Test Configuration page (see Configuring a Single SRST Test as Needed, page 18-9).

Polling Parameters—Opens the Polling Parameters: Edit page (see Editing Polling Parameters, page 19-13).

Threshold Parameters—Opens the Managing Thresholds: Edit page (see Editing Operations Manager Thresholds, page 19-29).

Administrative Pages—Opens the administrative page of the device. The options that appear depend on the device; some examples are Gateway Administration, Unity Administration, or Communications Manager Serviceability.

Connectivity Details—Opens the Connectivity Detail View (see Working with the Connectivity Detail View, page 2-9).

Path Analysis Tool—Opens the Path Analysis Tool (see Launching the Path Analysis Tool, page 2-23).

Operations Manager Device Center—Opens the Device Center page of the Operations Manager Server (see Using Device Management, page 16-1).

Window Tools Area

The top-right corner of the Detailed Device View contains available tools buttons. All buttons are described in Table 3-11.

Table 3-11 Detailed Device View Page—Window Tools Buttons

Icon
Meaning
Described in...

Exports the current display to a PDF file.

Exporting Data from a Display or Report, page 1-21

Opens a printer-friendly version for printing.

Printing Displays or Reports, page 1-22

Opens the online help.

Using Help, page 1-18


Record Count

The record count lists the number of information types available on the device.

Command Buttons Area

In addition to the Suspend and Resume button in the system information pane, the command button area provides other ways to respond to alerts.

Table 3-12 Detailed Device View—Command Buttons

Button
Action

Suspend or Resume

Either activates or deactivates monitoring of the device. Only one option is available at a time, depending on the state of the device. See Suspending Device Monitoring.

Refresh

Refreshes the Detailed Device View page. (The Detailed Device View is not automatically refreshed; you must do so manually.)


Launch Information

The launch information shows the current time on the server when the Detailed Device View display is being viewed. If you refresh the page, the time is updated.

Viewing Device Elements in Detail

This topic explains what the Detailed Device View displays for different device classes.

Information Shown in the Detailed Device View


Note Unity Connection 2.1 ports are not monitored by Operations Manager. In the Detailed Device View the following Unity Connection port details are displayed as Not Available (N/A):


Total # of unity connection ports.

# of ports currently active.

# inbound ports.

# outbound ports.

# inbound ports currently active.

# outbound ports currently active.

Also, the left pane of the Detailed Device View does not display a Unity Connection Ports option.


Table 3-13 shows the types of device information displayed for the various device types that Operations Manager supports.

Table 3-13 Device Information Provided by the Detailed Device View 

Device Type
Status Reported by Detailed Device View
Device-Specific Components Reported by Detailed Device View
Subcomponents Reported by Detailed Device View 1
Environment
System
Interface
Connectivity
Application 2

Content Networking

 

X

X

       

Digital Voice Gateway

   

X

X

     

Gatekeeper

X

X

X

X

     

IPSLA

X

X

X

       

MRP

 

X

X

X

     

Personal Assistant

       

X

   

Media Server

X

X

X

 

X

Cisco Unified Communications Manager

Performance Counters3

 

Phone Access Switch

X

X

X

       

Probe

X

X

X

       

Routers

X

X

X

     

RSM, MSM, MSFC

SPE

 

X

   

X

   

SSP

 

X

X

       

Switch

X

X

X

     

RSM, MSM, MSFC

Unified Communications Manager or Cluster

           

Media Servers, Digital Voice Gateways,
Voice Gateways, VoiceMail Gateways

Unified Contact Center Enterprise (formerly IPCC)

X

X

X

 

X

Functional components:

CTI Gateway

CTI Unified Communications Server

Administrator Workstation

Logger

NIC

Unified CCE Components

Peripheral Gateway

Peripheral Interface Manager

Router

Performance Counters3

 

Unity

X

X

X

 

X

   

Unity Express

 

X

X

 

X

Performance Counters3

 

Voice Gateway

X

X

X

X

X

Cisco Unified Communications Manager Express, SRST-enabled
Cisco Unity Connection

IOS GW Performance Counters3

RSM, MSM, MSFC

VoiceMail Gateway

 

X

X

X

     

1 You can display a new Detailed Device View for each of these subcomponents.

2 Voice applications and synthetic testing.

3 For descriptions of the Performance Counters, see Performance Counters Shown in the Detailed Device View, page A-1.


The status categories—Environment, System, Interface, and so forth—list different entries depending upon the device class. The following are some examples of what you may see under the status categories:

Environment: Temperature, fan, power supply, voltage information.

System: Hard disk, RAM, processor, virtual memory information

Interface: Card, interface, port, voice port information


Note The Voice Port entry displays information for T1, E1, FXS, and FXO ports, as well as Ethernet and Gigabit Ethernet ports that have IP phones connected to them. When new Ethernet ports with phones connected to them are discovered, the Voice Port information is updated after a manual refresh of the Detailed Device View.


Connectivity: Cluster connectivity information such as cluster name, Cisco Unified Communications Manager status, Cisco Unified Communications Manager list, Active Cisco Unified Communications Manager

Application: Voice Services, Cisco Unified Communications Manager information

Suspending Device Monitoring

You can stop monitoring a device by selecting it and clicking the Suspend button in the Detailed Device View. Conversely, you can resume monitoring by clicking the Resume button. These actions are also available for suspending and resuming specific components. See these topics for more information:

Suspending/Resuming Devices

Suspending/Resuming a Device Component

Suspending/Resuming Devices

When you stop monitoring a device—changing its monitored state to false—Operations Manager no longer polls that device for information. Subsequent events (including traps) are ignored and no longer processed.

When you suspend a device, the active alerts and events on the device are moved to the Cleared state. Also, a Suspended event occurs on the device, which you can view in the device's Alert Details page. This happens to ensure that:

You cannot mistakenly remove important information from the display when you suspend a device (when alerts are cleared, they are removed from the Alerts and Events display).

You can easily resume the device.


Step 1 From the Alerts and Events display, start the view that contains your device. (Devices not managed are in the Suspended Devices view.)

Step 2 Click a device in the Device Name column. The Detailed Device View opens. Depending upon the managed state of the device, either the Suspend or the Resume button is shown.

Step 3 Do one of the following:

Click Suspend to change the device's managed state to Suspended. Operations Manager no longer polls any device components, nor does it process any traps. All events and corresponding alerts are moved to the Cleared state. The device alert is moved to the Suspended Devices view. Subsequent events (including traps) are ignored and no longer processed.

Click Resume to change the device's managed state to Active. Operations Manager resumes polling and trap processing on the device, and the device alert is moved out of the Suspended Devices view and back into its previous view.


Note When you resume a device, you must also perform the apply changes action in Polling and Thresholds (see Applying Changes, page 19-61).


Click Refresh to redisplay the page.


Figure 3-9 provides an example of the Detailed Device View for a suspended device. Note the Resume button at the bottom of the window.

Figure 3-9 Detailed Device View—Suspended Device

Suspending/Resuming a Device Component

You can unmanage or remanage device components using the Detailed Device View. When you unmanage a component—changing its managed state to false—Operations Manager no longer polls that component for information. Subsequent events (including traps) are ignored and no longer processed.


Note You cannot resume a device component if the parent device is suspended. You must resume the parent device first.



Step 1 From the Alerts and Events display, click a device in the Device Name column. The Detailed Device View opens.

Step 2 Select the component with the instance you want to unmanage.

Step 3 Locate the instance you want to unmanage, and make your change using the list in the Managed State column.

Step 4 Click Submit.


Figure 3-10 shows the location of the Managed State column for a managed application (Voice Services).

Figure 3-10 Editing the Managed State of a Device Component

Responding to Alerts

You can respond to alerts from either the Alerts and Events display or the Alert Details page.

From the Alerts and Events display you can clear or acknowledge an alert (see Responding to Alerts Using the Alerts and Events Display).

From the Alert Details page you can clear, acknowledge, or annotate an alert. Also, you can send an e-mail in response to an alert (see Responding to Alerts Using the Alert Details Page).

Responding to Alerts Using the Alerts and Events Display

The Alerts and Events Display provides command buttons in the bottom-right corner of the page for you to take action on alerts.

You can perform the following actions:

Clear an alert (see Clearing an Alert—Using the Alerts and Events Display).

Acknowledge an alert (see Acknowledging an Alert—Using the Alerts and Events Display).

Clearing an Alert—Using the Alerts and Events Display

Clearing an alert moves the alert to the Cleared state and all the events under it to the user cleared state. Cleared alerts are displayed minimum for 30 minutes and maximum for 60 minutes in the Alerts and Events display.

The alert is purged from database if there are no user cleared events present in the database. As a result, when the next event is raised for the same device, the alert ID remains the same. If all the events are in the cleared state then the alert is purged from the database. As a result, when the next event is raised for the same device, a new alert ID is generated.

When you clear an alert, this status change is populated to all Alerts and Events displays. Once an alert is cleared, the status cannot be changed back. To get the existing state of the events for that device, you must manually delete and re-add the device to Operations Manager. If any new event on the alert recurs, the status reverts to active.


Note The cleared alert is removed from the Alerts and Events display after Operations Manager performs its normal polling and determines that the alarm has been in the cleared state for 30 minutes or longer (from the time of polling). The maximum time that a cleared alert can be seen in the Alerts and Events display is 60 minutes.


Use this procedure to clear one or more alerts from the Alerts and Events display.


Step 1 From the Alerts and Events display, select one or more alerts by selecting check boxes for them.

Step 2 Click Clear. A confirmation dialog box appears.

Step 3 Enter your initials.

Step 4 Click OK. Operations Manager clears the selected alerts and refreshes the Alerts and Events display.


Acknowledging an Alert—Using the Alerts and Events Display

Acknowledging an active alert signals other users that you are aware of the alert. When you acknowledge an alert, this status change is populated to all Alerts and Events displays.

Use this procedure to acknowledge one or more alerts from the Alerts and Events display.


Step 1 From the Alerts and Events display, select one or more alerts by selecting check boxes for them.

Step 2 Click Acknowledge. A confirmation dialog box appears.

Step 3 Enter your initials.

Step 4 Click OK. The Alerts and Events display refreshes and the Status column displays acknowledged for the selected devices.


Responding to Alerts Using the Alert Details Page

The Alert Details page provides command buttons in the bottom-right corner of the page (see Figure 3-5). The Suspend button is discussed in Suspending Device Monitoring. This topic explains how you can perform the following actions:

Acknowledge an alert (see Acknowledging an Alert—Using the Alert Details Page).

Clear an alert (see Clearing an Alert—Using the Alert Details Page).

Annotate an alert (see Annotating an Alert).

Send e-mail in response to an alert (see Sending E-Mail in Response to an Alert).

Acknowledging an Alert—Using the Alert Details Page

Acknowledging an active alert signals other users that you are aware of the alert. When you click the Acknowledge button on the Alert Details page, the alert is acknowledged. To acknowledge all of the events, open the alert, check the Select All check box, and click Acknowledge.

If an event on the alert recurs, the alert status reverts to active.


Step 1 From the Alert Details page, select one or more alerts by selecting check boxes for them.

Step 2 Click Acknowledge. A confirmation window opens.

Step 3 Click OK. In the Alerts and Events display the Status column displays acknowledged for the selected devices.


Clearing an Alert—Using the Alert Details Page

Clearing all active events under an alert changes the alert state in the Alerts and Events display to cleared. You may want to clear an alert when you are receiving erroneous events or are no longer interested in receiving that event. Cleared alerts are displayed minimum for 30 minutes and maximum for 60 minutes in the Alerts and Events display.

The alert is purged from database if there are no user cleared events present in the database. As a result, when the next event is raised for the same device, the alert ID remains the same. If all the events are in the cleared state then the alert is purged from the database. As a result, when the next event is raised for the same device, a new alert ID is generated.

When you click the Clear button after selecting all the events in Alert Details page, the status change is populated to all Alerts and Events displays. The alert status moves into the Cleared state, and the events move into the user cleared state. Once an alert is cleared, the status cannot be changed back. To get the existing state of the device, you must manually delete and re-add the device to Operations Manager.


Note The cleared alert is removed from the Alerts and Events display after Operations Manager performs its normal polling and determines that the alarm has been in the Cleared state for 30 minutes or longer (from the time of polling).


If an event on the alert recurs, the status reverts to Active.


Step 1 From the Alert Details page, select one or more alerts by selecting check boxes for them.

Step 2 Click Clear. A confirmation window opens.

Step 3 Click OK.


Annotating an Alert

You can annotate an alert by clicking the Annotate button. An editable Annotation dialog box opens; in the dialog box, you can enter up to 255 characters. Any number of annotations can be entered. An annotation is shown whenever other users view the alert from an Alert or Event Details page.


Step 1 From either the Alert or Event Details page or the Event Details page, make a selection on what to annotate and click Annotate. The Annotation dialog box opens.

Step 2 Enter your text. Text that exceeds 255 characters is truncated without warning. (If this happens, you can add another annotation.)

Step 3 Click OK. The annotated text is displayed in the Notes box.


Sending E-Mail in Response to an Alert

When you click the Notify button in an alert details page (for an alert on a device), Operations Manager opens a dialog box that you can complete to manually send an e-mail notification to multiple recipients. The e-mail notification adds the event/alert details for the selected event. (If you want to send automatic e-mail notifications when alerts or events occur on certain devices, use Notification Services to set up an e-mail notification subscription. (See Configuring Notifications, page 15-7.)


Step 1 From the Alert Details page (either for a device alert or a service quality alert), click Notify. The E-mail Notification Recipient(s) dialog box opens.

Step 2 Enter a fully qualified DNS name or IP address for an SMTP server.

Step 3 Enter your e-mail address in the Sender Address field.

Step 4 Enter a comma-separated list of e-mail addresses in the Recipient Address(es) field.

Step 5 Enter a subject heading in the Header field.

Step 6 (Optional) Enter a message in the Message field.

Step 7 Click Send.


Responding to Events

You can respond to events from either the Alert Details page or the Event Details page.

From the Alert Details page you can clear, acknowledge, or annotate an alert. Also, you can send an e-mail in response to an alert (see Responding to Events Using the Alert Details Page).

From the Event Details page you can clear, acknowledge or annotate an alert (see Responding to Events Using the Events Details Page).

Responding to Events Using the Alert Details Page

The Alert Details page provides command buttons in the bottom-right corner of the page (see Figure 3-5). The Suspend button is discussed in Suspending Device Monitoring. This topic explains how you can perform the following actions:

Acknowledge an event (see Acknowledging an Event—Using the Alert Details Page).

Clear an event (see Clearing an Event—Using the Alert Details Page).

Annotate an event (see Annotating an Alert).

Send e-mail in response to an event (see Sending E-Mail in Response to an Event).

Acknowledging an Event—Using the Alert Details Page

Acknowledging an event signals to other users that you are aware of the event and are working on it.

After the issue gets resolved, it moves to the Cleared state. Cleared events should not be Acknowledged.


Step 1 From the Alert Details page, do one of the following:

To acknowledge all of the events, open the alert, check the Select All check box.

To acknowledge a single event, select the check box next to the event.

To acknowledge multiple events, select the check boxes for the events.

Step 2 Click Acknowledge. A confirmation window opens.

Step 3 Click OK. In the Alerts and Events display the Status column displays Acknowledged for the selected devices.


Clearing an Event—Using the Alert Details Page

Clearing an event changes the alerts state in the Alerts and Events display to user cleared. When the issue is resolved, the event is moved to the cleared state.

User cleared events do not move to the active state directly. Any subsequent active events are suppressed. If you manually clear an event it signals that you are no longer interested in receiving that event.

Once an event is cleared, the status cannot be changed back. To get the existing state of the device, you must manually delete and re-add the device to Operations Manager. User cleared events are displayed for 30 minutes.


Note The cleared alert is removed from the Alerts and Events display after Operations Manager performs its normal polling and determines that the alarm has been in the Cleared state for 30 minutes or longer (from the time of polling).


If an event on the alert recurs, the status reverts to Active.


Step 1 From the Alert Details page, do one of the following:

To clear all of the events, open the alert, check the Select All check box.

To clear a single event, select the check box next to the event.

To clear multiple events, select the check boxes for the events.

Step 2 Click Clear. A confirmation window opens.

Step 3 Click OK.


Annotating an Event

You can annotate an alert or an event by clicking the Annotate button. An editable Annotation dialog box opens; in the dialog box, you can enter up to 255 characters. Any number of annotations can be entered. An annotation is shown whenever other users view the alert from an Alert or Event Details page.


Step 1 From either the Alert or Event Details page, do one of the following:

To annotate all of the events, open the alert, check the Select All check box.

To annotate a single event, select the check box next to the event.

To annotate multiple events, select the check boxes for the events.

Step 2 Click Annotate. The Annotation dialog box opens.

Step 3 Enter your text. Text that exceeds 255 characters is truncated without warning. (If this happens, you can add another annotation.)

Step 4 Click OK. The annotated text is displayed in the Notes box.


Sending E-Mail in Response to an Event

When you click the Notify button in an alert details page (for an alert on a device), Operations Manager opens a dialog box that you can complete to manually send an e-mail notification to multiple recipients. The e-mail notification adds the event/alert details for the selected event. (If you want to send automatic e-mail notifications when alerts or events occur on certain devices, use Notification Services to set up an e-mail notification subscription. (See Configuring Notifications, page 15-7.)


Step 1 From the Alert Details page (either for a device alert or a service quality alert), do one of the following:

To email notifications for all of the events, open the alert, check the Select All check box.

To email notification for a single event, select the check box next to the event.

To email notification for multiple events, select the check boxes for the events.

Step 2 Click Notify. The E-mail Notification Recipient(s) dialog box opens.

Step 3 Enter a fully qualified DNS name or IP address for an SMTP server.

Step 4 Enter your e-mail address in the Sender Address field.

Step 5 Enter a comma-separated list of e-mail addresses in the Recipient Address(es) field.

Step 6 Enter a subject heading in the Header field.

Step 7 (Optional) Enter a message in the Message field.

Step 8 Click Send.


Responding to Events Using the Events Details Page

The Events Details page provides command buttons in the bottom-right corner of the page (see Figure 3-7). This topic explains how you can perform the following actions:

Acknowledge an event (see Acknowledging an Event—Using the Alert Details Page).

Clear an event (see Clearing an Event—Using the Alert Details Page).

Close an event (see Closing the Event Details Page).

Annotate an event (see Annotating an Event).

Acknowledging an Event—Using the Event Details Page

Acknowledging an event signals to other users that you are aware of the event and are working on it.

After the issue gets resolved, it moves to the Cleared state. Cleared events should not be Acknowledged.


Step 1 From the Events Details page, click Acknowledge. A confirmation window opens.

Step 2 Click OK. In the Alerts and Events display the Status column displays Acknowledged for the selected devices.


Clearing an Event—Using the Events Details Page

Clearing an event changes the alerts state in the Alerts and Events display to user cleared. When the issue is resolved, the event is moved to the cleared state.

User cleared events do not move to the active state directly. Any subsequent active events are suppressed. If you manually clear an event it signals that you are no longer interested in receiving that event.

Once an event is cleared, the status cannot be changed back. To get the existing state of the device, you must manually delete and re-add the device to Operations Manager. User cleared events are displayed for 30 minutes.


Note The cleared alert is removed from the Alerts and Events display after Operations Manager performs its normal polling and determines that the alarm has been in the Cleared state for 30 minutes or longer (from the time of polling).


If an event on the alert recurs, the status reverts to Active.


Step 1 From the Events Details page, click Clear. A confirmation window opens.

Step 2 Click OK.


Closing the Event Details Page

To close the Event Details page, click Close.