User Guide for Cisco Unified Operations Manager 8.6
Fault Monitor
Downloads: This chapterpdf (PDF - 1.26MB) The complete bookPDF (PDF - 16.0MB) | Feedback

Using Fault Monitor

Table Of Contents

Using Fault Monitor

Using Fault Monitor

Understanding Fault Monitor

Fault Monitor Window Components

Understanding the Layout of Fault Monitor and Events Displays

Understanding the Group Selector

Fault Summary Tab

Events Tab

Tools Selector in Fault Monitor

Accessing Device and Event Data Using Fault Monitor

Selecting Device Groups in Fault Monitor

User Settings in Fault Monitor

Filtering Events or Devices

Filtering Using the Devices Subpane Filter

Filtering Using the Events Filter

Resetting Filters on the Fault Monitor Display

Accessing Details Windows from Fault Monitor Tabs

Viewing Device Event Summary Data using Fault Summary Tab

Acknowledging an Event Using the Fault Summary Tab

Clearing an Event Using the Fault Summary Tab

Annotating an Event Using the Fault Summary Tab

Sending E-Mail in Response to an Event Using the Fault Summary Tab

Taking Action on Event Data Using the Event Tab

Acknowledging an Event Using the Fault Monitor Events Tab

Clearing an Event Using the Fault Monitor Events Tab

Annotating an Event Using the Fault Monitor Events Tab

Sending E-Mail in Response to an Event Using the Fault Monitor Events Tab

Selecting Events on the Events Tab

Setting up Custom Email Notification

Enabling Custom Email Notification

Disabling Custom Email Notification

How Events are Handled

How to Use the Fault Monitoring Dashboard

Changing Fault Summary Column Displays

Getting Device and Event Details

Accessing the Events Details Page

Event Processing for the Events Display During High CPU Utilization

Understanding the Layout of the Event Details Page

Viewing Events Associated with an Device

Viewing Event Details

Troubleshooting Tips


Using Fault Monitor


Fault Monitor is a a real-time dashboard that displays event information on device types, clusters, phones, unmanaged, unreachable, and suspended devices.


Tip While previous releases monitored alerts as well as events, the concept of monitoring alerts are not in this release to allow for quicker access to event information and troubleshooting tools. Service Quality events relevant to Cisco Unified CM Express are available by selecting
Administration > System Settings > Miscellaneous > Service Quality Alerts.


These topics describe how to use Fault Monitor:

Using Fault Monitor

Understanding Fault Monitor

Accessing Device and Event Data Using Fault Monitor

How Events are Handled

How to Use the Fault Monitoring Dashboard

Getting Device and Event Details


Timesaver To view the online video tutorial for Fault Monitor, see Cisco.com or click on the E-learning icon in the online help.


Using Fault Monitor

Fault Monitor is the default tool that displays after logging into Operations Manager. Figure 4-1 shows an example of a Fault Monitor display.

Fault Monitor first displays the Fault Summary subpane. The Fault Summary subpane has the device details and the events associated with the first device.

For more details on filtering, see Filtering Events or Devices or Selecting Device Groups in Fault Monitor. You can also set up a customized email notification to allow third-party tools to track events. For details, see Setting up Custom Email Notification.

You can also display Fault Monitor in a separate, detached window so that you can view the Unified Dashboard with the specific Diagnostics portlets of your choosing. This allows you to keep Fault Monitor on the screen, along with other Operations Manager tools, to diagnose network issues as they arise. To open Fault Monitor in a separate window, select Tools > Detach Fault Monitor.


Tips After you become familiar with the Fault Monitor display, you can edit the information it provides as described in Selecting Device Groups in Fault Monitor and Filtering Events or Devices.


Understanding Fault Monitor

This section covers the following topics:

Fault Monitor Window Components

Understanding the Layout of Fault Monitor and Events Displays

Selecting Device Groups in Fault Monitor

Filtering Events or Devices

Fault Monitor Window Components

Fault Monitor consists of three main components (see Figure 4-1):

Group Selector—Uses groups to provide easy access to devices, clusters, phones, and unidentified traps. Also provides information on the number of critical, warning and informational events for each group. See Understanding the Layout of Fault Monitor and Events Displays.

Fault Summary tab which contains the Devices and Events sub-panes. You can filter using the Device filter or Event filter in each subpane. See Filtering Events or Devices.

Events tab—Provides event details when first displayed for All Devices and focused group events, based on user selections. If there are filters configured per user, then the devices and events will display dependent on the filter.

Figure 4-1 Fault Monitor

1

Group Selector. Shows all system and user-defined devices. Includes severity levels in parentheses to indicate the numbers of event types for each severity (Critical, Warning, and Information).

For example, All Devices (C:16,W:0,I:0) indicates there are 16 critical and zero warning and informational events. See Understanding the Group Selector.

5

Events panel. Displays events on the selected device or cluster.

See Understanding the Layout of Fault Monitor and Events Displays.

2

Fault Summary tab. Provides a summary of devices selected in the group selector.

If a device is selected, its events are displayed in the Events Panel. See Fault Summary Tab.

6

Search field. Options for searching include: Device and Phone (by extension, IP address, or MAC address).

3

Event tab. Provides a summary of the events of the selected group. 200 events can be supported in the Events tab. See Events Tab.

7

Tools selector. Depending on the window, other Operations Manager or network management applications display. See Tools Selector in Fault Monitor.

4

Device information for Fault Summary in a tabular display. See Understanding the Layout of Fault Monitor and Events Displays.

8

Command Button Area. Includes Refresh, Print, Export, and Settings. See Table 4-8.


Understanding the Layout of Fault Monitor and Events Displays

These topics provide details about the information in the Fault Monitor. These panes are illustrated in Figure 4-1.

Understanding the Group Selector

Fault Summary Tab

Events Tab

Tools Selector in Fault Monitor

There may be unexpected results in Fault Monitor if unsupported special characters appear in fields that display in Fault Monitor displays and reports. See Supported Special Characters List, page 1-20 for details on what characters are supported in Operations Manager.

Understanding the Group Selector

The group selector shows logical groupings of device types, clusters, phones, unmanaged devices, unreachable devices and suspended devices that appear in Fault Monitor in a tree-based format. For enterprise deployments, the groups include all system-defined groups for Common Services and Operations Manager, as well as user-defined groups. For multiple end-customer deployments, the groups include all Operations Manager groups (including customer names if added during manual device creation).

Each group includes an icon that indicates the highest severity level in that group, as well as the number of events for each severity level: Critical (C), Warning (W), and Informational (I). For example, Communications Manager Express (C:3, W:0, I:0) indicates three active or acknowledged critical events and would include a critical (red) icon in front of the CME group name. These counts do not include cleared and user cleared events.

Whenever you create a new user-defined group in the Group Administration and Configuration page (see Using Group Administration and Configuration, page 9-11), a corresponding view is created.

After you decide how you want to cluster your devices into a logical set, create and activate a view of these groups so they are shown in the Fault Monitor displays. You can edit groups only by changing the corresponding user-defined group.

After the user-defined group is edited, the corresponding group is updated automatically in the Fault Monitor. The maximum delay time for updates in Fault Monitor is 15 seconds.

By default, specific groups available in Operations Manager. For group descriptions, see Table 4-1. These groups are static and cannot be edited, deactivated, or deleted.

These group show events for the devices as mentioned in Table 4-1.

Table 4-1 Default Groups in Fault Monitor

Group Name
Description

System-Defined

Predefined list of groups in Fault Monitor.

User Defined

Groups you create.

Unreachable

Predefined group that contains devices which are unreachable by discovery or unavailable. This may be because of insufficient device credentials.

See Editing Device Configuration and Credentials, page 8-34.

Unmanaged

Predefined group that are unavailable to Operations Manager (for devices that are not added in Operations Manager).

Suspended

Predefined group that has devices in Suspended state.


The current group is highlighted in the group selector. To select another group, click the group name in the group selector.

Figure 4-2 shows the Fault Monitor group selector.

For example, in Figure 4-2 the All Devices and System Defined groups contain the event summary of 142 critical, 9 warning, and 10 informational events as follows (C:142,W:9,I:10). Icons next to the views indicate the highest level severity of the active and acknowledged events received from devices in those groups. This indicates that the devices may need attention.

To open a group, select the small triangle that appears in front of the group name. Additional groups or devices display and can be selected for viewing in Fault Summary or Events tabs.

Figure 4-2 Fault Monitor Group Selector

For the current view, All Devices, severity icons also appear next to the events in the tabular display, as shown in Figure 4-1, to help you quickly locate a specific event.

You can perform the following tasks in the Group Selector:

Select device types, cluster, phone, Unreachable devices, Unmanaged devices or Suspended devices for viewing in Fault Monitor tabular displays

Widen view pane for viewing

View system or user defined groups

View Common Services (available only in enterprise deployments)

View Operations Manager groups

View Critical, Warning, and Informational event count totals

You can add user-defined groups using the Device Configuration page. For details, see Managing Groups, page 9-1. Unreachable, unmanaged and suspended devices are added automatically.

For descriptions of icons and command buttons in Fault Monitor, see Table 4-2.

Table 4-2 Fault Monitor Icons and Command Buttons

Icon Name
Description

Severity of event.

Status of event.

Acknowledge

Changes the event's status to Acknowledged.

See Acknowledging an Event Using the Fault Summary Tab or Acknowledging an Event Using the Fault Monitor Events Tab.

UserClear

Clears the event.

See Clearing an Event Using the Fault Summary Tab or Clearing an Event Using the Fault Monitor Events Tab.

Autoclear

Signifies Operations Manager has cleared this event. A green tick mark indicates that the user has cleared the event. A red tick mark indicates the autoclear has occurred within the last 15 minutes.

Annotate

Add details for other users acknowledging event status. Available only for events.

See Annotating an Event Using the Fault Summary Tab or Annotating an Event Using the Fault Monitor Events Tab.

Notify

Send email to specified user about the selected event.

See Sending E-Mail in Response to an Event Using the Fault Summary Tab or Clearing an Event Using the Fault Monitor Events Tab.

Event has occurred within the last 15 minutes.

Critical event.

Warning event.

Informational event.

Filter.


Fault Summary Tab

The Fault Summary tab contains two subpanes: Devices and Events. The initial display includes All Devices. After you select the tree node in the group selector, the Devices pane refreshes with devices belonging to that group that have events.

The events that correspond to the selections appear in the Events subpane. Devices and events are sorted based only on time, not on severity. The most recent activity appears first. This pane is refreshed when updates are received, but may have a maximum delay of 15 seconds.

For an explanation of all of the items in the tabular display, see Table 4-3.

Icons alert you to what needs attention; for example:

The severity icons indicate the views and events that require attention.

The alarm clock symbol in the Last 15 Minutes column indicates the events that have experienced recent activity. When a symbol does not appear in this column, it indicates that the event is older than 15 minutes. A symbol indicates that the event is less than 15 minutes old.

The tabular display pane is scrollable and can store up to 200 records. For a description of the Fault Summary tab, see Table 4-3. For a description of the command buttons, see

Table 4-3 Fault Summary Tab Contents 

Icon
Field
Description
 
Devices panel

Severity

Event status icon. Indicates the severity of the event.

Last 15 Minutes

Indicates that this device is one of the most recent in the table (within the last 15 minutes). Devices are sorted based on the time of the most recent event status changes.

 

Device Name

Device name or IP address. This hyperlink displays the Device Details hover over window.

 

Device IP

Device IP.

 

Type

Device type.

Status columns

Critical—Total number of critical events.

Warning—Total number of warning events.

Information—Total number of informational events.

 

Last Updated Time

Time and date of event update (indicates activity, such as an event recurrence, event acknowledgement, the addition of a note, and so forth). Events are grouped by severity, and within severities, events with the latest change are listed first.

 
Events Panel
 

Selection box

Allows you to select an event on which to take action.

Severity

Event status icon. Indicates the severity of the event.

 

Status

Shows whether the event has been Acknowledged, Autocleared or User Cleared.

Clipboard icon/Is Annotated

Indicates this event has user notations. Only event annotation is supported.

 

Event Name

Identifies event name. Events are sorted based on the time of the most recent event status changes. This hyperlink displays the Event Details window.

 

Device Name

Device name or IP address. This hyperlink displays the Device Details window.

 

Device IP

Device IP.

 

Component Name

Device component name.

 

Last Updated Time

Date and time event was last updated.


Events Tab

The Events tab in the Fault Monitor page is described in Table 4-4. The Events Tab contains the same information as the Event Details page displayed from the Diagnostic Views.

Table 4-4 Events Tab Contents 

Icon
Field
Description
 

Selection box

Allows you to select an event on which to take action.

Severity

Event status icon. Indicates the severity of the event.

 

Status

Shows whether the event has been Active, Acknowledged, Autocleared or Usercleared.

Clipboard icon/Is Annotated

Indicates this event has user notations. Only event-level annotation is supported. Annotation is a tool to ensure that all users see event information. You can add an annotation by clicking the Annotation button.

Adding an annotation is described in Acknowledging an Event Using the Fault Monitor Events Tab or Acknowledging an Event Using the Fault Summary Tab.

 

Event Name

Identifies event name. This hyperlink displays the Event Details hover over window.

 

Device Name

Device name or IP address. This hyperlink displays the Device Details window.

 

Device IP

Device IP.

 

Component Name

Device component name.

 

Last Updated Time

Date and time event was last updated.


Tools Selector in Fault Monitor

The top-right corner of the Fault Monitor display contains the Tools selector. The Detach FM tool is the only tool option for Fault Monitor.

Detach Fault Monitor is the Fault Monitor tool that displays in a separate window that is detached from the Operations Manager dashboard. This allows you to view various portlets along with the Fault Monitor in order to diagnose network problems.

Accessing Device and Event Data Using Fault Monitor

Fault Monitor consolidates all events in one unified dashboard. Fault Monitor displays most events individually, but instead of displaying service quality events individually, Fault Monitor groups service quality events together (or aggregates them) based on criteria you set in Operations Manager threshold settings.

The new method of displaying service quality events may not fit your needs, so the existing Service Quality Alerts Display is still available by selecting Administration > System Settings > Miscellaneous > Service Quality Alerts.

The following topics discuss how to use Fault Monitor:

Selecting Device Groups in Fault Monitor

Filtering Events or Devices

Accessing Details Windows from Fault Monitor Tabs

Viewing Device Event Summary Data using Fault Summary Tab

Taking Action on Event Data Using the Event Tab

Setting up Custom Email Notification

Selecting Device Groups in Fault Monitor

Fault Monitor displays all available device groups in the group selector on the left side of the display. If the group shown does not meet your needs, you can create a new device group as described in Managing Groups, page 9-1.

The group selector view page is updated automatically whenever the events or devices are changed or when the view pane is refreshed. You can have up to 18 user-defined groups supported in the group selector in the Fault Monitor display.

To navigate down to an object or device in the group selector, click the triangle to open the object; the devices under the object display.

To view groups of devices in Fault Monitor, select the object name in the view pane. The devices are updated in the Fault Summary and Events tabs.

To expand the group selector to view group names and event counts, use the scroll bar at the bottom of the selector pane.


Note If you want to locate a specific device or phone, you can use the search options available in the view pane. Figure 4-1 shows an example of the view pane.


For a description of how the group selector works, see Understanding the Group Selector.

User Settings in Fault Monitor

Fault Monitor window has two levels of user settings:

Settings that remain even after you log off of Operations Manager. See Settings Across Login Sessions.

Settings that are remembered only during a single login. See Settings Retained During Your Login Session.

Settings Across Login Sessions

The following settings are saved in Fault Monitor for each user, across login sessions:

Devices subpane Filter settings in Fault Summary tab. See Filtering Using the Devices Subpane Filter.

Events subpane Filter settings in Fault Summary tab. See Filtering Events or Devices.

Events tab Filter settings. See Filtering Events or Devices.

Group selector tree. See Selecting Device Groups in Fault Monitor.

Operations Manager remembers these settings and returns you to the screen that you were on, at your last visit to Fault Monitor.

Settings Retained During Your Login Session

These settings are saved during a single login session:

Sorting settings (Devices subpane, Events subpane, and Events tab).

A device selected in the Devices subpane.

Your tab selection: Fault Summary or Events tab.

Operations Manager remembers these settings during your login session but after you log off, any device or tab settings are reset to the settings that you had, on your last visit to Fault Monitor. See Settings Across Login Sessions.

Filtering Events or Devices

Filters in Fault Monitor allow you to manipulate the displays to show events, based on their severity, status, originating device, and dates.

There are several ways to filter device data in Fault Monitor:

Operations Manager Search tool. See Using the Search Tool to Locate a Device, page 1-29 and Using the Search Tool to Locate a Phone, page 1-29.

Group selector. See Selecting Device Groups in Fault Monitor.

Devices subpane Filter button in Fault Summary tab. See Filtering Using the Devices Subpane Filter.

Events subpane Filter button in Fault Summary tab. See Filtering Events or Devices.

Events tab Filter button. See Filtering Events or Devices.

To understand what settings and filters are saved during or across login sessions, see User Settings in Fault Monitor.

Filtering Using the Devices Subpane Filter

You can filter using the Devices subpane Filter button in the Fault Summary tab. The devices that display in this subpane are filtered based on your selections in the group selector and only include devices with critical event status. If All Devices is selected, the Devices subpane includes all network device with critical event status.


Step 1 You can:

a. Select a specific device group and the Devices subpane displays only the devices in this group.

b. Select a single device and the Events subpane displays only the events for this device. If you want to filter by events, use the Events subpane filter. See Filtering Using the Events Filter.

or

c. Click Filter in the Device subpane of the Fault Summary tab to devices by name, IP address, device type, or date,

A Device Filter popup window opens.

Step 2 Enter information by which you want to filter.

Name
Description

Device Name

You can use wildcards such as * and ?.

Device IP

You can use wildcards such as * and ?.

Device Type

Select from drop-down selector.

Date

None or specified date.

Customer Name

You can enter the customer name in the text field.


Step 3 Click Apply Filter.

To reset your current selections in the popup, click Reset.

To clear any filters that you have set in Fault Monitor, click the X next to the Filter (On) indicator.

The displays are reset with all viewable data.


Filtering Using the Events Filter

There are two ways to filter events:

Select a device first and filter events in the Events subpane.

Select an event from the Events tab.

Filtering Device Events from Fault Summary

You can filter which events are displayed in Fault Monitor. The events filtered are based on your selections in the group selector and Devices subpane.


Step 1 Select the device group in the group selector.

Step 2 Select a device in the Fault Summary tab.

The Events subpane updates displaying only events from the selected device.

Step 3 Click Filter in the Events subpane.

The Events Filter popup window opens.

Step 4 Enter information by which you want to filter.

Name
Description

Event Name

You can use wildcards such as * and ?.

Severity

Select from drop-down selector.

Status

Select from drop-down selector.

Device Name

You can use wildcards such as * and ?.

Device IP

You can use wildcards such as * and ?.

Date

None, last, specified date, or range of dates.


Step 5 Click Apply Filter.

To reset your current selections in the popup, click Reset.

To clear any filters that you have set in Fault Monitor, click the X next to the Filter (On) indicator.

The displays are reset with all viewable data.


Filtering from All Events

You can filter using the Events tab Filter button. The events filtered will be based on your selections in the group selector and Devices subpane.


Step 1 Select All Devices in the group selector if you want to filter all events.

To filter devices by name, IP address, date, event name, severity or status, click Filter in the Events subpane of the Fault Summary tab or Events tab.

The Events Filter popup window opens.

Step 2 Enter information by which you want to filter.

Name
Description

Event Name

You can use wildcards such as * and ?.

Severity

Select from drop-down selector.

Status

Select from drop-down selector.

Device Name

You can use wildcards such as * and ?.

Device IP

You can use wildcards such as * and ?.

Last Updated

None, specified range (x hours, days, weeks, months), specified date, or range of dates.


Step 3 Click Apply Filter.

To reset your current selections in the popup, click Reset.

To clear any filters that you have set in Fault Monitor, click the X next to the Filter (On) indicator.

The displays are reset with all viewable data.


Resetting Filters on the Fault Monitor Display

A filter is active when Filter (On) indicator displays in the windows button bar. To clear any filters that you have set in Fault Monitor, click the X next to the Filter (On) indicator. As a result, all events in the currently selected view are displayed.

Accessing Details Windows from Fault Monitor Tabs

You can display device and event details from the Fault Monitor window by hovering over the icon next to the device or event name for several seconds.

Device Details

From the Fault Monitoring dashboard, hover over a device name to display a radio button. You can click on the radio button or hover over it to display Device Details (brief device information) in a hover over window.

There is a action link to cross launch Detailed Device View, as well as other actions. For more details on action links, see Taking Action on Event Data Using the Event Tab.

For a description of the Device Details window, see Table 4-5.

Figure 4-3 Device Details Hover Over Window

Table 4-5 Device Details Hover Over Window 

Field
Description

Device Name

Device name or IP address.

Device IP

Device IP.

Managed State

State of the device.

Last Discovered Time

Time and date of device was last discovered.

Capabilities

Functions that a device can perform; for example, switch, voice gateway, Cisco Unified Communications Manager, Host, and so on.

Platform

Server hardware information.

Local IP Address

NAT-enabled device IP address.

Local DNS Name

NAT-enabled device domain name.

Actions

You can launch Operations Manager tools and external applications. The options available are dependent on the device. All options do not appear. For a list of actions, see Actions (Tools You Can Use to Perform Tasks), page 8-49.


Event Details

From the Fault Monitoring dashboard, hover over a event name to display a radio button. You can click on the radio button or hover over it to display Event Details (brief event information) in a hover over window. It contains an action link to cross launch Event HistoryTable 4-5.

You can perform the following tasks from the Events Details window (see Figure 4-4):

View more information about Recommended Actions by clicking on the Click Here link.

Click on the action link to cross launch Event History.

For details about the Event Details window in Fault Monitor, see Event Details Hover-Over Window.

Figure 4-4 Event Details Access from Events Panel

Table 4-6 Event Details Hover-Over Window 

Field
Description

Event ID

Event identifier number. Note that this event ID is not the same as the event code provided by Notification Services. For more information, see Customizing Events, page E-74.

Event Name

Default or customized event name.

Component

Device element on which the event occurred.

Other fields depending on the event

Recommended Action

Links to the online help recommended actions for all events.

Actions

You can launch Event History which opens an Event History report (see Understanding the Event History Report, page 16-8).


Viewing Device Event Summary Data using Fault Summary Tab

To view device summary data of a group and take action on specific device events, using the Fault Summary tab, see the following topics:

Acknowledging an Event Using the Fault Summary Tab

Clearing an Event Using the Fault Summary Tab

Annotating an Event Using the Fault Summary Tab

Sending E-Mail in Response to an Event Using the Fault Summary Tab

Acknowledging an Event Using the Fault Summary Tab

Acknowledging active events is an indication to other users that you are aware of the event. When you acknowledge an event, this status change is populated to the Fault Monitor dashboard.

To acknowledge one or more device events from the Fault Monitor tab:


Step 1 From Fault Monitor, select a group from the group selector pane if desired.

Step 2 Select a device from the Devices pane.

The Events sub-pane refreshes.Select one or more events in the Events sub-pane by selecting check boxes for them.

Step 3 Click Acknowledge.

A confirmation dialog box appears.

Step 4 Enter your user name.

Step 5 Select Annotate if you want to insert text and type the desired annotation.

Step 6 Click Yes.

The Fault Monitor dashboard refreshes and the Status column displays acknowledged for the selected devices.


Clearing an Event Using the Fault Summary Tab

Clearing an event moves the event to the Cleared state. Cleared events are displayed minimum for 30 minutes and maximum for 60 minutes in the Fault Monitor dashboard.

The event is purged from database. As a result, when the next event is raised for the same device, a new event is generated.

When you clear an event, this status change is updated in the Fault Monitor dashboard. After an event is cleared, the status cannot be changed back. To get the existing state of the events for that device, you must manually delete and re-add the device to Operations Manager. If any new event on the device recurs, the status reverts to active.

The cleared event is removed from the Fault Monitor dashboard after Operations Manager performs its normal polling and determines that the alarm has been in the cleared state for 30 minutes or longer (from the time of polling). The maximum time that a cleared event can be seen in the Fault Monitor dashboard is 60 minutes.

To clear one or more device events from the Fault Monitor tab:


Step 1 From Fault Monitor, select a group from the group selector pane if desired.

Step 2 Select a device from the Devices pane.

The Events sub-pane refreshes.

Step 3 Select one or more events in the Events sub-pane by selecting check boxes for them.

Step 4 Click Clear.

A confirmation dialog box appears.

Step 5 Enter your user name.

Step 6 Select Annotate if you want to insert text and type the desired annotation.

Step 7 Click Yes.

Operations Manager clears the selected events and refreshes the Fault Monitor dashboard.


Annotating an Event Using the Fault Summary Tab

You can annotate an event by clicking the Annotate button. An editable Annotation dialog box opens; in the dialog box, you can enter up to 255 characters. Any number of annotations can be entered. An annotation is shown whenever other users view the event from an Event Details page.

To annotate an event:


Step 1 From Fault Monitor, select a group from the group selector pane if desired.

Step 2 Select a device from the Devices pane.

The Events sub-pane refreshes.

Step 3 Select one or more events in the Events sub-pane by selecting check boxes for theme and click Annotate.

The Annotation dialog box opens.

Step 4 Enter your text.

Text that exceeds 255 characters is truncated without warning. (If this happens, you can add another annotation.)

Step 5 Click OK.

The pane refreshes and the annotation is noted in the event rows with the clipboard annotation icon.


Sending E-Mail in Response to an Event Using the Fault Summary Tab

When you click Notify in an events panel of the Fault Monitor dashboard, Operations Manager opens a dialog box that you can complete to manually send an e-mail notification to multiple recipients. The e-mail notification adds the event details for the selected event.

If you want to send automatic e-mail notifications when events occur on certain devices, use Notification Services to set up an e-mail notification subscription. (See Configuring Notifications, page 15-8.)

If you want to synchronize your email notifications with a third-party case tool, you can set this up in Operations Manager. See Setting up Custom Email Notification.

SMTP Server configuration can be changed from Administration > Miscellaneous > Preferences.

The Sender address the email address (and is configured during new user configuration) of the login user.

To send an email notification:


Step 1 From Fault Monitor, select a group from the group selector pane if desired.

Step 2 Select a device from the Devices pane.

The Events sub-pane refreshes.

Step 3 Select one or more events in the Events sub-pane by selecting check boxes for them.

Step 4 Click Notify.

The Notify Events dialog box opens.

Step 5 Enter a comma-separated list of e-mail addresses in To field.

Step 6 (Optional) Enter a message in the Comment field.

The Subject heading in automatically entered with the event information.

Step 7 Click OK.


Taking Action on Event Data Using the Event Tab

To view event data and take action on events using the Event Tab, use the following topics:

Acknowledging an Event Using the Fault Monitor Events Tab

Clearing an Event Using the Fault Monitor Events Tab

Annotating an Event Using the Fault Monitor Events Tab

Sending E-Mail in Response to an Event Using the Fault Monitor Events Tab

Selecting Events on the Events Tab

Acknowledging an Event Using the Fault Monitor Events Tab

Acknowledging active events signals to other users that you are aware of the event. When you acknowledge an event, this status change is populated to the Fault Monitor dashboard. Only active events can be acknowledged.

To acknowledge one or more events from the Fault Monitor Events tab:


Step 1 From the Fault Monitor Events tab, select one or more events by selecting their check boxes.

Step 2 Click Acknowledge.

A confirmation dialog box appears.

Step 3 Enter your user name.

Step 4 Select Annotate if you want to insert text and type the desired annotation.

Step 5 Click Yes.

The Fault Monitor dashboard. refreshes and the Status column displays acknowledged for the selected devices.


Clearing an Event Using the Fault Monitor Events Tab

Clearing an event moves the event to the Cleared state. Cleared events are displayed minimum for 30 minutes and maximum for 60 minutes in the Fault Monitor dashboard.

The event is purged from database. As a result, when the next event is raised for the same device, a new event ID is generated.

When you clear an event, this status change is populated to the Fault Monitor dashboard. After an event is cleared, the status cannot be changed back.

To get the existing state of the events for that device, you must manually delete and re-add the device to Operations Manager. If any new event on the device recurs, the status reverts to Active.

The cleared event is removed from the Events display after Operations Manager performs its normal polling and determines that the alarm has been in the cleared state for 30 minutes or longer (from the time of polling). The maximum time that a cleared event can be seen in the Events display is 60 minutes.

To clear one or more events from the Fault Monitor Events tab:


Step 1 From the Fault Monitor Events tab, select one or more events by selecting check boxes for them.

Step 2 Click Clear.

A confirmation dialog box appears.

Step 3 Enter your user name.

If you want to annotate this event or events, click the Annotate check box. Enter the annotation in the box that displays and click Yes.

If you do not want to annotate, click OK.

Operations Manager clears the selected events and refreshes the Fault Monitor dashboard.


Annotating an Event Using the Fault Monitor Events Tab

You can annotate an event by clicking the Annotate button. An editable Annotation dialog box opens; in the dialog box, you can enter up to 255 characters. Any number of annotations can be entered. An annotation is shown whenever other users view the event from Fault Monitor.

To annotate an event:


Step 1 From the Fault Monitor Events tab, make a selection on what event or events you want to annotate and click Annotate.

The Annotate Event dialog box opens.

Step 2 Enter your text.

Text that exceeds 255 characters is truncated without warning. (If this happens, you can add another annotation.)

Step 3 Click OK.

The pane refreshes and the annotation is noted in the event rows with the clipboard annotation icon.


Sending E-Mail in Response to an Event Using the Fault Monitor Events Tab

When you click Notify in the Fault Monitor dashboard, Operations Manager opens a dialog box that you can complete to manually send an e-mail notification to multiple recipients. The e-mail notification adds the event details for the selected event.

If you want to send automatic e-mail notifications when events occur on certain devices, use Notification Services to set up an e-mail notification subscription. (See Configuring Notifications, page 15-8.)


Step 1 From the Fault Monitor Events tab, select an event and click Notify.

The Notify Events dialog box opens.

Step 2 Enter a comma-separated list of e-mail addresses in To field.

Step 3 (Optional) Enter a message in the Comment field.

The Subject heading in automatically entered with the event information.

Step 4 Click OK.


To monitor events and service quality events, use the following topics:

Accessing Device and Event Data Using Fault Monitor

Monitoring Service Quality Events and Alerts, page 6-1

Selecting Events on the Events Tab

You can select all events using the Select All button or reset the view to allow you to select individual events by selecting the Clear All button.

You can also alter the events that you see in Fault Monitor using the various filtering methods. See Filtering Events or Devices for more details.

Setting up Custom Email Notification

You can integrate Fault Monitor email notification with your third-party case tools. This enables you to track certain events using Fault Monitor. This feature is disabled by default.

For details, see:

Enabling Custom Email Notification

Disabling Custom Email Notification

Enabling Custom Email Notification

This feature allows you to customize the subject line in your email notifications from Fault Monitor. An example of how the subject line can be updated appears below:

Existing subject line: 000011H;10.77.241.33;PowerSupplyDown;Thu 19-May-2011 01:28:39 GMT+05:30;Critical;Acknowledged

New subject line: Submit Problem 000011H;10.77.241.33;PowerSupplyDown;Thu 19-May-2011 01:28:39 GMT+05:30;Critical;Acknowledged

Where the string Submit Problem can be modified to any other string of choice in the notification property file. This string is not added by default, but is modified by users in the notification properties file.

To set up the email customization:


Step 1 Edit the Install_Dir/objects/nots/config/nots.properties property file.

Step 2 Search for the line:

#TICKET_TEXT=Submit Problem

Step 3 Remove the comment # from the beginning of the line:

TICKET_TEXT=Submit Problem

You may also change the default email subject line text from Submit Problem to something else, if desired. This may be useful if you are using a ticket tracking tool.

If you want to use special characters such as a backslash, \, in the TICKET_TEXT string you must use quotes and an escape to reflect the character. For example, "\\".

Step 4 Save the file Install_Dir/objects/nots/config/nots.properties.

Step 5 Open a Windows command prompt and run the following commands in this sequence:

net stop OMHealthMonitor
pdterm NOTSServer
pdexec NOTSServer
net start OMHealthMonitor

This allows all new email notifications from Operations Manager to contain the above text in subject line.


Disabling Custom Email Notification

To disable any customized changes to the email notification properties file:


Step 1 Edit the Install_Dir/objects/nots/config/nots.properties property file.

Step 2 Search for the line:

TICKET_TEXT=Submit Problem

Step 3 Add the comment # at the beginning of the line:

#TICKET_TEXT=Submit Problem

Step 4 Save the file Install_Dir/objects/nots/config/nots.properties.

Step 5 Open a Windows command prompt and run the following commands in this sequence:

net stop OMHealthMonitor
pdterm NOTSServer
pdexec NOTSServer
net start OMHealthMonitor

This updates all future email notifications from Operations Manager to reflect the changes made.


How Events are Handled

You can customize event names and severities are valid across all dashboards in Operations Manager (such as Fault Monitor, Diagnostics views, Event History reports, and so on). The customization for events occurs only for those events that come after the customization is performed.

Existing events continue to retain their event names and severities. For more details about event customization, see Customizing Events, page E-74.

Only service quality events which are from a managed phone will be aggregated. Service quality events from managed devices other than phones are displayed in Fault Monitor.

Service quality events from unmanaged devices or phones can only be viewed in the Service Quality Activity Display. These events are not considered for aggregation and are not displayed in Fault Monitor.

For information on service quality event aggregation at the device pool and Unified CM Express level, see Service Quality Events Aggregation, page 6-9.

How to Use the Fault Monitoring Dashboard

Operations Manager displays events in a variety of application windows. Depending on the application you want to use to view events, you may need to perform some preliminary setup. For details on device setup, see the Installation Guide for Cisco Unified Operations Manager.

You can customize your Fault Monitor dashboard by selecting specific groups and using filters to access specific event information in Fault Monitor. Use:

The group selector to control the events for device groups that appear on the Fault Monitor dashboard. See Selecting Device Groups in Fault Monitor.

Filters to control the specific device names, and IP addresses, event names, event severities and status, as well as when they were updated. See Filtering Events or Devices.

Preferences to set which columns display in the Fault Summary user interface. See Changing Fault Summary Column Displays.

You can also change the names of Operations Manager events to names that are more meaningful to you. These customized names are reflected in or any views or reports you generate. For information on changing Operations Manager event names using Event Customization, see Customizing Events, page E-74.

You can monitor all devices that Operations Manager supports, once you have added those devices using Device Management and ensured that the devices are in your view.


Note All Event History reports generated from within the Fault Monitor dashboard provide information from the past 24 hours. To generate an Event History report on time spans beyond the last 24 hours, use Event History from the Reports tab by selecting Reports > Event History. For more information, see 24-Hour Context-Based Event History Reports, page 16-2.


All three views (device view, device-event view, and event view) can display only 200 records though more than 200 records exist in the system. Use the Filter or Sort options to display events in views. To view all devices or events export and print from the view.

Changing Fault Summary Column Displays

To hide or display hidden Fault Monitor Fault Summary columns, do the following:


Step 1 Select the Settings icon in the Devices or Events pane.

The Columns option appears.

You can click or hover over the Columns link to view the list of columns.

Step 2 Click the columns to display or hide them.

A blue checkmark indicates the column appears.

Step 3 Select Reset to Default to return any hidden columns.


Getting Device and Event Details

These topics address how to start and use the Fault Monitor page to get detail information on events:

Accessing the Events Details Page

Understanding the Layout of the Event Details Page

Viewing Events Associated with an Device

Viewing Event Details

For details on how to access Device Details View, see Getting Device and Event Details. For additional details on Service Quality event details, see Monitoring Service Quality Events and Alerts, page 6-1.

Accessing the Events Details Page

The Events Details page provides information about all of the events for a device or cluster.


Note The mini Events Details page can also be opened from the Diagnostics view or from the Fault Monitor. The hover over Event Details in Fault Monitor is briefer. The Event Details available in the Diagnostics view portlets contains a table of the event details and is described in Understanding the Layout of the Event Details Page.


Event Processing for the Events Display During High CPU Utilization

During periods of high CPU utilization and event buildup, Operations Manager stops processing events. This action is based on the maximum allowed event count settings. A message appears when you open Fault Monitor, indicating this.

A message may also appear in the status line. This message states that event processing is being controlled, and not every event is being displayed. An example of this type of message follows:

21 May 2009|12:16:03.984|ERROR|Event|EventBinder|EventBinder|processNormalizedEvent|null| Event Dropped for component: 172.25.109.221 ; Reason :-> Exceeded limit for eventStatus = Active

The excess events are written to the NMSROOT\logs\itemlogs\EPM\EPMDroppedEvents.log file, and these events:

Do not appear on the Events display.

Are not stored in the Events history database.

Are not sent out as notifications.


Note NMSROOT is the directory where Operations Manager is installed on your system. If you selected the default directory during installation, it can be entered as "C:\Program Files\CSCOpx" or C:\PROGRA~1\CSCOpx.


There are also cases when events may flood Operations Manager. If an event flood is detected, dropped events are logged in FloodDroppendEvents.log.

In the Events display, the following message appears for the device warning about the event flood: All events, X records (Event processing is being controlled. For details, click here.).

To view additional information about the flood, click on the hotlink or view the FloodDroppedEvents.log for details. For more information on event flooding, see Understanding Event Flooding Control, page E-73.

Understanding the Layout of the Event Details Page

These topics provide details about the information on the Event Details page (see Figure 4-4).

Table 4-7 Event Details  Page—Event Status Bar Contents 

Field
Description

Event ID

Event identifier number. This event ID is not the same as the event code provided by Notification Services. For more information, see Customizing Events, page E-74.

Last Change

Time and date of last event update (indicates activity, such as an event recurrence, event acknowledgement, the addition of an annotation, and so forth). Events are grouped by severity, and within severities, events with the latest change are listed first.

Description

Click Here

Links to recommended actions for this event.

Actions

You can launch Operations Manager tools and external applications. These options are dependent on the event. Not all options will display. For a list of actions, see Actions (Tools You Can Use to Perform Tasks), page 8-49.


Tabular Display Pane

On the Event Details page, the tabular display pane contains a table that lists details about events. These events are associated with the event that is listed in the event status bar. You can refresh the display by clicking Refresh at the bottom of the pane. For an explanation of all of the items in the table, see Getting Device and Event Details.

The tabular display is scrollable and can store up to 1,000 records. See Viewing Events Associated with an Device for actions that you can perform from this page.

Window Tools Area

The top-right corner of the Device and Events subpanes, as well as the Events tab, contains several command buttons, as described in Table 4-8.

Table 4-8 Event Details Page—Window Command Buttons

Icon
Meaning
Described in...

Refreshes the Events details page.

Opens a printer-friendly version for printing.

Printing Displays or Reports, page 1-27

Exports the Events details page to a file.

Exporting Data from a Display or Report, page 1-26

Sets which columns to display or hide.

Changing Fault Summary Column Displays


Viewing Events Associated with an Device

Use the tabular display in the Fault Monitor page to obtain more information about all of the events associated with a specific device. In the tabular display, as shown in Figure 4-5, events with the latest change are listed first.


Note If you suspend a device, all events move to cleared state and not an active state. The event also moves to cleared state. Operations Manager stops polling the device but may still receive device data, such as CDR records.


Table 4-9 provides an example of an Events Tab in the Fault Monitor page. This table is refreshed every 60 seconds.


Tips You can generate a 24-hour Event History report on all events that occurred on a selected component by opening Event History from the Actions area of the Events details display.


Table 4-9 Event Details Tabular Display—Contents 

Column
Description

Event ID

Event identifier number. Note that this event ID is not the same as the event code provided by Notification Services. For more information, see Customizing Events, page E-74.

Description

Operations Manager event name (as described in Events Processed, page E-1). You can also change the names of Operations Manager events to names that are more meaningful to you.

For information on changing Operations Manager event names using Notification Customization, see Customizing Event Description and Severity, page E-75.

Component

Device element on which the event occurred.

Time

Time at which the event occurred.

Status

Event state, based on last polling.

Active

Event is live. (Note that events on suspended devices remain active; see Sending E-Mail in Response to an Event Using the Fault Summary Tab.)

Cleared

Event is no longer live.

Acknowledged

Events on which you have taken action and acknowledged.

UserCleared

Events that you have manually cleared from the user interface.

Tools

Links to tools that allow you to perform additional tasks. For example:

Detach Fault Monitor (see Tools Selector in Fault Monitor). Only available Tools option in Fault Monitor.

Open an Event History report (see Understanding the Event History Report, page 16-8).

Performance (see How to Use Performance Graphs, page 7-1).

Edit threshold settings (see Editing Operations Manager Thresholds, page 19-32).


Viewing Event Details

The Event Details page provides additional details about the event, such as event name, component, reason for clearing (if available), values of MIB attributes at the time of the event, polling and threshold information, and utilization information.

The Event Details page also provides ways to respond to events by adding annotations, acknowledging, or clearing the event.


Step 1 From the Fault Monitor, locate the event you want to investigate and click the Event Name.

The Event Details page appears (see Figure 4-4).

Step 2 To select the Event History report from the Actions list, click on the report name.


Figure 4-5 shows the hover over Event Details page.

Figure 4-5 Event Details Hover Over Page

The information that is shown in the Event Details page depends on the event description. Table 4-10 describes the Event Details contents.

Table 4-10 Event Details  Page—Windows Contents 

Field
Description

Event Name

Event name.

Component

Device component responsible for the event.

Detail

Provides details on cluster, node, and event.

Reason for Clear (displays only for cleared and usercleared events)

User cleared event from display

Displays when you clear an event. All corresponding events for that event move into the UserCleared state.

User suspended device

Displays when you suspend a device. All events for the event for that device move into the Cleared state.

Some events are cleared because of a Clear coming from underlying modules. These events will not display a Reason for Clear.

Aged event auto-cleared

Displays when Operations Manager autoclears the events.

Cleared By

 

User responsible for event activity.

Cisco Unified Operations Manager

Displays only when the events are auto-cleared by Operations Manager.

More Info

Link to event details and recommended actions. See Supported Events, page E-3.


Troubleshooting Tips

If Fault Monitor displays the following messages:

Failed to load Group Tree. Due to CPU intensive processes running on the OM server, 
sometimes, UI might take several minutes to respond. 

If this problem persists, please contact Server Administrator.

We recommend you verify the following information and restart the daemon manager to resolve the problem:


Step 1 Check all active processes to determine if there any processes occupying CPU cycles that are not relevant to Operations Manager.

Typically, look for third party applications which may have been installed on the Operations Manager server.

Step 2 Stop any unnecessary processes on the Operations Manager server.

Step 3 Check to see if there are any Virus Scanner processes running and wait until after the scan completes before proceeding to the next step.

Step 4 Check to see if there are any device discovery processes running.

The process responsible for device discovery is sm_server.exe. Wait until the discovery completes.

Operations Manager user interface will return to a normal state when the CPU consumption reduces.


Note Various discovery processes run at specific times of day. Ensure that your virus scan schedules do not overlap with discovery times.


Step 5 If none of the above scenarios are present and resources such as CPU, memory, and disk utilization are normal on the Operations Manager server, we recommend you restart the daemon manager.