Cisco Element Manager System User's Guide, 3.1
Event Browser
Downloads: This chapterpdf (PDF - 251.0KB) | Feedback

Event Browser

Table Of Contents

Event Browser

Launching the Event Browser

The Event Browser Window

Query Configuration

Opening the Query Editor

Sorting Options

Setting up Sort Options

Managing Events

Managing an Event from the Window

Managing an Event from the Menu Bar

Auto or Manual Update

Enabling Auto Update

Enabling Manual Update

Setting Color Coding

Selecting the Type of Color Coding to be Used

Event History

Viewing the Event History

Refreshing the Window

Full Event Description

Accessing the Full Event Description Window

Acknowledge Details

Clearing Details


Event Browser


One of the most important aspects of Network Service Management is the ability to identify events on the system and to take action to resolve them quickly and efficiently. For example, there may be a power supply fault in a chassis which would require an engineer to be sent out to rectify the fault. This fault is critical to the running of the network and would need prompt attention.

In Cisco EMF, when a condition (fault) occurs on a managed object in the network, the system is notified immediately. This notification is shown as an event and can be viewed with the Cisco EMF Event Browser. The Event Browser is opened from the Cisco EMF Launchpad. A window similar to Figure 6-1 is displayed.

Figure 6-1 Cisco EMF Event Browser Window

The Event Browser provides a tool to manage the network efficiently; you can list, query, and sort all or some events according to how you want to manage the network. Services can be invoked on events so faults can be attended to from the window that shows the event.


Note You can also view events on Cisco EMF maps, however, only the most severe fault on a managed object is shown on the map icon.


More than one Event Browser session can be open to a user at any one time, if they have different queries specified. All users can see any event. In the Event Browser window, you can acknowledge that a particular event is one that you are going to deal with and all other users will see that the event is being handled. When the event is cleared, it is shown in the Event Browser window, so other users know that the event requires no further attention.

When an event is received, it is shown as active and unacknowledged (the two indicators are shown as grey). At this stage, no one has taken responsibility to deal with it. You may not want to receive all events on the system, so a query can be set up using the Cisco EMF Query Editor to view specific events.

Access to the Event Browser is set up in Access Control (refer to "User Access Control" for more information.)

Launching the Event Browser

The Event Browser application is launched using the icon in the Cisco EMF Launchpad window. The Query Editor window is displayed.
Refer to the "Query Configuration" section. Set your query (the Event Browser will display events that match the query criteria), or from the pop up menu available when you right click on one or more objects in the Map Viewer (the Event Browser will display only the events associated with the selected objects), or from other Cisco EMF applications, select the Event Browser option from the pop up menu available when you right click a selected object.

The Event Browser Window

The main panel in the Event Browser window displays a list of events including:

Object name (this is the managed device's name)

Time the event was raised

Severity of the event (color-coded), refer to the Severity Colors

Description of the event.

Two indicators, color coded to the severity of the event, are available to the left of the object name:

Clear (an indicator to show if an event is active or cleared)

Ack (an indicator to show if an event is acknowledged or unacknowledged).

You click the Ack button to indicate to other users that the fault is being worked on. The button changes to the color of the severity, in this case, red. If for any reason you cannot clear the problem, this button can be de-selected so the event can be re-assigned. The Clear button is selected when the fault has been rectified to indicate the event requires no further attention.


Note The option to unacknowledge an event is only available to an administrator or the user who acknowledged the event initially.


Figure 6-2 Event Browser Window

Menus are available which provide you options for modifying the way the information is displayed. From the Edit menu, you can:

Set up the Event State (Clear Events, Acknowledge or Unacknowledge Events)

Set up queries to specify the events you want to see

Set up sort options to present the events in the order you desire.

From the View menu you have the following options to manage the way events are viewed on each object:

Use Auto or Manual Update

Set the Color Coding

View the Event History window

Refresh the Event Browser window

Display the Full Object Name

Select Full Name Options.

The Full Event Description window allows you to view the status of a selected event. For more information, refer to the "Full Event Description" section.

Clicking on an event severity, name, time, or description selects that event. One or more events can be selected; this gives the opportunity to perform bulk operations. With one or more events selected, clicking the right mouse button displays a pop up menu which shows the common services available on those events.

The Event Browser window also displays other information in the status bar:

Current Update status (this can be auto or manual)

Current query

Current sort order, for example, sort by time

Total number of events displayed (this number is shown in blue until it is acknowledged by the user by clicking on the number).


Note The Event Browser can display a maximum of fifteen thousand entries. If there are more events on the system this is indicated in the status bar.


In the Event Browser, you can use Print to save the contents of all or part of the browser to a file or to print a paper copy.

Query Configuration

The Event Browser monitors all events on all devices. To work efficiently, you may want to specify the objects on the network you are concerned with. The Event Browser gives you the option to do this through queries which can be configured to match your requirements. With queries you can choose to include or exclude devices or criteria. For example, you could choose to monitor a particular device, specify a time period, and choose to look only at events which are warnings or critical. You define a query so that the Event Browser only displays the events that meet the criteria you defined. Refer to "Managing Objects in Cisco EMF" for more information.


Note Any changes made to the queries are not stored after exiting the Event Browser.


Opening the Query Editor

To define a query, click on the icon in the Cisco EMF Launchpad window, or

in the Event Browser, select the Edit menu's Query Setup option, or

click the Query Filter icon from the Toolbar.

The Query Editor window, similar to Figure 6-3, is displayed. The criteria which can be used to specify a query are available on individual tabs. Values or criteria can be selected on each tab. A dark gray tab is active (On) and its query is used in the Event Browser. A light gray tab is inactive (Off), its query is not used.

Figure 6-3 Query Editor Window

The Query Editor is split into tabbed sections. Scroll through the tabs to see the following options:

Severity

Time

Event Status

Source Domain

Mgmt Domain

User

Event Class

Object Scope

Object Class

Object Attribute Presence

Object Attribute Value.

The Query Editor is described fully in "Managing Objects in Cisco EMF".

The Event Browser is updated with events that match the query criteria. A progress dialog indicates Cisco EMF is querying for events.


Note You have the option to Cancel on the Progress dialog and no events will be loaded.


When the query is completed the progress dialog then shows the progress of events being loaded. The total number of events displayed on the status bar is shown in blue until you acknowledge it by clicking on the number.

Sorting Options

Query Editor configuration allows you to specify the events you want to see. Sorting gives you options to change the order in which you view the events which match your query criteria.

Setting up Sort Options

From the Edit menu, select Sorting Options. A drop down menu is displayed listing the available sorting options. An indicator shows which option is selected. Selecting an option causes the Event Browser display to change to show the appropriate information. The sort option selected is shown in the status bar. You can sort by:

Time—shows the most recent event first

Event Class—allows you to sort event classes

Event Stateif the query is set up to show all states, this option shows events in the following order:

Unacknowledged/Active

Acknowledged/Active

Cleared/Unacknowledged

Cleared/Acknowledged.

Managed Objectsorts by the name of the managed object on the network


Note Set the option to show full name before sorting by name.


Severity if the query was set up to show all severities, this option shows events in the following order:

Critical

Major

Minor

Warning

Normal

Decommission

Informational.

Managing Events

When the Event Browser shows a sorted list of events which match the query criteria set, you can start to manage those events. This is the place to acknowledge an event, which shows you have taken responsibility for managing that event. If you cannot continue to manage an event, it can be unacknowledged and then becomes available to other users.


Note The option to unacknowledge an event is only available to an administrator or the user who acknowledged the event initially.


When the fault has been rectified and the event requires no further attention, clear the event. It is then removed from the Event Browser.

Three methods are available for managing events:

1. Two indicators (Clear and Ack) are available to the left of the object name. Select or deselect the indicator associated with an event in the Event Browser window.

2. Use the Edit menu.

3. Right click on a selected event(s) to display a pop up menu of options available on that event(s).

Clicking on an event severity, name, time, or description selects that event. One or more events can be selected; this gives you the opportunity to perform bulk operations.

Managing an Event from the Window


Step 1 To clear the event, select the indicator associated with the event or select the object and click the Clear Events icon on the Toolbar. This displays the Events Clearing window.

Enter the reason for clearing the event, then click Apply to save or Cancel to exit the window without saving. The indicator changes to the new color of the severity of the event.

Step 2 Select the Ack indicator to Acknowledge an event. The indicator changes to the color of the severity of the event. To Unacknowledge an event, select the Ack indicator which is then shown as deselected.


Note This option is only available to the user who acknowledged the event or a user with administrative access (refer to "User Access Control").



Managing an Event from the Menu Bar

From the Edit menu you can select the Edit Event State option. A drop down menu is displayed, which provides options to manage the events.

Clear Events—allows you to clear the event. When you select this option, the Events Clearing window is displayed. Enter a reason then click Apply to save the details or Cancel to exit without saving.

Acknowledge Events—allows you to acknowledge an event

Acknowledge Events with comment—allows you to record a reason for acknowledging an event. When you select this option, the Acknowledge Events window is displayed. Enter a reason then click Apply to save the details or Cancel to exit without saving.

Unacknowledge Events—allows you to unacknowledge an event.


Note This option is only available to the user who acknowledged the event or a user with administrator access (refer to "User Access Control").


Auto or Manual Update

Auto Update is the default state and allows you to view incoming events which are automatically updated in the window.

The status box displays the current update state; either Auto or Manual. If Auto Update is enabled, the status box displays Auto Update.

When the update state is Manual (Auto Update is disabled) you should refresh the window at regular intervals using the View menu's Refresh option or the Refresh icon so that new events are displayed.

Enabling Auto Update

From the View menu, select Enable Auto Update. The message in the status box changes to Auto Update.


Note If an indicator is displayed on the pull down menu, to the left of Enable Auto Update, the Auto Update application is enabled.


Enabling Manual Update

From the View menu, de-select Enable Auto Update.


Note The message in the status box changes to Manual Update.


Setting Color Coding

Three color coding options are available to you. The color you choose depends on the severity of the event (refer to the Severity Colors). The options are as follows:

Full Color Coding—when this option is selected, the severity information displayed has text on a colored background

Partial Color Coding—when this option is selected, the Severity column is colored. The color of the column depends on the severity of the event

No Color Coding—when this option is selected, text only is displayed in the Severity column.

Selecting the Type of Color Coding to be Used


Step 1 From the View menu, select Set Color Coding.

Step 2 From the menu that appears, select one of the options.

The selected option is implemented immediately.


Event History

Event history allows you to display any events that match the current query criteria and have had their state changed, either acknowledged, cleared, or unacknowledged. This is disabled by default. To view this information, select the View menu's Event History option.

Viewing the Event History


Step 1 Configure the event query (refer to the "Query Configuration" section.)

The Event Browser displays current events which match the criteria set in the query.

Step 2 From the View menu, select Event History.

The Event Browser now displays any events that meet that query and have been cleared.


Note By default, cleared events are stored by the system for seven days. Therefore, only events that match the current query and have had their state changed in the last seven days, are displayed when the Event History is enabled.


Figure 6-4 Event History Enabled


Refreshing the Window

Ensure Manual Update is selected; this is shown as a current status message. From the View menu, select Refresh or click the Refresh icon on the Toolbar. The window is refreshed.


Note You should refresh the window at regular intervals to show an up-to-date list of events.


Full Event Description

Double-clicking on an event displays the Full Event Description window. This provides details of the event with Acknowledge and Clearing details.

Accessing the Full Event Description Window

Place the cursor over the relevant event in the Event Browser, then double-click the left mouse button or select Event Description, then select Event Information Dialog from the pop up menu available on a selected object.

A window similar to Figure 6-5 is displayed.

Figure 6-5 Full Event Description Window


Note If the event has not been cleared, the Event State displays Active and the Clearing Method, User Responsible for Clearing, and Clearing Time and Date sections are disabled.
The information displayed cannot be altered.
If an event has been cleared, you can view the method used to clear it by clicking the Clearing Event button.


The Full Event description window displays the following information:

Object name—name of the Cisco EMF managed object the event was reported against

Time and Date—the time and date the event was reported

Severity—the severity of the reported event

Source Domain—indicates from which Communications domain the event was reported

Management Domain—indicates from which Management domain the event was reported

Event Description—provides a brief description of the reported event

Event State—indicates whether the event is active or cleared. If the event has been cleared, the Clearing Method, User Responsible for Clearing, and Clearing Time and Date sections become active.

Acknowledge Details

User—identifies the user who acknowledged the event

Time and Date—identifies when the event was acknowledged.

Clearing Details

Clearing Method—indicates if the event was cleared by the network or by a user

User Responsible for Clearing—displays the user name responsible for clearing the event

Clearing Time and Date—indicates the time and date the event was cleared

Reason for clearing—the information that was entered in the Events Clearing window, which is completed when the Clear indicator is selected.