Guest

Cisco Unified Communications Manager IM & Presence Service

System Error Messages for Cisco Unified Presence Release 8.6

Cisco Unified Serviceability Alarms and CiscoLog Messages

Cisco Unified Serviceability Alarms and CiscoLog Messages

CiscoLog Format
Log File and Syslog Outputs
Standard Syslog Server Implementations
Clock Synchronization
Multipart Messages
CiscoLog Message Format
Message Length Limit
SEQNUM Field
HOST Field
TIMESTAMP Field
HEADER Field
TAGS Field
MESSAGE Field
Internationalization
Versioning

Preconfigured System Alarm Notifications

AuthenticationFailed
CiscoDRFFailure
CoreDumpFileFound
CpuPegging
CriticalServiceDown
HardwareFailure
LogFileSearchStringFound
LogPartitionHighWaterMarkExceeded
LogPartitionLowWaterMarkExceeded
LowActivePartitionAvailableDiskSpace
LowAvailableVirtualMemory
LowInactivePartitionAvailableDiskSpace
LowSwapPartitionAvailableDiskSpace
ServerDown
SparePartitionHighWaterMarkExceeded
SparePartitionLowWaterMarkExceeded
SyslogSeverityMatchFound
SyslogStringMatchFound
SystemVersionMismatched
TotalProcessesAndThreadsExceededThreshold

Emergency-level Alarms

PENoSWVersionLicense
ESPNoSWVersionLicense
IPMANotStarted
BDINotStarted
WDNotStarted
CiscoDirSyncStartFailure
FailedToReadConfig
OutOfMemory
ServiceNotInstalled
FileWriteError
CertExpired

Alert-Level Alarms

CiscoLicenseOverDraft
CiscoLicenseApprochingLimit
ServiceActivationFailed
ServiceDeactivationFailed
ServiceExceededMaxRestarts
MemAllocFailed
SystemResourceError
NoDbConnectionAvailable
ErrorChangeNotifyReconcile
CLM_MsgIntChkError
CertValidLessthanADay

Critical-Level Alarms

DUPLEX_MISMATCH
LogPartitionHighWaterMarkExceeded
CoreDumpFileFound
CUPSyncAgentAXLConnectionFailed
CUPSyncAgentCucmDbmonConnectionFailed
DbmonQueueWorkerExistWithError
CupNotInCucmAppServerListError
PEDatabaseError
PEPeerNodeFailure
PEIDStoTimestenDatabaseSyncError
PEIDSSubscribeError
PEIDSQueryError
PESipSgHostUnavailable
PESipSocketBindFailure
PEOamInitialConfigFileError
PEOamInvalidInitialConfigFile
PEOamConfigFileError
PEOamInvalidConfigFile
PEConfigNotificationFailure
ESPStopped
ESPSharedMemCreateFailed
ESPSharedMemSetPermFailed
ESPSharedMemAllocFailed
IPPMStopped
CTIGWProviderDown
CTIGWProviderFailedToOpen
CALBackendCalDisc
CALMtngPlSvrDisc
CALExchangeTrustCertReadFailure
CALMtngPlTrustCertReadFailure
CALMtngPlSystemFailure
SRMFailover
SRMFailed
CiscoDirSyncProcessFailToStart
ServiceFailed
ServiceStartFailed
ServiceStopFailed
ServiceRestartFailed
CUPInterclusterSyncAgentAXLConnectionFailed
CUPInterclusterSyncAgentPeerSyncFailed
CUPInterclusterSyncAgentFailedToSendCN
CUPInterclusterSyncAgentPeerDuplicate
CUPICSACertificateFingerPrintMisMatch
CUPICSACertificateValidationFailure
CUPInterclusterSyncAgentFailedToCleanUpPeer
XcpSIPGWStackResourceError
ErrorChangeNotifyClientBlock
CUPXCPConfigMgrQueueAtCriticalLevel
CUPXCPConfigMgrJabberRestartRequired
CUPXCPConfigMgrConfigurationFailure
CUPXCPConfigMgrHostNameResolutionFailed
CUPXCPConfigMgrR2RPasswordEncryptionFailed
CertValidfor7days
TomcatCertRegen

Error-Level Alarms

ScheduledCollectionError
SparePartitionLowWaterMarkExceeded
PEAutoRecoveryFailed
PECalendarConnectionLoss
PEWebDAVInitializationFailure
ESPConfigError
ESPConfigNotFound
ESPCreateLockFailed
ESPSocketError
ESPRadiusError
ESPStatsLogFileOpenFailed
ESPStatsInitFailed
ESPMallocFailure
ESPWrongIPAddress
ESPWrongHostName
ESPMySQLConnectionError
ESPPassedParamInvalid
ESPNumsvRouteError
ESPConnectToProvisioningServer
ESPNAPTRInvalidRecord
ESPASNLibInitError
ESPE164Error
ESPRASSendMessageFailed
ESPVirtualProxyError
ESPRegistryError
ESPRegistryInitFailed
ESPRegistryLockFailed
ESPRoutingError
ESPRouteInitFailed
ESPRouteLockFailed
ESPSIPURLWrong
IPPMSCBFindFailed
IPPMSCBGetFailed
UASCBFindFailed
UASCBGetFailed
IPPMSCBInitFailed
IPPMReadConnectionError
CTIGWQBEFailedRequest
CTIGWSystemError
PWSSCBFindFailed
PWSSCBInitFailed
RTMT_ALERT
IPMAApplicationError
IPMAOverloaded
IPMAFilteringDown
BDIApplicationError
BDIOverloaded
WDApplicationError
WDOverloaded
CiscoDirSyncProcessFailedRetry
CiscoDirSyncProcessFailedNoRetry
CiscoDirSyncProcessConnectionFailed
CiscoDirSyncDBAccessFailure
DirSyncScheduledTaskFailed
DirSyncSchedulerFailedToGetDBSchedules
DirSyncSchedulerInvalidEventReceived
DirSyncInvalidScheduleFound
DirSyncSchedulerFailedToRegisterDBEvents
DirSyncSchedulerEngineFailedToStart
DirSyncScheduleDeletionFailed
DirSyncScheduleUpdateFailed
CiscoDRFDBAccessFailure
CiscoDRFMasterAgentStartFailure
CiscoDRFLocalAgentStartFailure
CiscoDRFBackupFailure
CiscoDRFRestoreFailure
CiscoDRFDeviceError
CiscoDRFInternalProcessFailure
CiscoDhcpdFailure
CiscoLicenseManagerDown
CiscoLicenseRequestFailed
CiscoLicenseDataStoreError
CiscoLicenseInternalError
CiscoLicenseFileError
DirSyncSchedulerFailedToUpdateNextExecTime
EspConfigAgentMemAllocError
EspConfigAgentFileWriteError
EspConfigAgentSharedMemoryStaticRouteError
EspConfigAgentLocalDBAccessError
CUPInterclusterSyncAgentDuplicateUser
XcpDBConnectError
XcpComponentConnectError
XcpComponentConfigError
XcpMdnsStartError
XcpCmPauseSockets
XcpCmStartupError
XcpCmHttpdError
XcpCmXmppdError
XcpTxtConfGearError
XcpThirdPartyComplianceConnectError
kDbConnectionFailed
ErrorReadingInstalledRPMS
ErrorChangeNotifyClientTimeout
IDSEngineCritical
IDSEngineFailure
IDSReplicationFailure
CLM_UnrecognizedHost
EMCCFailedInLocalCluster
EMAppInitializationFailed
EMServiceConnectionError
NodeNotTrusted
DRFTruststoreMissing
DRFUnknownClient
DRFSecurityViolation
DRFMasterAgentStartFailure
DRFLocalAgentStartFailure
DRFLA2MAFailure
DRFMA2LAFailure
DRFBackupFailure
DRFRestoreFailure
DRFBackupDeviceError
DRFTapeDeviceError
DRFLocalDeviceError
DRFInternalProcessFailure
DRFRestoreInternalError
DRFMABackupComponentFailure
DRFMARestoreComponentFailure
DRFMABackupNodeDisconnect
DRFNoRegisteredComponent
DRFNoRegisteredFeature
DRFMARestoreNodeDisconnect
DRFSftpFailure
DRFRegistrationFailure
DRFBackupCancelInternalError
DRFFailure
SyslogStringMatchFound
HardwareFailure
SyslogSeverityMatchFound
CertExpiryError

Warning-Level Alarms

AuthenticationFailed
TotalProcessesAndThreadsExceededThresholdStart
LogPartitionLowWaterMarkExceeded
LogCollectionJobLimitExceeded
SparePartitionHighWaterMarkExceeded
LegacyCUPCLogin
PENotifyTimeout
PELoadHighWaterMark
PEMemoryHighCondition
PEStateLocked
PEStateDisabled
CTIGWModuleNotEnabled
CTIGWUserNotLicenced
CTIGWUserNotAuthorized
PWSAboveCPULimit
PWSRequestLimitReached
PWSAboveSipSubscriptionLimit
IPMAStopped
IPMAManagerLogout
BDIStopped
WDStopped
DirSyncNoSchedulesFound
DirSyncScheduledTaskTimeoutOccured
CiscoDRFUnknownMessage
authFail
SSONullTicket
SSOServerUnreachable
LDAPServerUnreachable
SSOuserNotInDB
SSODisabled
SSOInternal
authLdapInactive
authAdminLock
authHackLock
authInactiveLock
EspConfigAgentNetworkOutage
EspConfigAgentNetworkRestored
EspConfigAgentHighMemoryUtilization
EspConfigAgentHighCPUUtilization
EspConfigAgentRemoteDBAccessError
EspConfigAgentProxyDomainNotConfigured
CUPICSACertificateCASignedTrustCertFound
ServiceStartupFailed
CLM_ConnectivityTest
EMCCFailedInRemoteCluster
UserInputFailure
CUPXCPConfigMgrQueueAtWarningLevel
CUPXCPConfigMgrQueueBelowWarningLevel
ReplicationFailure
ReplicationFailureClear
ReplicationFailureTimeout
DRFLogDirAccessFailure
DRFComponentDeRegistered
DRFDeRegistrationFailure
DRFDeRegisteredServer
DRFSchedulerDisabled
DRFNoBackupTaken
CertValidLessThanMonth

Notice-Level Alarms

TotalProcessesAndThreadsExceededThresholdEnd
PEPeerNodeFailureCleared
PELoadHighWaterMarkCleared
PEIDStoTimestenDatabaseSyncErrorCleared
PEMemoryHighConditionCleared
PESipSgHostUnavailableClear
PEOamInitialConfigFileClear
PEStateEnabled
PECalendarConnectionLossCleared
PWSBelowCPULimit
PWSBelowSipSubscriptionLimit
authExpired
authMustChange
credReadFailure
ServiceActivated
ServiceDeactivated
EspConfigAgentServiceStartFailed
EspConfigAgentServiceStopFailed
EspConfigAgentHighMemoryUtilizationClear
EspConfigAgentHighCPUUtilizationClear
EMAppStopped
CertValidityOver30Days

Informational-Level Alarms

AuthenticationSucceeded
LogFileSearchStringFound
AdministrativeEvent
SecurityEvent
CriticalEvent
PESipMessageTimeout
PEStateStopped
PEStateShuttingdown
PEStateUnlocked
ESPStarted
CTIGWStarted
CTIGWStopped
CTIGWRestarted
CTIGWConnectionRestarted
CALBackendCalConn
CALMtngPlSvrConn
IPMAStarted
IPMAInformation
BDIStarted
WDStarted
WDInformation
CiscoDirSyncStarted
CiscoDirSyncProcessStarted
CiscoDirSyncProcessCompleted
CiscoDirSyncProcessStoppedManually
CiscoDirSyncProcessStoppedAuto
CiscoDirsyncZeroUsersSynced
UserUpdated
DirSyncScheduledTaskOver
DirSyncSchedulerEngineStopped
DirSyncNewScheduleInserted
CiscoDRFLA2MAFailure
CiscoDRFMA2LAFailure
CiscoDRFHistory
CiscoDhcpdRestarted
CiscoLicenseFileInvalid
CiscoHardwareLicenseInvalid
DirSyncScheduleInsertFailed
DirSyncSchedulerEngineStarted
authSuccess
credUpdateFailure
credUpdateSuccess
credFullUpdateSuccess
credFullUpdateFailure
credReadSuccess
AdminPassword
CUPICSACertificateDBDeletionFailed
PermissionDenied
ServiceStopped
ServiceStarted
XcpDBConnectRestore
XcpCmResumeSockets
XcpTxtConfRoomLimitError
XcpThirdPartyComplianceConnectRestore
IDSEngineDebug
IDSEngineInformation
IDSReplicationInformation
CLM_IPSecCertUpdated
CLM_IPAddressChange
CLM_PeerState
EMCCUserLoggedIn
EMCCUserLoggedOut
EMAppStarted
DRFComponentRegistered
DRFSchedulerUpdated
DRFBackupCompleted
DRFRestoreCompleted
CertExpiryApproaching

Cisco Unified Serviceability Alarms and CiscoLog Messages


This chapter describes the Cisco Unified Serviceability alarms and error messages and CiscoLog message format. Network alarms tracked by Cisco Unified Serviceability for Cisco Unified Presence generate the error messages.


This chapter contains the following sections:

Cisco Unified Serviceability Alarms and CiscoLog Messages

Preconfigured System Alarm Notifications

Emergency-Level Alarms

Alert-Level Alarms

Critical-Level Alarms

Error-Level Alarms

Warning-Level Alarms

Notice-Level Alarms

Informational-Level Alarms

Cisco Unified Serviceability Alarms and CiscoLog Messages

Cisco Unified Serviceability alarms provide information on runtime status and the state of the system, so you can troubleshoot problems that are associated with your system. The alarm or error message information includes the application name, machine name, and recommended action and other critical information to help you troubleshoot.

You use the Trace and Log Central option in the Cisco Unified Real-Time Monitoring Tool (RTMT) to collect alarms that get sent to an SDI or SDL trace log file. To view the alarm information sent to the local syslog, use the SysLog Viewer in RTMT.


CiscoLog Format

CiscoLog, a specification for unified logging in Cisco software applications, gets used in the Cisco Unified RTMT. It defines the message format when messages are logged into file or by using the syslog protocol. The output that is provided by Cisco software applications gets used for auditing, fault-management, and troubleshooting of the services that are provided by these applications.

Be aware that CiscoLog message format is compatible with one of the message formats that is produced by Cisco IOS Release 12.3 by using the syslog protocol when Cisco IOS Software is configured with the following commands:

service sequence-numbers—A default sequence number that is produced by Cisco IOS. An additional sequence number can also be enabled with this command. This command forces sequence numbers to be shown in terminal output, but results in two sequence numbers in the syslog output. CiscoLog standardizes on a format with just one sequence number. Thus, the compliant Cisco IOS Software configuration occurs when the second number is disabled by using the no service sequence-numbers command.

logging origin-id hostname—The CiscoLog HOST field remains consistent with that produced by the Cisco IOS Release 12.3 when configured with this command. This command does not get documented in the Cisco IOS Software documentation but is available in Cisco IOS Release 12.3. CiscoLog stays compatible with the results that Cisco IOS Software produces in this field.

service timestamps log datetime localtime msec show-timezone year—The CiscoLog TIMESTAMP field remains consistent with the timestamp format produced by Cisco IOS Release 12.3 when configured with this command.


Note CiscoLog uses the same field delimiters as Cisco IOS Software Release 12.3.


The following topics are described in this section:

Log File and Syslog Outputs

Standard Syslog Server Implementations

Clock Synchronization

Multipart Messages

CiscoLog Message Format

Internationalization

Versioning

Log File and Syslog Outputs

When CiscoLog messages are written directly into a log file by an application, each message is on a separate line. The line separator should be a standard line separator used on a given platform. On Windows, the line separator must be the sequence of carriage return and line feed characters (ASCII decimal values 13 and 10; often designated as "\r\n" in programming languages). On Solaris and Linux, the line separator is a single line feed character (ASCII decimal value 10 and in programming languages typically "\n"). Two line separators must never appear one after another, for example, you cannot have "\r\n\r\n" on Windows, but "\r\n" is fine because these two characters are a single line separator.

In practical terms, this means that applications should be careful when appending data to an existing log. In some cases an initial line break is required and in others not. For example, if application crashes when writing CiscoLog message, but before it wrote a line break to file, then when the application starts up, it should print an initial line break before printing the next message. An application can determine if an initial line break is necessary during startup by checking the last character sequence in the log file that will be used for appending.

CiscoLog message format is identical for messages written directly to a log file or those generated by using the syslog protocol with two minor exceptions. When CiscoLog messages are written directly into to a file they must be appended with line separators. When CiscoLog messages are sent by using the syslog protocol then the syslog RFC 3164 protocol PRI header must be prepended to each CiscoLog message.

The syslog PRI field encodes syslog message severity and syslog facility. The severity encoded in the PRI field must match the value of the CiscoLog SEVERITY field. Any syslog facility can be used regardless of the content of the message. Typically, a given application is configured to send all its messages to a single syslog facility (usually RFC 3164 facilities local 0 through local 7). Refer to RFC 3164 for details about how to encode the PRI field. Below is an example of a CiscoLog message with the syslog protocol PRI field <165> which encodes the severity level of notice (5) and facility value local4.

<165>11: host.cisco.com: Jun 13 2003 12:11:52.454 UTC: %BACC-5-CONFIG: Configured from 
console by vty0 [10.0.0.0]

Messages as shown in the example above can be sent to UDP port 514 if using RFC 3164 logging mechanism.

Syslog RFC 3164 provides additional guidelines for message content formatting beyond the PRI field. However, RFC 3164 is purely information (not on IETF standards track) and actually allows messages in any format to be generated to the syslog UDP port 514 (see section 4.2 of RFC 3164). The RFC provides observation about content structure often encountered in implementations, but does not dictate or recommend its use. CiscoLog format does not follow these observations due to practical limitations of the format defined in the RFC. For example, the time stamp is specified without a year, time zone or milliseconds while the hostname can only be provided without the domain name.

CiscoLog messages must remain unaltered when relayed. The PRI field is not part of a CiscoLog message, but rather a protocol header. It can be stripped or replaced if necessary. Additional headers or footers can be added to and stripped from the CiscoLog message for transport purposes.

Standard Syslog Server Implementations

Standard syslog server implementations can be configured to forward received log messages or to store the messages locally. Most syslog server implementations strip the PRI field from the received messages and prefix additional information to the message before storage. This additional information typically includes two extra fields: the local time stamp and the host identifier (IP or DNS name) of the server, which generated or relayed the message.

The following example of a CiscoLog message shown the output after being logged by the Solaris 8 syslog server:

Jun 13 12:12:09 host.cisco.com 11: host.cisco.com: Jun 13 2003 12:11:52.454 UTC: 
%BACC-5-CONFIG: Configured from console by vty0 [10.0.0.0]

There is no standard that defines how syslog servers must store messages. Implementations vary greatly. CiscoLog only addresses the format in which messages are sent to the syslog server, not how they are stored by the server that receives them. Specifically, the format and presence of any additional header fields in syslog log files is outside of the scope of this specification.


Note The CiscoLog specification recommends that the syslog server implementation store CiscoLog messages in exactly the same format as it receives them only stripping the PRI field and without any extra headers. This would provide an identical storage format for CiscoLog messages written directly to the log file by an application or logged through syslog protocol.


Clock Synchronization

It is important that the clocks of all hosts of a distributed application be synchronized with one authoritative clock. This can be accomplished by using protocols such as NTP. Clock synchronization is recommended because the time stamps in log messages are required in order to be able to reconstruct the correct sequence of events based on messages originating from multiple processes or multiple hosts. Clock drifts can still occur, but ongoing synchronization should reduce this issue to a minimum.

Multipart Messages

ASCII control characters are not permitted in any of the fields of CiscoLog message format. Control characters include characters such as line feed, form feed and carriage returns. This means that multi-line messages are not allowed unless to allow:

• Better presentation (for example, a stack trace)

• Fragmenting messages which exceed 800 octet limit

Multi-part CiscoLog message consists of a set of multiple valid CiscoLog messages. Messages are grouped together using a special tag key "part", which identifies the part number and the sequence number of the original message.

All messages which are part of a multi-part message must have a "part" tag as well as identical values for the HOST, TIMESTAMP, APPNAME, SEVERITY fields and other TAG values. However, the sequence number of each message has to be incremented as usual.

Example of a multi-part message:

16: host.cisco.com: Jun 13 2003 23:11:52.468 UTC: %BACC-3-UNEXPECTED_EXCEPTION: 
%[pname.orig=rdu][part=16.1/3]: Null pointer exception
17: host.cisco.com: Jun 13 2003 23:11:52.468 UTC: %BACC-3-UNEXPECTED_EXCEPTION: 
%[pname.orig=rdu][part=16.2/3]:   com.cisco.Source:123
18: host.cisco.com: Jun 13 2003 23:11:52.468 UTC: %BACC-3-UNEXPECTED_EXCEPTION: 
%[pname.orig=rdu][part=16.3/3]:   com.cisco.Main:1112

In this example, the first message has part number 1 and its sequence number, 16, embedded in the part tag. Subsequent messages embed the sequence number of the first message part and provide their own part number. The trailing "/3" in each part tag value means that the message consists of three parts.

CiscoLog Message Format

The CiscoLog message format follows:

<SEQNUM>: <HOST>: <TIMESTAMP>: %<HEADER>: [TAGS: ]<MESSAGE>

All fields gets separated by a single colon character (ASCII decimal value 58) and a single space character (ASCII decimal value 32). The HEADER field is also preceded by a percent character (ASCII decimal value 37).

The TIMESTAMP, HEADER and TAGS fields have internal formatting. Below is a complete format with details for TIMESTAMP and HEADER fields:

<SEQNUM>: <HOST>: [ACCURACY]<MONTH> <DAY> <YEAR> <HOUR>:<MINUTES>:<SECONDS>.<MILLISECONDS> <TIMEZONE>: %<APPNAME>-<SEVERITY>-<MSGNAME>: [TAGS: ]<MESSAGE>

All fields except for ACCURACY and TAGS are required.

The following example shows a CiscoLog message:

11: host.cisco.com: Jun 13 2003 23:11:52.454 UTC: %BACC-5-CONFIG: Configured from 
console by vty0 [10.10.10.0]

The following example shows the optional TAGS and ACCURACY fields in a CiscoLog message:

12: host.cisco.com: *Jun 13 2003 23:11:52.454 UTC: %BACC-4-BAD_REQUEST: 
%[pname.orig=rdu][comp=parser][mac=1,6,aa:bb:cc:11:22:33][txn=mytxn123]: Bad request 
received from device [1,6,aa:bb:cc:11:22:33]. Header missing. 

The values of the specific fields in the above example are as follows:

• SEQNUM - "12"

• HOST - "host.cisco.com"

• ACCURACY - "*"

• MONTH - "Jun"

• DAY - "13"

• YEAR - "2003"

• HOUR - "23"

• MINUTES - "11"

• SECONDS - "52"

• MILLISECONDS - "454"

• TIMEZONE - "UTC"

• APPNAME - "BACC"

• SEVERITY - "4"

• MSGNAME - "BAD_REQUEST"

• TAGS - "%[pname.orig=rdu][comp=parser][mac=1,6,aa:bb:cc:11:22:33][txn=mytxn123]"

• MESSAGE - "Bad request received from device [1,6,aa:bb:cc:11:22:33]. Header missing."

Message Length Limit

The maximum length of a complete CiscoLog message must not exceed 800 octets.The term octet is used for 8-bit data type instead of byte because byte is not 8 bits on some platforms. The words "character" and "octet" are not synonyms in parts of this specification because in places were internationalization is supported a single character may need to be represented with multiple octets. This limit is dictated by RFC 3164. The limit of 1024 octets reserves some extra space for syslog forwarding headers and/or fields that may be formalized in later specifications.

When CiscoLog message includes the syslog PRI field, then the combined CiscoLog messages and PRI field length must not exceed 805 octets.

SEQNUM Field

The SEQNUM field contains a sequence number, which can be used to order messages in the time sequence order when multiple messages are produced with the same time stamp by the same process. The sequence number begins at 0 for the first message fired by a process since the last startup and is incremented by 1 for every subsequent logging message originated by the same process. Every time the application process is restarted, its sequence number is reset back to 0. The sequence number of each message must be in the exact order in which messages are fired/logged by the application.

This may mean that in a multi-threaded application there must be some kind of synchronization to ensure this and another consideration may have to be made for Java applications that have some native (C) code in JNI. If log messages originate in both native and Java parts of the same process, the implementation needs to be synchronized to use the same sequence number counter across the two process parts and to fire messages in the order of sequence numbers.

The maximum numeric value of the SEQNUM field is 4,294,967,295 at which point the counter must be reset back to 0. The maximum positive value of a 32-bit unsigned integer as used in Cisco IOS. Cisco IOS uses ulong for the sequence number counter and ulong is a 32-bit unsigned integer on all current Cisco IOS platforms including mips, ppc, and 68k.

Sequence numbers are process specific. If application architecture has multiple application processes on a single host, which share a single logging daemon, the sequence number still has to be process-specific. Thus, each process has it is own sequence number which it increments.

Sequence numbers also help detect lost messages. Therefore, sequence numbers cannot be skipped. In other words, a message must be produced for every number in the sequence order.

HOST Field

The HOST field identifies the system originating the message with a Fully Qualified DNS Name (FQDN), hostname or an IPv4/IPv6 address. If the FQDN or hostname is known, one of the two has to appear in the HOST field. It is expected that in most deployments the hostname is sufficient. However, if a deployment spans multiple domains, then using FQDNs is recommend. If an application is expected to be deployed in both scenarios, then it is recommended that the application default to the FQDNs, but make it a configurable option.

If neither FQDN nor hostname can be identified, then the IP address of the host must be used. If the IP address cannot be identified, then a constant "0.0.0.0" (without quotes) must appear in place of the HOST field.

Note With regards to the compliance with Cisco IOS format. Cisco IOS Release 12.3 supports producing hostname, IP address, or any user-defined string in the HOST field. If it is configured to provide a hostname and it is not set on the device, it will use a string such as "Router."


The length of the HOST field must not exceed 255 octets.

FQDN & Hostname

If multiple FQDNs or hostnames are known for a given system, applications must use the primary FQDN/hostname or an arbitrary one if no primary is designated. However, applications must use the same HOST field value until some relevant configuration change takes place. In other words, the FQDN/hostname value should not arbitrarily change from message to message if system is configured with multiple FQDNs/hostnames.

Only printable US ASCII characters (those with decimal values 32-126) and foreign language characters are allowed in the HOST field when encoding an FQDN or hostname. The appropriate character set and encoding for HOST should be compliant with RFC 1123 / STD-3.

The acceptable character set per these standards includes US ASCII letters, numbers, dash and dot separator characters (although not starting or ending with a dash). The reason that these are only recommendations of adhering to these standards is that, in practice, many hosts do not follow the convention and use characters such as underscore in the hostname. However, the HOST field cannot contain a character sequence of ": " (colon and space) as this sequence is used as a field delimiter in the CiscoLog format.

Foreign language characters outside of the printable US ASCII characters have to be encoded according to internationalization rules.

Use of non-printable (control) ASCII characters is not allowed in the HOST field. Control characters include characters with ASCII decimal values 0-31 and 127. If an application provides a CiscoLog-compliant library with a host string, which includes one or more control characters, the logging library must do the following. If the horizontal tab character (ASCII decimal value 9) is encountered, it must be replaced with one or more space characters (ASCII decimal value 32). Eight spaces per tab are recommended because this is a convention on most Unix and Windows platforms. Other control characters must each be replaced with a question mark character (ASCII decimal value 63).

While DNS is letter-case agnostic, CiscoLog places an additional recommendation of using only lower-case characters in the HOST field for ease of readability. The use of the trailing dot at the end of the FQDN is optional. The following examples are valid HOST fields:

• host123

• host-123

• host123.cisco.com

• host123.cisco.com.

IP Addresses

The IP address value used in the HOST field can be either an IPv4 or IPv6 address. If a device has multiple IP addresses, the primary IP address of the device must be used regardless of the interface through which the CiscoLog message is sent to syslog server. If no primary IP address is designated, a fixed/static IP address is preferred to a dynamically assigned one. If multiple static IP addresses exist, any one can be used, but it must be used consistently in all messages until a relevant configuration event occurs on the system.

• IPv4 Address—IPv4 address should be represented in dot notation "x.x.x.x", where x is a decimal value from 0 to 255 encoded as ASCII text. If an IP address is unknown, "0.0.0.0" (without quotes) must be used as a place holder. Examples of valid IPv4 addresses are 0.0.0.0 and 212.1.122.11.

Below is an example of a message with an IPv4 address in the HOST field:

11: 212.1.122.11: Jun 13 2003 23:11:52.454 UTC: %BACC-3-BAD_REQUEST: Bad request 
received from device [1.2.3.4]. Missing header.

Below is an example of a CiscoLog message when FQDN, hostname or IP are all unknown:

11: 0.0.0.0: Jun 13 2003 23:11:52.454 UTC: %BACC-3-BAD_REQUEST: Bad request received 
from device [1.2.3.4]. Missing header.

• IPv6 Address—IPv6 address representation must follow conventions outlined in RFC 3513, sections 2.2.1, 2.2.2 and 2.2.3. Specifically, all three conventions are supported. Both lower-case and upper-case letters can be used in the IPv6 address, but the lower-case letters are recommended. If an IP address is unknown, "0.0.0.0" (without quotes) should be used as the IP address. Examples of valid IPv6 addresses:

1080:0:0:800:ba98:3210:11aa:12dd (full notation)

1080::800:ba98:3210:11aa:12dd (use of "::" convention)

0:0:0:0:0:0:13.1.68.3 (last 4 octets expanded as in IPv4)

0.0.0.0 (unknown FQDN, hostname and IP address )

Below is an example of a message with an IPv6 address in the HOST field:

11: 1080:0:0:800:ba98:3210:11aa:12dd: Jun 13 2003 23:11:52.454 UTC: 
%BACC-3-BAD_REQUEST:  Bad request received from device [1.2.3.4]. Missing header.

TIMESTAMP Field

The TIMESTAMP field provides date with year, time with milliseconds and a time zone identifier in the following format:

[ACCURACY]<MONTH> <DAY> <YEAR> <HOUR>:<MINUTES>:<SECONDS>.<MILLISECONDS> <TIMEZONE>

Below are several examples of valid time stamps:

Jun 13 2003 23:11:52.454 UTC
Jun  3 2003 23:11:52.454 UTC
Jun 22 2003 05:11:52.525 -0300
*Feb 14 2003 01:02:03.005 EST

In some cases, it is possible that a device may not have the knowledge of the date and/or time due to hardware or software limitations. In such circumstances, the following string must be produced in the TIMESTAMP field: "--- 00 0000 00:00:00.000 ---". Below is an example of a CiscoLog message from a device which has no knowledge of date and/or time:

11: host.domain.com: --- 00 0000 00:00:00.000 ---: %BACC-3-BAD_REQUEST: Bad request 
received from device [1.2.3.4]. Missing header.

Devices which are not aware of their clock, may choose to provide an uptime as a relative measure of time. If device is capable of providing uptime, it is recommended that does so as a substitute for unavailable time stamp. If uptime is provided it must be provided with a standard uptime tag as outlined in the CiscoLog Standard Tags specification.

Table 6-1 details each field specification.

Table 6-1 TIMESTAMP Field Specifications 

Field
Specification

ACCURACY

This is an optional field. If present, it must be either a single asterisk character (ASCII decimal value 42), or a single dot character (ASCII decimal value 46). No separator character is used after this field. This field indicates the status of clock synchronization.

Cisco IOS uses a special convention for time prefixes to indicate the accuracy of the time stamp. If dot character appears before the date, it means that the local time was synchronized at some point via NTP, but currently no NTP servers are available. The asterisk character in front of the date means that the local time is not authoritative, i.e. NTP servers are not setup.

 

CiscoLog supports the use of this convention, but does not require it. If an application is integrated with NTP client software, and knows that its time is out of sync, then it can optionally prefix the message with asterisk character. However, because applications may choose not to use this scheme, the lack of "." or "*" in CiscoLog messages should not be interpreted to mean that the local time is synchronized.

MONTH

Must be one of the following three-character month designations followed by a single space (ASCII decimal value 32) as a delimiter character: Jan, Feb, Mar, Apr, May, Jun, Jul, Sep, Oct, Nov or Dec.

DAY

Must consist of two characters. If day is a single digit, it must be prefixed with a single space character. The acceptable range of values is from 1 to 31. The day value must be followed by a single space as a delimiter character.

YEAR

Must consist of exactly 4 digit characters followed by a space as a delimiter character.

HOUR

Must consist of exactly two number characters. The hour value is based on a 24-hour clock. Values range from 00 to 23. If hour value is a single digit, it must be prefixed with a single zero character. The hour value must be followed by a single colon as a delimiter character.

MINUTES

Must consist of exactly two number characters. Values range from 00 to 59. If minute value is a single digit, it must be prefixed with a single zero character. The minutes value must be followed by a single colon as a delimiter character

SECONDS

Must consist of exactly two number characters. Values range from 00 to 59. If seconds value is a single digit, it must be prefixed with a single zero character. The seconds value must be followed by a period as a delimiter character.

MILLISECONDS

Must consist of exactly 3 digit characters. Values range from 000 to 999. If milliseconds value is less then 3 digits in length it must be prefixed with extra zeros to make it a 3-character field. The milliseconds value is followed by a space as a delimiter character.

TIMEZONE

Must consist of at least one, but no more than 7 characters in the following ASCII decimal value range: 32-126. The value must not include a combination of colon-space-percent of characters - ": %" (ASCII decimal values 58, 32, 37) - as this character combination is reserved as a field delimiter that follows the time stamp.

There is no standard set of acronyms for time zones1 . A list of common time zone acronyms and corresponding time offsets from UTC is provided in the UTC specification.

Uppercase letters are recommended for time zone acronym values. CiscoLog recommends the use of time offset instead of time zone identifier in this field. The offset, if provided, must follow the following format "-hhmm" or "+hhmm" to indicate hour and minute offset from UTC.

 

In this format time zone field must always contain 5 characters, with the last 4 characters being constrained to numbers only. Unlike a textual time zone identifier, this format provides a specific time offset from universal standard time.

 

Cisco IOS Release 12.3 supports any 7-character string as a time zone identifier, so it can be configured in a way which is compatible with this recommendation. Multiple messages may and sometimes must be produced with exactly the same time stamp. This can happen naturally on a non-preemptive operating system or may need to be deliberately induced as in the case of multi-part messages. Sequence numbers then become helpful for establishing message order. Time stamp should always be accurate to the millisecond unless it can significantly hinder performance of the application.

In either case, applications must always provide the administrator with an option to output messages with exact time stamp in milliseconds. If an application uses time stamp with accuracy to the second (instead of a millisecond), it must put the last known milliseconds value or 000 in place of the milliseconds. Whatever convention is chosen by the application, it should be followed consistently.

1 Neither Cisco IOS nor CiscoLog define a standard set of time zone acronyms because there is no single established standard.


HEADER Field

The HEADER field has the following format:

<APPNAME>-<SEVERITY>-<MSGNAME>

A single dash character (ASCII decimal value 45) serves a separator for the three fields.

APPNAME Field

The APPNAME field in the HEADER defines the name of the application producing the message. Cisco IOS uses FACILITY in place of APPNAME that names the logical component producing the message. Cisco IOS 12.3 defines approximately 287 facilities for 3950 messages. Example of some easily recognizable facilities: AAAA, SYS, ATM, BGP, CRYPTO, ETHERNET, FTPSERVER, CONFIG_I, IP, ISDN, RADIUS, SNMP, SYS, TCP, UBR7200, X25. A complete list of defined facilities is available in Cisco IOS documentation at http://.

Outside of the Cisco IOS, there can be multiple applications on the same host originating log messages. Therefore, it is necessary that APPNAME field identify the specific application. Additional source identifiers are available in the HOST field as well as various standard TAGS field values (pname, pid, comp, etc).

The APPNAME field must consist of at least two uppercase letters or digits and may include underscore characters. More precisely, the acceptable character set is limited to characters with the following ASCII decimal values: 48-57 (numbers), 65-90 (upper-case letters) and 95 (underscore).

The length of the APPNAME field must not exceed 24 characters.

Application names cannot conflict with other Cisco software applications and with Cisco IOS facilities.

On the Solaris platform, it is recommended (not required) that the application name values used in the APPNAME field be consistent with those used for the application installation package name, only in upper case and without the CSCO prefix. For example, an application registering as "CSCObacc" on Solaris should use "BACC" as the value of the APPNAME field.

Some applications may choose to specify a version as part of the APPNAME field. This is acceptable and may be useful in cases where the meaning of certain messages is redefined from one release to another. For example, an APPNAME value could be "BACC_2_5" for BACC version 2.5. The use the version within an application name is optional and may be introduced by applications in any release.

SEVERITY Field

The SEVERITY field is a numeric value from 0 to 6, providing seven different severities. The severities defined below match Cisco IOS severity levels. They are also standard syslog severities.

It is important that messages use the correct severity. An error in a certain component may be severe as far as the component is concerned, but if the overall application handles it gracefully, then the severity may be lower for the application as a whole. Table 6-2 lists guidelines that should be followed in determining the severity of a message.

Table 6-2 Name and Severity Level and Descriptions in Error Messages 

Name/
Severity Level
Description

Emergency (0)

System or service is unusable. Examples:

• Service repeatedly fails to startup

• System ran out of disk space while disk space is essential for this system to operate

• Application requires root privileges to run but does not have them

Alert (1)

Action must be taken immediately. Examples:

• Application is about to run out of licenses

• Application is about to run out of disk space

• Too many unauthorized access attempts detected

• Denial of service attack is detected

Critical (2)

Critical condition. Similar to alert, but not necessarily requiring an immediate action. Examples:

• Received an invalid authentication request

• Service crashed due to an error that could not be handled, like an out of memory condition, (provided it has a watchdog process to restart it, it does not necessarily require immediate action)

• Unexpected code error that could not be handled

Error (3)

An error condition, which does not necessarily impact the ability of the service to continue to function. Examples:

• Problem parsing/processing a particular request which does not prevent the application from handling other requests

• Unexpected, but handled code exception

Warning (4)

A warning about some bad condition, which is not necessarily an error. Examples:

• Lost network connection to some resource

• Timed out waiting for a response

Notice (5)

Notifications about system-level conditions, which are not error conditions. Examples:

• Configuration was updated (not audit level information)

• Process has started

• Process is shutting down gracefully on request

Informational (6)

Informational messages are distinguished from notification in that they provide information for internal flows of the application or per-request information instead of system-wide notifications. Informational messages are used for troubleshooting by users who are familiar with the basic flows of the application. Examples:

• Request received

• Request was parsed successfully

• Request being processed

• Response sent back

• Acknowledgement received

• Detailed audit information


If an application uses a default severity level to determine which messages should be logged, then it is recommended that this level be set at 5 (notice). This ensures that all messages of severity 5 or higher are logged by default.

MSGNAME Field

The MSGNAME field of the HEADER uniquely identifies the message within the context of a given APPNAME. A fixed severity and logical meaning is associated with a specific MSGNAME within a specific APPNAME. In other words, the same message name cannot appear with different severity or a completely different logical meaning for the same APPNAME value even if the message is originated by a different process.

Message names are only unique within a given application (a given APPNAME value) unless the message is one of the standard messages. Thus, applications interpreting CiscoLog messages should be careful not to assume that a message with a given name has the same meaning for all applications that may use this message name. Indeed, if the message is not one of the standard messages, it may have a different severity and meaning in a different application.

The MSGNAME field must consist of at least two characters. Acceptable characters are limited to the following ASCII decimal values: 48-57 (numbers), 65-90 (upper-case letters) and 95 (underscore). While IOS allows lower-case letters as well, the vast majority of IOS messages use only the upper-case letters. In order to be consistent with established conventions we opted to restrict the character set to upper-case letters, numbers and underscore characters.

Both numeric-only or alphanumeric message names are acceptable. However, per IOS convention, it is recommended that a user-friendly alphanumeric label be preferred to a numeric-only label. For example, "NO_MEMORY" message name is preferred to a "341234" identifier.

A special tag mid is defined in the CiscoLog Standard Tags specification for identifying a numeric id corresponding to a message name. This tag can be used to provide a numeric message is in addition to the MSGNAME. When this tag is used, a given MSGNAME must always correspond to a single message id value. CiscoLog defines mid tag values for each standard message.

The length of the MSGNAME field must not exceed 30 characters, but most message names should be more concise. MSGNAME value may not conflict with the names defined in this standard.

A separate message name must be defined for each logically different message. In other words, while the message text for a given message name can vary by virtue of some substitutable parameters, logically different messages must have different message names.

The following is an example of correct use of message name:

11: host.cisco.com: Jun 13 2003 23:11:52.454 UTC: %BACC-4-CONNECTION_LOST: 
%[pname.orig=rdu]: Server lost connection to host [1.1.1.1]
12: host.cisco.com: Jun 13 2003 23:11:52.458 UTC: %BACC-4-CONNECTION_LOST: 
%[pname.orig=rdu]: Server lost connection to host [2.2.2.2] 

Notice that while the IP address of the host changes, it is still logically the same type of message. The following is an example of an INCORRECT use of the message name:

15: host.cisco.com: Jun 13 2003 23:11:52.458 UTC: %BACC-4-CONNECTION: 
%[pname.orig=rdu]: Server lost connection to host [2.2.2.2]
16: host.cisco.com: Jun 13 2003 23:11:52.468 UTC: %BACC-4-CONNECTION: 
%[pname.orig=rdu]: Server re-established connection to host [2.2.2.2]

The use of a single message name for two different events in the above example is wrong and unacceptable. This is referred to as a "catch-all" message name and they must be avoided. Another extreme example is defining a message named "ERROR" and providing all error log messages under the same message name. This defeats the purpose of having the message name field, which is to enable external filtering of messages or easily trigger actions.

The only exception to the "no-catch-all" rule is when message cannot be identified ahead of time with anything better than a generic description or the users will not benefit from distinguishing the various subtypes of the message.

Although some applications may choose to do so, there is generally no need to define a separate message name for all debugging messages because debugging messages are not intended for automated filtering and action triggering based on message name. The sheer number of debugging messages and the highly dynamic nature of what is produced in them makes it very hard to define separate messages.

This specification proposes establishing a mailing list that could be used by groups for consulting purposes when in doubt about how to define certain messages. Currently, the mailing list alias used for this purpose is "cmn-logging".

TAGS Field

The TAGS field is optional in the message format. It provides a standard mechanism for applications to provide structured content in the form of key-value pairs which can be used to categorize or filter a set of messages externally.

Tags can be used to identify virtual logging channels. A set of messages flagged with the same tag can later be grouped together. For example, an application may flag messages belonging to a particular thread by supplying the corresponding tag. This would then allow filtering and viewing messages based on threads.

Virtual logging channels can also be established across multiple applications. For example, if all applications could tag requests from a device with device id (mac, ip, etc), then it would be easy to filter all messages related to that device even thought it communicates with multiple components.

Each application may define its own set of supported tags. A single tag consists of key and value pair separated by the equals sign and surrounded by square bracket characters as in the following format: [KEY=VALUE]. This is an example of a valid tag key-value pair [ip=123.23.22.22].

The TAGS field is prefixed with a percent character (ASCII decimal value 37) and ends with a sequence of colon and space characters (ASCII decimal values 58 and 32). When multiple tags are assembled together, no characters should appear between the tags as separators. The following example has a complete CiscoLog message with four tags:

12: host.cisco.com: Jun 13 2003 23:11:52.454 UTC: %BACC-4-BAD_REQUEST:  
%[pname.orig=rdu][comp=parser][mac=1,6,aa:bb:cc:11:22:33][txn=mytxn123]: Bad request 
received from device [1,6,aa:bb:cc:11:22:33]. Missing header.

If TAGS field is missing, the percent character prefix and the trailing colon and space must be omitted. Thus, when the TAGS field is missing, the HEADER and MESSAGE fields must be separated by just a single colon and a space which follows the HEADER field. For example:

12: host.cisco.com: Jun 13 2003 23:11:52.454 UTC: %BACC-4-BAD_REQUEST: Bad request 
received from device [1,6,aa:bb:cc:11:22:33]. Missing header.

Multiple tags with the same tag key can be provided in the same message. This essentially provides the capability for handling multi-valued keys. Below is an example of a message produced from a device which has two IP addresses where the application chose to provide both IP addresses in the TAGS field as well as the process name:

12: host.cisco.com: Jun 13 2003 23:11:52.454 UTC: %BACC-4-BAD_REQUEST:  
%[pname.orig=rdu][ip.orig=1.1.1.1][ip.orig=1.1.1.2]: Bad request received from device 
[1,6,aa:bb:cc:11:22:33]. Missing header.

Any number of tags can be provided in a given message. The only limit is the overall length limit of the CiscoLog message of 800 octets.

If multiple tags are present, it is recommended that they appear in the alphanumeric order of the keys. This insures that tags are always produced in the same order. However, a different order may be chosen by an application if the order of tags is used to communicate some semantic value.

Tag Keys

Tag key must contain at least one character. The characters are limited to ASCII characters with decimal values 48-57 (numbers), 65-90 (upper-case letters), 95 (underscore), 97-122 (lower case letters). Use of lower-case letters is recommended. There is no strict limit on tag key length, although a general message limit of 800 octets applies and dictates that one should attempt to define short tag key names.

Tag Semantic Extensions

In some cases, a tag can have a standard value syntax, but different meaning depending on the content in which it is used. Tag semantic extensions are used to differentiate the contextual meaning of tags.

The semantic extension tags are created by appending the tag key with a single dot character (ASCII decimal value 46) and a text string consisting of characters from a proper character set.

For example, an "ip" tag defines syntax for an IP address representation, but no semantic value. An "ip" tag found in a CiscoLog message generally means only that this IP address is somehow related to the message. In some cases, such vague association is sufficient. However, sometimes, communicating semantic value could be useful.

A message may have two IP address tags associated with it, for example, from and to IP addresses. In this case, using tags "ip.from" and "ip.to" would communicate both the syntax of the tags and some semantic value. Another example, is a standard tag "ip.orig", which specifies the IP address of the host which originated the message. The following is an example of all three tags appearing together:

[ip.from=1.1.1.1][ip.to=2.2.2.2][ip.orig=123.12.111.1]

Multiple levels of semantic extension tags are allowed with each extension providing meaning that is more specific. For example, tag key "ip.to.primary" is valid and could mean the primary IP address of the destination host.

The semantic value is much harder to standardize than the syntax because there can an infinite number of meanings for a given value depending on the context. Thus, it is anticipated that defining tag semantics extensions will be largely application specific.

Tag Values

Tag values may contain zero or more characters. The empty (zero characters) value is interpreted as unknown or undetermined value. The value must only include printable US ASCII characters (those in the ASCII decimal value range 32-126) and foreign language characters

There is a restriction on the use of three characters: "[", "]" and "\". The bracket characters (ASCII decimal values 91 & 93) must be escaped with a back slash character (ASCII decimal value 92) . This helps to avoid confusion with the brackets that signify the start/end of the tag. Thus, when the tag value needs to represent characters "[" or "]", a sequence of "\[" or "\]" is used instead respectively. When the escape character itself needs to be represented in the tag value, then instead of the "\" character a sequence of "\\" is used.

Use of non-printable (control) ASCII characters is not allowed in the TAG value field. Control characters include characters with ASCII decimal values 0-31 and 127. If application provides to a CiscoLog-compliant library a tag value string, which includes one or more control characters, the logging library must do the following. If the horizontal tab character (ASCII decimal value 9) is encountered, it must be replaced with one or more space characters (ASCII decimal value 32). Eight spaces per tab are recommended because this is a convention on most Unix and Windows platforms. Other control characters must each be replaced with a question mark character (ASCII decimal value 63). Technically, we only need to require escaping a closing bracket. However, requiring escaping both open and closing brackets simplifies parser code and provides for a more consistent display in raw form.

There is no strict limit on tag value length; although a general message length limit of 800 octets applies and dictates that one must be conservative.

Tag Guidelines

The TAGS field is optional in the CiscoLog message format. Tags do not replace substitutable parameters in the message body. Tags merely provide an additional way to identify and categorize messages.

Since tags are optional, they can be enabled or disabled by the application/user as required. There is no requirement for the same message to always be produced with the same set of tags. If the application supports a given tag, it does not necessarily mean that it must always produce it. This can be configurable. Indeed, it is recommended that applications provide the administrator with at least limited control over which tags get produces.

Application developers have a choice as to what information to make available in the tags and what in the message body. In some cases, the information may be duplicated between the two. This is acceptable.

The general guideline is to put all required information in the message body and make appropriate information available via tags. In other words, the message should provide sufficient meaning even when all tags are disabled. Tags merely provide additional useful information and a way to present it in a standard, easily filtered, form.

The following are two valid examples of a message where both the message and the message tags contain a MAC address. Example with tags disabled:

11: host.cisco.com: Jun 13 2003 23:11:52.454 UTC: %BACC-3-BAD_REQUEST: Bad request 
received from device [1,6,aa:bb:11:22:33:aa]. Missing header.

In the above example, the MAC address appears as part of the message field - it is not a tag. In the following example, the tags are enabled. Even though MAC address is duplicated between the tag and the message, it is acceptable.

11: host.cisco.com: Jun 13 2003 23:11:52.454 UTC: %BACC-3-BAD_REQUEST:  
%[mac=1,6,aa:bb:11:22:33:aa][tid=thread1][txn=mytxn123]: Bad request received from 
device [1,6,aa:bb:11:22:33:aa]. Missing header.

Process Identification Tag

One of the standard tags, pname.orig, is used to identify the logical process name which originates the message. Any application that seeks to provide originating process information must do so using the "pname.orig" tag.

This tag is extremely valuable in addition to information in the APPNAME field because some applications consist of multiple processes, each of which may originate logging messages. It is recommended that any application which consists of multiple processes always provide the "pname.orig" tag.

MESSAGE Field

The MESSAGE field provides a descriptive message about the logging event. This field may consist of one or more characters. The character set is limited to printable US ASCII characters (ASCII decimal values 32-126) and foreign language characters.

Use of non-printable (control) ASCII characters is not permitted in the MESSAGE field. Control characters include characters with ASCII decimal values 0-31 and 127. If application provides a CiscoLog-compliant library with message string, which includes one or more control characters, the logging library must do the following. If the horizontal tab character (ASCII decimal value 9) is encountered, it must be replaced with one or more space characters (ASCII decimal value 32). Eight spaces per tab are recommended because this is a convention on most Unix and Windows platforms. Other control characters must each be replaced with a question mark character (ASCII decimal value 63).

The maximum length of the MESSAGE field is constrained only by the maximum length of the entire message. The maximum length of the CiscoLog message must not exceed 800 octets. Another practical limitation is a potentially highly variable length of the TAGS field.

Message text may contain substitutable parameters, which provide necessary details about the message. For example, the IP address in the following example is a substitutable parameter.

11: host.cisco.com: Jun 13 2003 23:11:52.454 UTC: %BACC-3-INVALID_REQUEST: Invalid 
request received from device [1.22.111.222]. Missing header. 

It is recommended (but not required) that substitutable parameters be surrounded by bracket characters "[" and "]" as in the above example. It is further recommended that the message text and values of substitutable parameters do not include bracket characters. When it is not possible to avoid brackets characters in the values of substitutable parameters, it is recommended that the value at least does not include unbalances brackets (like an opening bracket without a closing one). When these recommendations are followed, it would be possible to programmatically extract substitutable parameter values out of a CiscoLog message. However, this recommendation is not a strict requirement.

Message text should be spell-checked. Editorial review is recommended. This includes all messages that can be seen by the customers, even debugging messages.

If the first word of the message is an English word, the first letter should be capitalized. Single sentence messages do not require a period at the end.

Internationalization

Foreign language characters are defined as characters with ASCII decimal values 0-126. Foreign language characters are supported in the HOST field, the value part of the TAGS field and the MESSAGE field.

Foreign language characters must be encoded using the Unicode standard UTF-8. UTF-8 provides encoding for any language without requiring the application to know local encoding/decoding rules for a particular language. In fact, the application encoding the message does not even need to know the language of the message. UTF-8 can encode any Unicode character.

UTF-8 encodes US ASCII characters exactly as they would normally be encoded in a 7-bit ASCII convention. This means that applications interpreting CiscoLog messages can assume that entire messages are encoded in UTF-8. On the other hand, applications producing CiscoLog messages can encode the entire message using US-ASCII 7-bit convention if they are known not to support foreign languages in their products.

Since UTF-8 can encode characters in any language, it is possible to mix and match languages. For example, it is anticipated that a one use-case would be the inclusion of just some parameters in foreign language in an otherwise English message. For example, an English message about user authentication could have a username in Japanese. Similarly, any number of languages can be combined in a CiscoLog message.

In order to take advantage of messages, which include a foreign language, a log viewer capable of interpreting UTF-8 would be necessary. Most likely, the log viewer would also require that the appropriate language fonts be installed on a given system. In a US-ASCII only editor, the user will see garbage for non-US-ASCII characters encoded in UTF-8, but should be able to see all US-ASCII text.

Internationalization support can be readily used with CiscoLog messages written to a local file. Syslog RFC 3164, however, does not currently define foreign language support. Thus, in order to take advantage of internationalization with a syslog server, one would need to use a server implementation, which was tested to correctly relay or store all 8-bits of each octet unchanged. This would ensure that UTF-8 encoded parts of the message retain all their information when foreign languages are used.

In UTF-8, a single character is encoded with one or more octets. The CiscoLog message length limit is specified as 800 octets. Developers must be aware that with foreign languages, the 800-octet length limit may mean fewer than 800 characters. When a message is split into a multi-part message using guidelines provided in Multipart Messages, octets belonging to a single character must never be split into separate lines.

Versioning

CiscoLog does not provide any versioning information in the message format. Extensions to the format must be made within the restrictions of the format. CiscoLog message formats provides for extensions by way of defining additional tags.

If applications require changes to existing messages, the value of APPNAME can redefine message within the new space. For example, the application version can be appended to the application name as BACC_2_5 for BACC 2.5.

Preconfigured System Alarm Notifications

The following list contains the preconfigured system alerts in RTMT. Refer to the Real-Time Monitoring Tool Administration Guide for information on configuration.

AuthenticationFailed

CiscoDRFFailure

CoreDumpFileFound

CpuPegging

CriticalServiceDown

HardwareFailure

LogFileSearchStringFound

LogPartitionHighWaterMarkExceeded

LogPartitionLowWaterMarkExceeded

LowActivePartitionAvailableDiskSpace

LowAvailableVirtualMemory

LowInactivePartitionAvailableDiskSpace

LowSwapPartitionAvailableDiskSpace

ServerDown

SparePartitionHighWaterMarkExceeded

SparePartitionLowWaterMarkExceeded

SyslogSeverityMatchFound

SyslogStringMatchFound

SystemVersionMismatched

TotalProcessesAndThreadsExceededThreshold

AuthenticationFailed

Authentication validates the user ID and password that are submitted during log in. An alarm gets raised when an invalid user ID and/or the password gets used.

Table 6-3 provides the default configuration for the AuthenticationFailed RTMT Alert.

Table 6-3 Default Configuration for the AuthenticationFailed RTMT Alert 

Value
Default Configuration

Enable Alert

Selected

Severity

Critical

Enable/Disable this alert on the following servers

Enabled on listed servers

Threshold

Number of AuthenticationFailed events exceeds:

1 time in the last 1 minute

Duration

Trigger alert immediately

Frequency

Trigger alert on every poll

Schedule

24 hours daily

Enable e-mail

Selected

Trigger Alert Action

Default


CiscoDRFFailure

This alert occurs when the DRF backup or restore process encounters errors.

Table 6-4 provides the default configuration for the CiscoDRFFailure RTMT Alert.

Table 6-4 Default Configuration for the CiscoDRFFailure RTMT Alert 

Value
Default Configuration

Enable Alert

Selected

Severity

Critical

Enable/Disable this alert on the following servers

Enabled on listed servers

Threshold

Trigger alert when following condition met:

CiscoDRFFailure event generated

Duration

Trigger alert immediately

Frequency

Trigger alert on every poll

Schedule

24 hours daily

Enable E-mail

Selected

Trigger Alert Action

Default


CoreDumpFileFound

This alert occurs when the CoreDumpFileFound event gets generated. This indicates that a core dump file exists in the system.

Table 6-5 provides the default configuration for the CoreDumpFileFound RTMT Alert.

Table 6-5 Default Configuration for the CoreDumpFileFound RTMT Alert 

Value
Default Configuration

Enable Alert

Selected

Severity

Critical

Enable/Disable this alert on the following servers

Enabled on listed servers

Threshold

Trigger alert when following condition met:

CoreDumpFileFound event generated

Duration

Trigger alert immediately

Frequency

Trigger alert on every poll

Schedule

24 hours daily

Trace download Parameters

Not Selected

Enable E-mail

Selected

Trigger Alert Action

Default


CpuPegging

CPU usage gets monitored based on configured thresholds. If the usage goes above the configured threshold, this alert gets generated.

Table 6-6 provides the default configuration for the CpuPegging RTMT Alert.

Table 6-6 Default Configuration for the CpuPegging RTMT Alert 

Value
Default Configuration

Enable Alert

Selected

Severity

Critical

Enable/Disable this alert on the following servers

Enabled on listed servers

Threshold

Trigger alert when following condition met:

99%

Duration

Trigger alert only when value remains constantly below or over threshold for 60 seconds

Frequency

Trigger up to 3 alerts within 30 minutes

Schedule

24 hours daily

Enable E-mail

Selected

Trigger Alert Action

Default


CriticalServiceDown

The CriticalServiceDown alert gets generated when the service status equals down (not for other states).

Table 6-7 provides the default configuration for the CriticalServiceDown RTMT Alert.

Table 6-7 Default Configuration for the CriticalServiceDown RTMT Alert 

Value
Default Configuration

Enable Alert

Selected

Severity

Critical

Enable/Disable this alert on the following servers

Enabled on listed servers

Threshold

Trigger alert when following condition met:

Service status is DOWN

Duration

Trigger alert immediately

Frequency

Trigger alert on every poll

Schedule

24 hours daily

Trace download Parameters

Enable Trace Download not selected

Enable E-mail

Selected

Trigger Alert Action

Default


HardwareFailure

This alert occurs when a hardware failure event (disk drive failure, power supply failure, and others) triggers.

Table 6-8 provides the default configuration for the HardwareFailure RTMT Alert.

Table 6-8 Default Configuration for the HardwareFailure RTMT Alert 

Value
Default Configuration

Enable Alert

Selected

Severity

Critical

Enable/Disable this alert on the following servers

Enabled on listed servers

Threshold

Trigger alert when following condition met:

HardwareFailure event generated

Duration

Trigger alert immediately

Frequency

Trigger alert on every poll

Schedule

24 hours daily

Enable E-mail

Selected

Trigger Alert Action

Default


LogFileSearchStringFound

This alert occurs when the LogFileSearchStringFound event gets generated. This indicates that the search string was found in the log file.

Table 6-9 provides the default configuration for the LogFileSearchStringFound RTMT Alert.

Table 6-9 Default Configuration for the LogFileSearchStringFound RTMT Alert 

Value
Default Configuration

Enable Alert

Selected

Severity

Warning

Enable/Disable this alert on the following servers

Enabled on listed servers

Threshold

Trigger alert when following condition met:

LogFileSearchStringFound event generated

Duration

Trigger alert immediately

Frequency

Trigger alert on every poll

Schedule

24 hours daily

Enable E-mail

Selected

Trigger Alert Action

Default


LogPartitionHighWaterMarkExceeded

This alert occurs when the percentage of used disk space in the log partition exceeds the configured high water mark. When this alert gets generated, LPM deletes files in the log partition (down to low water mark) to avoid running out of disk space.


Note LPM may delete files that you want to keep. You should act immediately when you receive the LogPartitionHighWaterMarkExceeded alert.


Table 6-10 provides the default configuration for the LogPartitionHighWaterMarkExceeded RTMT Alert.

Table 6-10 Default Configuration for the LogPartitionHighWaterMarkExceeded
RTMT Alert 

Value
Default Configuration

Enable Alert

Selected

Severity

Critical

Enable/Disable this alert on the following servers

Enabled on listed servers

Threshold

Trigger alert when following condition met:

Log Partition Used Disk Space Exceeds High Water Mark (95%)

Duration

Trigger alert immediately

Frequency

Trigger alert on every poll

Schedule

24 hours daily

Enable E-mail

Selected

Trigger Alert Action

Default


LogPartitionLowWaterMarkExceeded

This alert occurs when the LogPartitionLowWaterMarkExceeded event gets generated. This indicates that the percentage of used disk space in the log partition exceeded the configured low water mark.


Note Be aware that this alert is an early warning. The administrator should start freeing up disk space. Using RTMT/TLC, you can collect trace/log files and delete them from the server. The administrator should adjust the number of trace files that are kept to avoid hitting the low water mark again.


Table 6-11 provides the default configuration for the LogPartitionLowWaterMarkExceeded RTMT Alert.

Table 6-11 Default Configuration for the LogPartitionLowWaterMarkExceeded RTMT Alert 

Value
Default Configuration

Enable Alert

Selected

Severity

Critical

Enable/Disable this alert on the following servers

Enabled on listed servers

Threshold

Trigger alert when following condition met:

Log Partition Used Disk Space Exceeds Low Water Mark (95%)

Duration

Trigger alert immediately

Frequency

Trigger alert on every poll

Schedule

24 hours daily

Enable E-mail

Selected

Trigger Alert Action

Default


LowActivePartitionAvailableDiskSpace

This alert occurs when the percentage of available disk space on the active partition is lower than the configured value.

Table 6-12 provides the default configuration for the LowActivePartitionAvailableDiskSpace RTMT Alert.

Table 6-12 Default Configuration for the LowActivePartitionAvailableDiskSpace
RTMT Alert 

Value
Default Configuration

Enable Alert

Selected

Severity

Critical

Enable/Disable this alert on the following servers

Enabled on listed servers

Threshold

Trigger alert when following condition met:

Active Partition available diskspace below (4%)

Duration

Trigger alert immediately

Frequency

Trigger up to 3 alerts within 30 minutes

Schedule

24 hours daily

Enable E-mail

Selected

Trigger Alert Action

Default


LowAvailableVirtualMemory

RTMT monitors virtual memory usage. When memory runs low, a LowAvailableVirtualMemory alert gets generated.

Table 6-13 provides the default configuration for the LowAvailableVirtualMemory RTMT Alert.

Table 6-13 Default Configuration for the LowAvailableVirtualMemory RTMT Alert 

Value
Default Configuration

Enable Alert

Selected

Severity

Critical

Enable/Disable this alert on the following servers

Enabled on listed servers

Threshold

Trigger alert when following condition met:

Available virtual memory below (30%)

Duration

Trigger alert immediately

Frequency

Trigger up to 3 alerts within 30 minutes

Schedule

24 hours daily

Enable E-mail

Selected

Trigger Alert Action

Default


LowInactivePartitionAvailableDiskSpace

This alert occurs when the percentage of available disk space of the inactive partition equals less than the configured value.

Table 6-14 provides the default configuration for the LowInactivePartitionAvailableDiskSpace RTMT Alert.

Table 6-14 Default Configuration for the LowInactivePartitionAvailableDiskSpace RTMT Alert 

Value
Default Configuration

Enable Alert

Selected

Severity

Critical

Enable/Disable this alert on the following servers

Enabled on listed servers

Threshold

Trigger alert when following condition met:

Inactive Partition available disk space below (4%)

Duration

Trigger alert immediately

Frequency

Trigger up to 3 alerts within 30 minutes

Schedule

24 hours daily

Enable E-mail

Selected

Trigger Alert Action

Default


LowSwapPartitionAvailableDiskSpace

This alert indicates that the available disk space on the swap partition is low.


Note The swap partition makes up part of virtual memory, so low available swap partition disk space means low virtual memory as well.


Table 6-15 provides the default configuration for the LowSwapPartitionAvailableDiskSpace RTMT Alert.

Table 6-15 Default Configuration for the LowSwapPartitionAvailableDiskSpace
RTMT Alert 

Value
Default Configuration

Enable Alert

Selected

Severity

Critical

Enable/Disable this alert on the following servers

Enabled on listed servers

Threshold

Trigger alert when following condition met:

Swap Partition available disk space below (105)

Duration

Trigger alert immediately

Frequency

Trigger up to 3 alerts within 30 minutes

Schedule

24 hours daily

Enable E-mail

Selected

Trigger Alert Action

Default


ServerDown

This alert occurs when a remote node cannot be reached.


Note Cisco Unified CM clusters only—The ServerDown alert gets generated when the currently "active" AMC (primary AMC or the backup AMC, if the primary is not available) cannot reach another server in a cluster. This alert identifies network connectivity issues in addition to a server down condition.


Table 6-16 provides the default configuration for the ServerDown RTMT Alert.

Table 6-16 Default Configuration for the ServerDown RTMT Alert 

Value
Default Configuration

Enable Alert

Selected

Severity

Critical

Enable/Disable this alert on the following servers

Enabled on listed servers

Threshold

Trigger alert when following condition met:

ServerDown occurred

Duration

Trigger alert immediately

Frequency

Trigger up to 1 alert within 60 minutes

Schedule

24 hours daily

Enable E-mail

Selected

Trigger Alert Action

Default


SparePartitionHighWaterMarkExceeded

This alert occurs when the SparePartitionHighWaterMarkExceeded event gets generated. It indicates that the percentage of used disk space in the spare partition exceeds the configured high water mark. Some core file or log files are purged until the percentage of used disk space in the spare partition is below the configured low water mark. Check if the configured high water mark for used disk space in the spare partition is too low.

Cisco Log Partition Monitoring Tool (LPM) starts purging trace log files in the spare partition and keeps deleting trace log files in the spare partition until spare partition disk usage is just below the low water mark.

Name of the service generating this alarm is Cisco Log Partition Monitoring Tool.

Check if the configured high water mark for used disk space in the spare partition is too low; if it is, change the high water mark setting to a higher value. Also examine each application trace log files under spare partition and delete those trace log files that are too old or too big.


Note Spare Partition is not used for Intercompany Media Engine server. So this alert will not be triggered for Intercompany Media Engine.


Table 6-17 provides the default configuration for the SparePartitionHighWaterMarkExceeded RTMT Alert.

Table 6-17 Default Configuration for the SparePartitionHighWaterMarkExceeded RTMT Alert 

Value
Default Configuration

Enable Alert

Selected

Severity

Critical

Enable/Disable this alert on the following servers

Enabled on listed servers

Threshold

Trigger alert when following condition met:

Spare Partition Used Disk Space Exceeds High Water Mark (95%)

Duration

Trigger alert immediately

Frequency

Trigger alert on every poll

Schedule

24 hours daily

Enable E-mail

Selected

Trigger Alert Action

Default


SparePartitionLowWaterMarkExceeded

This alert occurs when the SparePartitionLowWaterMarkExceeded event gets generated. It indicates that the percentage of used disk space in the spare partition has exceeded the configured low water mark threshold. There are files to be purged by Cisco Log Partition Monitoring Tool (LPM). If the spare partition disk usage keeps increasing until it exceeded the configured high water mark, Cisco LPM starts purging the trace log files in the spare partition. Cisco LPM sends the alarm periodically if the spare partition disk usage has not changed.

Name of the service generating this alarm is Cisco Log Partition Monitoring Tool.

Check if the configured low water mark for used disk space in the spare partition is too low; if, change the low/high water mark settings to the higher values. Also examine each application trace log files under spare partition and clean up those trace log files that are too old or too big before the used disk space exceeds the high water mark.


Note Spare Partition is not used for Intercompany Media Engine server. So this alert will not be triggered for Intercompany Media Engine.


Table 6-18 provides the default configuration for the default configuration for the SparePartitionLowWaterMarkExceeded RTMT Alert.

Table 6-18 Default Configuration for the SparePartitionLowWaterMarkExceeded
RTMT Alert 

Value
Default Configuration

Enable Alert

Selected

Severity

Critical

Enable/Disable this alert on the following servers

Enabled on listed servers

Threshold

Trigger alert when following condition met:

Spare Partition Used Disk Space Exceeds Low Water Mark (90%)

Duration

Trigger alert immediately

Frequency

Trigger alert on every poll

Schedule

24 hours daily

Enable E-mail

Selected

Trigger Alert Action

Default


SyslogSeverityMatchFound

This alert occurs when the SyslogSeverityMatchFound event gets generated. This indicates that a syslog message with the matching severity level exists.

Table 6-19 Default Configuration for the SyslogSeverityMatchFound RTMT Alert 

Value
Default Configuration

Enable Alert

Selected

Severity

Critical

Enable/Disable this alert on the following servers

Enabled on listed servers

Threshold

Trigger alert when following condition met:

SyslogSeverityMatchFound event generated

Duration

Trigger alert immediately

Frequency

Trigger alert on every poll

Schedule

24 hours daily

Syslog Severity Parameters

Critical

Enable E-mail

Selected

Trigger Alert Action

Default


SyslogStringMatchFound

This alert occurs when the SyslogStringMatchFound event gets generated. The alert indicates that a syslog message with the matching search string exists.

Table 6-20 Default Configuration for the SyslogStringMatchFound RTMT Alert 

Value
Default Configuration

Enable Alert

Selected

Severity

Critical

Enable/Disable this alert on the following servers

Enabled on listed servers

Threshold

Trigger alert when following condition met:

SyslogStringMatchFound event generated

Duration

Trigger alert immediately

Frequency

Trigger alert on every poll

Schedule

24 hours daily

Syslog Alert Parameters

(Text box for search string)

Enable E-mail

Selected

Trigger Alert Action

Default


SystemVersionMismatched

This alert occurs when a mismatch in system version exists.

Table 6-21 Default Configuration for the SystemVersionMismatched RTMT Alert 

Value
Default Configuration

Enable Alert

Selected

Severity

Critical

Enable/Disable this alert on the following servers

Enabled on listed servers

Threshold

Trigger alert when following condition met:

SystemVersionMismatched occurred

Duration

Trigger alert immediately

Frequency

Trigger up to 1 alert within 60 minutes

Schedule

24 hours daily

Enable E-mail

Selected

Trigger Alert Action

Default


TotalProcessesAndThreadsExceededThreshold

This alert occurs when the TotalProcessesAndThreadsExceededThreshold event gets generated. The alert indicates that the current total number of processes and threads exceeds the maximum number of tasks that are configured for the Cisco RIS Data Collector Service Parameter. This situation could indicate that a process is leaking or that a process has thread leaking.

Table 6-22 Default Configuration for the TotalProcessesAndThreadsExceededThreshold RTMT Alert 

Value
Default Configuration

Enable Alert

Selected

Severity

Critical

Enable/Disable this alert on the following servers

Enabled on listed servers

Threshold

Trigger alert when following condition met:

TotalProcessesAndThreadsExceededThreshold event generated

Duration

Trigger alert immediately

Frequency

Trigger alert on every poll

Schedule

24 hours daily

Enable E-mail

Selected

Trigger Alert Action

Default


Emergency-level Alarms

The emergency-level alarm equals zero (0) and means that your system or service is unusable. These alarms generally indicate platform failures. Examples follow:
  • Service repeatedly fails to startup
  • System ran out of disk space while disk space is essential for this system to operate
  • System ran out of memory
  • Motherboard failure occurred

PENoSWVersionLicense

Cisco Unified Presence Engine: failed to start

Cisco Unified Serviceability Alarm Definition Catalog

Cisco UP Presence Engine

Severity

EMERGENCY_ALARM

Explantion

Cisco Unified Presence Engine: SW version license is needed.

Recommended Action

Please acquire a SW Version license file and upload it before starting the Presense Engine

Routing List

SDL, SDI, Sys Log, Event Log, Alert Manager

ESPNoSWVersionLicense

Cisco Unified Presence SIP Proxy: failed to start

Cisco Unified Serviceability Alarm Definition Catalog

CiscoUPSSIPProxy

Severity

EMERGENCY_ALARM

Explantion

Cisco Unified Presence SIP Proxy: SW version license is needed.

Recommended Action

Please acquire a SW Version license file and upload it before starting the PROXY

Routing List

SDL, SDI, Sys Log, Event Log, Alert Manager

IPMANotStarted

IPMA Application not started

Cisco Unified Serviceability Alarm Definition Catalog

JavaApplications

Severity

EMERGENCY_ALARM

Explantion

Error occurred while starting application

Recommended Action

See application logs for error

Routing List

Event Log, SNMP Traps

Parameters

ServletName (String) Reason (String)

BDINotStarted

BDI Application not started

Cisco Unified Serviceability Alarm Definition Catalog

JavaApplications

Severity

EMERGENCY_ALARM

Explantion

Error occurred while starting application

Recommended Action

See application logs for error

Routing List

Event Log, SNMP Traps

Parameters

Reason (String)

WDNotStarted

Failed to startup WebDialer application

Cisco Unified Serviceability Alarm Definition Catalog

JavaApplications

Severity

EMERGENCY_ALARM

Explantion

Error occurred while starting application

Recommended Action

See application logs for error

Routing List

Event Log, SNMP Traps

Parameters

ServletName (String) Reason (String)

CiscoDirSyncStartFailure

Cisco DirSymc application failed to start successfully

Cisco Unified Serviceability Alarm Definition Catalog

JavaApplications

Severity

EMERGENCY_ALARM

Explantion

Error occurred while starting application

Recommended Action

See application logs for error, may require restarting the application

Routing List

Sys Log, Event Log, SNMP Traps

FailedToReadConfig

Service Manager failed to read configuration file.

Cisco Unified Serviceability Alarm Definition Catalog

ServiceManagerAlarmCatalog

Severity

EMERGENCY_ALARM

Explantion

Failed to read configuration file. Configuration file might be corrupted.

Recommended Action

Re-install CUCM

Routing List

Event Log, SDI, Sys Log

Parameters

Filename (String) Reason (String)

OutOfMemory

Out of memory.

Cisco Unified Serviceability Alarm Definition Catalog

GenericAlarmCatalog

Severity

EMERGENCY_ALARM

Explantion

The process has requested memory from the operating system, and there was not enough memory available.

Recommended Action

No action is required.

Routing List



ServiceNotInstalled

Service is not installed.

Cisco Unified Serviceability Alarm Definition Catalog

GenericAlarmCatalog

Severity

EMERGENCY_ALARM

Explantion

An executable is trying to start but cannot because it is not configured as a service in the service control manager. The service name is %s.

Recommended Action

Reinstall the service.

Routing List

Parameters

ServiceName (String)

FileWriteError

Cannot write into a file.

Cisco Unified Serviceability Alarm Definition Catalog

GenericAlarmCatalog

Severity

EMERGENCY_ALARM

Explantion

Failed to write into the primary file path.

Recommended Action

Ensure that the primary file path is valid and the corresponding drive has sufficient disk space. Also, make sure that the path has security permissions similar to default log file path.

Routing List

Parameters

PrimaryFilePath (String)

CertExpired

Certificate has Expired and needs to be changed at the earliest

Cisco Unified Serviceability Alarm Definition Catalog

CertMonitorAlarmCatalog

Severity

EMERGENCY_ALARM

Explantion

The Validity Date of the Certificate indicated is over and the Certificate is expired.

Recommended Action

Re-generate the certificate that is about to Expire from Certificate Management UI from CUOS Administration web Page. If the Certificate is issued by a CA, obtain a fresh certificate from CA and upload it to CUCM.

Routing List

Event Log, Sys Log

Parameters

Message (String)

Alert-Level Alarms

The alert-level alarm equals 1 and action must take place immediately. A system error occurred and will not recover without manual intervention. Examples follow:
  • Application is about to run out of licenses
  • Application is about to run out of disk space
  • Application is almost out of memory
  • 100% CPU occurs for long period of time

CiscoLicenseOverDraft

Overdraft licenses in use

Cisco Unified Serviceability Alarm Definition Catalog

JavaApplications

Severity

ALERT_ALARM

Explantion

Overdraft licenses in use

Recommended Action

None

Routing List

Sys Log, Event Log, SNMP Traps

Parameters

Reason (String)

CiscoLicenseApprochingLimit

License units consumption approaching its authorized limit

Cisco Unified Serviceability Alarm Definition Catalog

JavaApplications

Severity

ALERT_ALARM

Explantion

License units consumption approaching its authorized limit

Recommended Action

None

Routing List

Sys Log, Event Log, SNMP Traps

Parameters

Reason (String)

ServiceActivationFailed

Failed to activate a service.

Cisco Unified Serviceability Alarm Definition Catalog

ServiceManagerAlarmCatalog

Severity

ALERT_ALARM

Explantion

Failed to activate this service.

Recommended Action

Activate the service again

Routing List

Event Log, SDI, Sys Log

Parameters

ServiceName (String) Reason (String) ErrorString (String)

ServiceDeactivationFailed

Failed to deactivate a service.

Cisco Unified Serviceability Alarm Definition Catalog

ServiceManagerAlarmCatalog

Severity

ALERT_ALARM

Explantion

Failed to deactivate this service.

Recommended Action

Deactivate the service again

Routing List

Event Log, SDI, Sys Log

Parameters

ServiceName (String) Reason (String) ErrorString (String)

ServiceExceededMaxRestarts

Service failed to start and exceeded maximum allowed restarts.

Cisco Unified Serviceability Alarm Definition Catalog

ServiceManagerAlarmCatalog

Severity

ALERT_ALARM

Explantion

Service failed to start, even after the max restarts attempts.

Recommended Action

Start the service manually.

Routing List

Event Log, SDI, Sys Log

Parameters

ServiceName (String) RestartCount (Int)

MemAllocFailed

Memory allocation failed.

Cisco Unified Serviceability Alarm Definition Catalog

ServiceManagerAlarmCatalog

Severity

ALERT_ALARM

Explantion

Failure to allocate memory.

Recommended Action

(1) Check the syslog for the system error number. (2) If the Alert is seen repeatedly, restart Service Manager (3) If the problem still persist, reboot the CUCM node.

Routing List

Event Log, SDI, Sys Log

Parameters

MemAllocFailure (String)

SystemResourceError

A System call failed.

Cisco Unified Serviceability Alarm Definition Catalog

ServiceManagerAlarmCatalog

Severity

ALERT_ALARM

Explantion

System call failed.

Recommended Action

(1) Check the syslog for the system error number.(2) If the Alert is seen repeatedly, restart Service Manager (3) If the problem still persist, reboot the node.

Routing List

Event Log, SDI, Sys Log

Parameters

SystemCall (String) Service (String) Reason (String)

NoDbConnectionAvailable

No database connection available.

Cisco Unified Serviceability Alarm Definition Catalog

DBAlarmCatalog

Severity

ALERT_ALARM

Explantion

Database layer could not find any working database connection.

Recommended Action

In Cisco Unified Serviceability, enable Detailed level traces in the Trace Configuration window for the Cisco Database Layer Monitor service. Check network connectivity and operation of SQL Server services.

Routing List

SDI, Event Log, Sys Log

ErrorChangeNotifyReconcile

A change notification shared memory reconciliation has occurred.

Cisco Unified Serviceability Alarm Definition Catalog

DBAlarmCatalog

Severity

ALERT_ALARM

Explantion

The change notification buffers in shared memory have been rebuilt due to conflicts.

Recommended Action

This problem may have been already corrected. If unexpected behavior is observed, restart all Cisco services in the cluster.

Routing List

SDI, Event Log, Sys Log

CLM_MsgIntChkError

ClusterMgr message integrity check error.

Cisco Unified Serviceability Alarm Definition Catalog

PlatformCatalog

Severity

ALERT_ALARM

Explantion

ClusterMgr has received a message which has failed a message integrity check. This can be an indication that another node in the cluster is configured with the wrong security password.

Recommended Action

Verify message is coming from an expected IP address. Verify the security password on that node.

Routing List

Event Log

Parameters

NodeIP (String)

CertValidLessthanADay

Certificate is about to Expire in less than 24 hours or has Expired

Cisco Unified Serviceability Alarm Definition Catalog

CertMonitorAlarmCatalog

Severity

ALERT_ALARM

Explantion

The Validity of the Certificate indicated in the notification message is less than 24 hours .

Recommended Action

Re-generate the certificate that is about to Expire from Certificate Management UI from CUOS Administration web Page. If the Certificate is issued by a CA, Generate a CSR, Submit CSR to CA, obtain a fresh certificate from CA and upload it to CUCM

Routing List

Event Log, Sys Log

Parameters

Message (String)

Critical-Level Alarms

The critical-level alarm equals 2 and action may need to be taken immediately; auto-recovery is expected, but monitor the condition.
This alarm acts similar to the alert-level alarm but not necessarily requiring an immediate action. A system-affecting service had a failure but recovered without intervention. Examples follow:
  • Service crashed due to an error that could not be handled but a watchdog process exists that will restart the service. The crash does not necessarily require immediate action. Examples are:
    • Out of memory conditions
    • Unitialized variables
    • Memory scribblers
  • Unexpected code error occurred that could not be handled but for which the system automatically restarts.

DUPLEX_MISMATCH

Duplex Mismatch Alarm

Cisco Unified Serviceability Alarm Definition Catalog

CDPAlarmCatalog

Severity

CRITICAL_ALARM

Explantion

This alarm is generated by Cisco CDP whenver there is a duplex mismatch between local inetrface and switch interface.

Recommended Action

Ensure that Duplex settings are set to auto or full on local inetrface as well as switch interface

Routing List

Event Log, Sys Log

Parameters

SwitchDuplex (String) LocalInterfaceDuplex (String)

LogPartitionHighWaterMarkExceeded

The percentage of used disk space in the log partition has exceeded the configured high water mark.

Cisco Unified Serviceability Alarm Definition Catalog

LpmTctCatalog

Severity

CRITICAL_ALARM

Explantion

The percentage of used disk space in the log partition has exceeded the configured high water mark. Some of the core file and / or trace files will be purged until the percentage of used disk space in the log partition gets below the configured low water mark.

Recommended Action

Login into RTMT and check the configured threshold value for LogPartitionHighWaterMarkExceeded alert in Alert Central. If the configured value is set to a lower than the default threshold value unintentionally, change the value to default. If you continue to receive this alert for half an hour after receiving the 1st alert, check for the disk usage for Common partition under "Disk Usage" tab in RTMT. If the disk usage shown under that tab is higher than configured value in LogPartitionLowWaterMarkExceeded alert configuration, contact Cisco TAC to troubleshoot the cause of high disk usage in Common partition.

Routing List

SDI, Sys Log, Event Log, Alert Manager

Parameters

UsedDiskSpace (String) MessageString (String)

CoreDumpFileFound

The new core dump file(s) have been found in the system.

Cisco Unified Serviceability Alarm Definition Catalog

LpmTctCatalog

Severity

CRITICAL_ALARM

Explantion

One of the component has crashed and generated a core dump. Use admin cli or RTMT to featch the backtrace.

Recommended Action

This serious internal error should be investigated by the Cisco Technical Assistance Center (TAC). Before contacting TAC, Login to cli on CCM serve and run "active analyze core file name" to generate the backtrace of the core dump. The core file name is listed in the alert details. After the analyze command is executed, collect the backtrace using cli command "file get activelog analyze" or "Collect Traces" option from RTMT. Send these backtraces to Cisco TAC for further analysis.

Routing List

SDI, Sys Log, Event Log, Alert Manager

Parameters

TotalCoresFound (String) CoreDetails (String) Core1 (String) Core2 (String) Core3 (String) Core4 (String) Core5 (String) Core6 (String)

CUPSyncAgentAXLConnectionFailed

Cisco UP Sync Agent service failed authentication

Cisco Unified Serviceability Alarm Definition Catalog

CiscoUPSSyncAgent

Severity

CRITICAL_ALARM

Explantion

Cisco UP Sync Agent service failed authentication to the remote Cisco Unified Communications Manager publisher and therefore is unable to connect

Recommended Action

Please verify the AXL credentials are correct and whether the Cisco AXL Web service is activated and running on the remote Cisco Unified Communications Manager publisher

Routing List

Sys Log, Event Log, Alert Manager

CUPSyncAgentCucmDbmonConnectionFailed

Cisco UP Sync Agent service lost connection to the Cisco Database Layer Monitor service

Cisco Unified Serviceability Alarm Definition Catalog

CiscoUPSSyncAgent

Severity

CRITICAL_ALARM

Explantion

Cisco UP Sync Agent service lost the connection to the Cisco Database Layer Monitor service. This error can cause the data on the Cisco Unified Presence cluster to get out-of-sync with the data on the Cisco Unified Communications Manager cluster

Recommended Action

Verify the Cisco Unified Communications Manager server is active and the Cisco Unified Communications Manager publisher has opened port 8001

Routing List

Sys Log, Event Log, Alert Manager

DbmonQueueWorkerExistWithError

Cisco UP Sync Agent service unable to process change notifications from the Cisco Unified Communications Manager cluster

Cisco Unified Serviceability Alarm Definition Catalog

CiscoUPSSyncAgent

Severity

CRITICAL_ALARM

Explantion

Cisco UP Sync Agent service is no longer processing change notifications from the Cisco Unified Communications Manager cluster. This error can cause the data on the Cisco Unified Presence cluster to get out-of-sync with the data on the Cisco Unified Communications Manager cluster

Recommended Action

Please verify the Cisco Unified Communications Manager server is active. A restart of the Cisco UP Sync Agent service may be required

Routing List

Sys Log, Event Log, Alert Manager

CupNotInCucmAppServerListError

Cisco UP Sync Agent failed to start up due to Cisco Unified Presence Server node is not in the application server list on the Cisco Unified Communications Manager publisher.

Cisco Unified Serviceability Alarm Definition Catalog

CiscoUPSSyncAgent

Severity

CRITICAL_ALARM

Explantion

Cisco Unified Presence Server node is not in the application server list on the Cisco Unified Communications Manager publisher.

Recommended Action

Please add Cisco Unified Presence Server node in the application server list on the Cisco Unified Communications Manager server and start Cisco UP Sync Agent service.

Routing List

Sys Log, Event Log, Alert Manager

PEDatabaseError

Information lookup failed

Cisco Unified Serviceability Alarm Definition Catalog

Cisco UP Presence Engine

Severity

CRITICAL_ALARM

Explantion

An error occurred while retrieving information. This may indicate a problem with the Cisco DB service

Recommended Action

Verify that the Cisco DB service is activated and running. Use RTMT to check the Cisco UP Presence service logs for errors

Routing List

SDI, Sys Log, Event Log, Alert Manager

Parameters

DatabaseErrorMessage (String)

PEPeerNodeFailure

The Cisco UP Presence Engine service on the peer node of a subcluster has failed

Cisco Unified Serviceability Alarm Definition Catalog

Cisco UP Presence Engine

Severity

CRITICAL_ALARM

Explantion

The Cisco UP Presence Engine service in the peer node is not responding

Recommended Action

Use Cisco Unified Serviceability to verify the Cisco UP Presence Engine serivce is activated and running

Routing List

SDI, Sys Log, Event Log, Alert Manager

Parameters

PeerFailedMessage (String)

PEIDStoTimestenDatabaseSyncError

Synchronization between the Cisco Unified Presence database and the Cisco Unified Presence Engine database has failed

Cisco Unified Serviceability Alarm Definition Catalog

Cisco UP Presence Engine

Severity

CRITICAL_ALARM

Explantion

An error has occurred synchronizing the Cisco Unified Presence data with the Cisco Unified Presence Engine database

Recommended Action

See associated error message and log files. Please restart the Cisco UP Presence Engine service when convenient

Routing List

SDI, Sys Log, Event Log, Alert Manager

Parameters

PEMessage (String)

PEIDSSubscribeError

The Cisco UP Presence Engine service was unable to subscribe for Cisco Unified Presence database change notifications

Cisco Unified Serviceability Alarm Definition Catalog

Cisco UP Presence Engine

Severity

CRITICAL_ALARM

Explantion

An error has occurred subscribing to Cisco Unified Presence database change notifications

Recommended Action

See associated error message and log files. Please restart the Cisco UP Presence Engine service when convenient

Routing List

SDI, Sys Log, Event Log, Alert Manager

Parameters

PEMessage (String)

PEIDSQueryError

The Cisco UP Presence Engine service has detected an error while querying the Cisco Unified Presence database

Cisco Unified Serviceability Alarm Definition Catalog

Cisco UP Presence Engine

Severity

CRITICAL_ALARM

Explantion

An error has occurred whilst querying the Cisco Unified Presence database

Recommended Action

See associated error message and log files. Please restart the Cisco UP Presence Engine service when convenient

Routing List

SDI, Sys Log, Event Log, Alert Manager

Parameters

PEMessage (String)

PESipSgHostUnavailable

Cisco UP Presence Engine service could not reach server group

Cisco Unified Serviceability Alarm Definition Catalog

Cisco UP Presence Engine

Severity

CRITICAL_ALARM

Explantion

Cisco UP Presence Engine service could not contact the outbound proxy server group

Recommended Action

Verify that outbound proxy is configured correctly and listening on the configured ports

Routing List

SDI, Sys Log, Event Log, Alert Manager

Parameters

SipSgHost (String)

PESipSocketBindFailure

Cisco UP Presence Engine service was unable to connect to the SIP listener interface

Cisco Unified Serviceability Alarm Definition Catalog

Cisco UP Presence Engine

Severity

CRITICAL_ALARM

Explantion

Cisco UP Presence Engine service was unable to connect to the configured interface. No SIP traffic can be processed on this interface

Recommended Action

Verify that the Cisco UP Presence Engine service listen interface is configured correctly on the Cisco Unified Presence Administration GUI Application Listener page. Verify that no other process is listening on the same port using netstat

Routing List

SDI, Sys Log, Event Log, Alert Manager

Parameters

SipSocketInterface (String)

PEOamInitialConfigFileError

Cisco UP Presence Engine service configuration file not found or malformed

Cisco Unified Serviceability Alarm Definition Catalog

Cisco UP Presence Engine

Severity

CRITICAL_ALARM

Explantion

Cisco UP Presence Engine service configuration file is missing or malformed

Recommended Action

Verify that the Cisco UP OAM Agent service is activated and running

Routing List

SDI, Sys Log, Event Log, Alert Manager

Parameters

PEOamConfigFileURI (String) PEOamErrorMessage (String)

PEOamInvalidInitialConfigFile

Cisco UP Presence Engine service configuration file not found or malformed

Cisco Unified Serviceability Alarm Definition Catalog

Cisco UP Presence Engine

Severity

CRITICAL_ALARM

Explantion

Cisco UP Presence Engine service configuration file is missing or malformed

Recommended Action

Verify that the Cisco UP OAM Agent service is activated and running

Routing List

SDI, Sys Log, Event Log, Alert Manager

Parameters

PEOamConfigFileURI (String) PEOamErrorMessage (String)

PEOamConfigFileError

Cisco UP OAM Agent service configuration file is invalid

Cisco Unified Serviceability Alarm Definition Catalog

Cisco UP Presence Engine

Severity

CRITICAL_ALARM

Explantion

Cisco UP OAM Agent service configuration file is invalid

Recommended Action

Verify that the Cisco UP OAM Agent service is activated and running

Routing List

SDI, Sys Log, Event Log, Alert Manager

Parameters

PEOamConfigFileURI (String) PEOamErrorMessage (String)

PEOamInvalidConfigFile

Cisco UP Presence Engine service configuration file is invalid

Cisco Unified Serviceability Alarm Definition Catalog

Cisco UP Presence Engine

Severity

CRITICAL_ALARM

Explantion

Cisco UP Presence Engine service configuration file is invalid

Recommended Action

Verify that the Cisco UP OAM agent serivce is activated and running

Routing List

SDI, Sys Log, Event Log, Alert Manager

Parameters

PEOamConfigFileURI (String) PEOamErrorMessage (String)

PEConfigNotificationFailure

Cisco UP Presence Engine service cannot connect to socket used for communications between with the Cisco UP OAM Agent service

Cisco Unified Serviceability Alarm Definition Catalog

Cisco UP Presence Engine

Severity

CRITICAL_ALARM

Explantion

The Cisco UP Presence Engine service cannot bind to the socket that is used for communication with the Cisco UP OAM Agent service via XML-RPC

Recommended Action

Verify that the Cisco UP OAM Agent service listen interface is configured correctly on the Cisco Unified Presence Administration GUI Application Listener page. Verify that no other process is listening on the same port using netstat

Routing List

SDI, Sys Log, Event Log, Alert Manager

Parameters

PEOamXmlRpcSocketPort (String) PEOamXmlRpcSocketHostname (String)

ESPStopped

Cisco UP SIP Proxy service child process has been stopped

Cisco Unified Serviceability Alarm Definition Catalog

CiscoUPSSIPProxy

Severity

CRITICAL_ALARM

Explantion

Cisco UP SIP Proxy service child process has stopped

Recommended Action

If the administrator has not manually stopped the Proxy service, this may indicate a problem. Please use RTMT to check for any related alarms

Routing List

Sys Log, Event Log, Alert Manager

Parameters

Version (String)

ESPSharedMemCreateFailed

Failed to create shared memory

Cisco Unified Serviceability Alarm Definition Catalog

CiscoUPSSIPProxy

Severity

CRITICAL_ALARM

Explantion

Failed to create shared memory segments while trying to initialize tables

Recommended Action

Use RTMT to check system shared memory and check the Cisco UP SIP Proxy service trace log file for any detailed error messages

Routing List

Sys Log, Event Log, Alert Manager

ESPSharedMemSetPermFailed

Failed to set permissions on shared memory

Cisco Unified Serviceability Alarm Definition Catalog

CiscoUPSSIPProxy

Severity

CRITICAL_ALARM

Explantion

Failed to set permissions on shared memory segments while trying to initialize tables

Recommended Action

Use RTMT to check system shared memory and check the Cisco UP SIP Proxy service trace log file for any detailed error messages

Routing List

Sys Log, Event Log, Alert Manager

ESPSharedMemAllocFailed

Failed to allocate shared memory

Cisco Unified Serviceability Alarm Definition Catalog

CiscoUPSSIPProxy

Severity

CRITICAL_ALARM

Explantion

Failed to allocate shared memory segments while trying to initialize tables

Recommended Action

Use RTMT to check system shared memory and check the Cisco UP SIP Proxy service trace log file for any detailed error messages

Routing List

Sys Log, Event Log, Alert Manager

Parameters

MySQL (String)

IPPMStopped

Cisco IP Phone Messenger application stopped

Cisco Unified Serviceability Alarm Definition Catalog

CiscoUPSSIPProxy

Severity

CRITICAL_ALARM

Explantion

Cisco IP Phone Messenger application stopped

Recommended Action

Use RTMT to check for alarms. Verify whether this application was stopped manually by administrator

Routing List

Sys Log, Event Log, Alert Manager

Parameters

Version (String)

CTIGWProviderDown

CTI provider is down

Cisco Unified Serviceability Alarm Definition Catalog

CiscoUPSSIPProxy

Severity

CRITICAL_ALARM

Explantion

The CTI provider is currently unavailable

Recommended Action

Check the connection to the configured Cisco Unified Callmanager nodes and verify the Cisco CTI Gateway application is enabled on the Cisco Unified Presence Administration GUI CTI Settings page

Routing List

Sys Log, Event Log, Alert Manager

CTIGWProviderFailedToOpen

CTI Provider failed to open

Cisco Unified Serviceability Alarm Definition Catalog

CiscoUPSSIPProxy

Severity

CRITICAL_ALARM

Explantion

CTI Provider failed to open due to a configuration error

Recommended Action

Verify the Cisco Unified Callmanager address(es), and application user credentials on the Cisco Unified Presence Administration GUI CTI Settings page

Routing List

Sys Log, Event Log, Alert Manager

CALBackendCalDisc

Calendar server connection failure

Cisco Unified Serviceability Alarm Definition Catalog

CiscoUPSSIPProxy

Severity

CRITICAL_ALARM

Explantion

Connection to the calendar server was lost. Meeting information will not be available

Recommended Action

Use RTMT to check the Cisco UP SIP Proxy service trace log file for any detailed error messages

Routing List

Sys Log, Event Log, Alert Manager

CALMtngPlSvrDisc

MeetingPlace server connection failure

Cisco Unified Serviceability Alarm Definition Catalog

CiscoUPSSIPProxy

Severity

CRITICAL_ALARM

Explantion

Connection to the MeetingPlace server was lost. Callback functionality will not be available

Recommended Action

Use RTMT to check the Cisco UP SIP Proxy service trace log file for any detailed error messages

Routing List

Sys Log, Event Log, Alert Manager

CALExchangeTrustCertReadFailure

Failed to read calendar server certificate

Cisco Unified Serviceability Alarm Definition Catalog

CiscoUPSSIPProxy

Severity

CRITICAL_ALARM

Explantion

The Cisco UP SIP Proxy service was unable to read the calendar server root trust certificate

Recommended Action

Reload the calendar server root certificate and restart the Cisco UP SIP Proxy service

Routing List

Sys Log, Event Log, Alert Manager

CALMtngPlTrustCertReadFailure

Failed to read MeetingPlace server certificate

Cisco Unified Serviceability Alarm Definition Catalog

CiscoUPSSIPProxy

Severity

CRITICAL_ALARM

Explantion

The Cisco UP SIP Proxy service was unable to read the MeetingPlace server root trust certificate

Recommended Action

Reload the MeetingPlace server root certificate and restart the Cisco UP SIP Proxy service

Routing List

Sys Log, Event Log, Alert Manager

CALMtngPlSystemFailure

Failed to decrypt the user MeetingPlace password

Cisco Unified Serviceability Alarm Definition Catalog

CiscoUPSSIPProxy

Severity

CRITICAL_ALARM

Explantion

The Cisco UP SIP Proxy service was unable to decrypt the MeetingPlace user password

Recommended Action

Reconfigure the MeetingPlace user password

Routing List

Sys Log, Event Log, Alert Manager

SRMFailover

Cisco UP SRM is performing an automatic failover

Cisco Unified Serviceability Alarm Definition Catalog

Cisco UP Server Recovery Manager

Severity

CRITICAL_ALARM

Explantion

Cisco UP SRM is performing an automatic failover

Recommended Action

Please verify that the failed node is up and that critical services are running.

Routing List

Sys Log, Event Log, Alert Manager

Parameters

FromNode (String) ToNode (String) Reason (String)

SRMFailed

Cisco UP Server Recovery Manager is in the failed state

Cisco Unified Serviceability Alarm Definition Catalog

Cisco UP Server Recovery Manager

Severity

CRITICAL_ALARM

Explantion

Cisco UP SRM is in the failed state

Recommended Action

Please restart the Cisco UP Server Recovery Manager.

Routing List

Sys Log, Event Log, Alert Manager

CiscoDirSyncProcessFailToStart

LDAPSync process failed to start on particular sync agreement

Cisco Unified Serviceability Alarm Definition Catalog

JavaApplications

Severity

CRITICAL_ALARM

Explantion

LDAPSync process failed to start on the configured agreement id

Recommended Action

See application logs for error

Routing List

Sys Log, Event Log, SNMP Traps

Parameters

AgreementId (String)

ServiceFailed

Service terminated.

Cisco Unified Serviceability Alarm Definition Catalog

ServiceManagerAlarmCatalog

Severity

CRITICAL_ALARM

Explantion

The Service has terminated abruptly. Service Manager will try to restart it.

Recommended Action

Monitor the state of the service.

Routing List

Event Log, SDI, Sys Log

Parameters

ServiceName (String) Reason (String) ProcessID (Int)

ServiceStartFailed

Failed to start service.

Cisco Unified Serviceability Alarm Definition Catalog

ServiceManagerAlarmCatalog

Severity

CRITICAL_ALARM

Explantion

Failed to start this service. Service Manager will attempt to start the service again.

Recommended Action

Monitor the state of the service.

Routing List

Event Log, SDI, Sys Log

Parameters

ServiceName (String) Reason (String)

ServiceStopFailed

Failed to stop service.

Cisco Unified Serviceability Alarm Definition Catalog

ServiceManagerAlarmCatalog

Severity

CRITICAL_ALARM

Explantion

Unable to stop the specified service after serveral retries. The service will be marked stopped.

Recommended Action

Check the syslog for system error code.

Routing List

Event Log, SDI, Sys Log

Parameters

ServiceName (String) Reason (String)

ServiceRestartFailed

Failed to Restart service.

Cisco Unified Serviceability Alarm Definition Catalog

ServiceManagerAlarmCatalog

Severity

CRITICAL_ALARM

Explantion

Unable to restart the specified service.

Recommended Action

No action is required.

Routing List

Event Log, SDI, Sys Log

Parameters

ServiceName (String) Reason (String)

CUPInterclusterSyncAgentAXLConnectionFailed

Cisco UP Intercluster Sync Agent service failed authentication

Cisco Unified Serviceability Alarm Definition Catalog

CiscoUPInterclusterSyncAgent

Severity

CRITICAL_ALARM

Explantion

Cisco UP Intercluster Sync Agent service failed authentication to the remote Cisco Unified Presence cluster and therefore is unable to connect

Recommended Action

Please verify the AXL credentials are correct and whether the Cisco AXL Web service is activated and running on the remote Cisco Unified Presence cluster

Routing List

Sys Log, Event Log, Alert Manager

Parameters

hostname (String)

CUPInterclusterSyncAgentPeerSyncFailed

Cisco UP Intercluster Sync Agent service failed to sync remote peer data

Cisco Unified Serviceability Alarm Definition Catalog

CiscoUPInterclusterSyncAgent

Severity

CRITICAL_ALARM

Explantion

Cisco UP Intercluster Sync Agent service failed to sync user location data from the remote Cisco Unified Presence cluster

Recommended Action

Verify that the remote Cisco Unified Presence peer is not also configured as a node in the local cluster and run the Cisco Unified Presence System Troubleshooter for more information regarding this issue

Routing List

Sys Log, Event Log, Alert Manager

Parameters

hostname (String) exceptionMessage (String)

CUPInterclusterSyncAgentFailedToSendCN

Cisco UP Intercluster Sync Agent service failed to send change notification to remote cluster

Cisco Unified Serviceability Alarm Definition Catalog

CiscoUPInterclusterSyncAgent

Severity

CRITICAL_ALARM

Explantion

Cisco UP Intercluster Sync Agent service failed to send change notifications to the remote Cisco Unified Presence cluster

Recommended Action

Please verify the AXL credentials are correct and whether the Cisco AXL Web service is activated and running on the remote Cisco Unified Presence cluster

Routing List

Sys Log, Event Log, Alert Manager

Parameters

hostname (String)

CUPInterclusterSyncAgentPeerDuplicate

Cisco UP Intercluster Sync Agent service failed to sync with remote peer

Cisco Unified Serviceability Alarm Definition Catalog

CiscoUPInterclusterSyncAgent

Severity

CRITICAL_ALARM

Explantion

Cisco UP Intercluster Sync Agent service failed to sync user location data from a remote peer. The remote peer is from a Cisco Unified Presence cluster which already has a peer in the local cluster

Recommended Action

Verify that the hostname of the remote peer is not a secondary node from the identified existing peer. If the new peer is a secondary node, then remote this peer from the Cisco Unified Presence Administration GUI Inter-cluster details page. You can also run the System Troubleshooter for more details

Routing List

Sys Log, Event Log, Alert Manager

Parameters

hostname (String) existingPeer (String)

CUPICSACertificateFingerPrintMisMatch

Cisco UP Intercluster Sync Agent service detected a fingerprint mismatch on the certificate being processed

Cisco Unified Serviceability Alarm Definition Catalog

CiscoUPInterclusterSyncAgent

Severity

CRITICAL_ALARM

Explantion

Cisco UP Intercluster Sync Agent service detected a fingerprint mismatch on the certificate being processed

Recommended Action

Use the Cisco Unified Presence Platform GUI to compare the certificates loaded on this server with the certificates on the source server. It may necessary to delete the problem certificates and reload them

Routing List

Sys Log, Event Log, Alert Manager

Parameters

SubjectCN (String) IssuerCN (String)

CUPICSACertificateValidationFailure

Cisco UP Intercluster Sync Agent service detected a validation error on the certificate being processed

Cisco Unified Serviceability Alarm Definition Catalog

CiscoUPInterclusterSyncAgent

Severity

CRITICAL_ALARM

Explantion

Cisco UP Intercluster Sync Agent service detected a validation error on the certificate being processed

Recommended Action

Use the Cisco Unified Presence Platform GUI to compare the certificates loaded on this server with the certificates on the source server. It may necessary to delete the problem certificates and reload them

Routing List

Sys Log, Event Log, Alert Manager

Parameters

SubjectCN (String) IssuerCN (String) ErrorCode (String)

CUPInterclusterSyncAgentFailedToCleanUpPeer

Cisco UP Intercluster Sync Agent service failed to successfuly clean up after a peer was removed during a sync.

Cisco Unified Serviceability Alarm Definition Catalog

CiscoUPInterclusterSyncAgent

Severity

CRITICAL_ALARM

Explantion

Cisco UP Intercluster Sync Agent service failed to successfully clean up data after a peer was removed during a sync.

Recommended Action

Verify that the Cisco DB service is still up and accepting connections. See Inter Cluster Sync Agent logs for further root cause.

Routing List

Sys Log, Event Log, Alert Manager

Parameters

hostname (String)

XcpSIPGWStackResourceError

The number of concurrent S2S SIP Federation subscriptions or call-legs has reached the maximum limit specified by the configuration.

Cisco Unified Serviceability Alarm Definition Catalog

CiscoUPXCP

Severity

CRITICAL_ALARM

Explantion

The number of concurrent S2S SIP Federation subscriptions or call-legs has reached the maximum limit specified by the configuration. It will not be possible to create any more subscriptions or call-legs at the time.

Recommended Action

Increase the Pre-allocated SIP stack memory Service Parameter for the Cisco UP XCP SIP Federation Connection Manager. Note - If changing this setting, make sure that you have the memory available. If not, you may have reached the limit of your hardware's capability.

Routing List

Sys Log, Event Log, Alert Manager

ErrorChangeNotifyClientBlock

A change notification client is busy (blocked). If the change notification client continues to be blocked for 10 minutes, the system automatically clears the block and change notification should resume successfully.

Cisco Unified Serviceability Alarm Definition Catalog

DBAlarmCatalog

Severity

CRITICAL_ALARM

Explantion

Changes made to the database are not being consumed by one of the recipients. This does not always represent an issue. However, if the change notification client continues to be blocked for 10 minutes, the system automatically clears the block for all clients except the blocked one, which means that change notifications should resume successfully for all other clients. To clear the blocked client, you must restart the server.

Recommended Action

At the command line interface (CLI) on the database server, execute the following command: show tech notify. The CLI command output will provide information about the block. Use Cisco Unified Serviceability to restart the server that was indicated in the alarm. You may also want to gather traces to examine them for anomalous activity during the time that client was blocked. In Cisco Unified Serviceability, enable Detailed level traces in the Trace Configuration window for the Cisco Database Layer Monitor service. Also, use RTMT to look for error messages that may have occurred around the time of the alarm.

Routing List

SDI, Event Log, Sys Log

CUPXCPConfigMgrQueueAtCriticalLevel

Cisco UP XCP Config Manager buffer has reached critical levels. System will halt until configuration stabilizes, then regenerate all files. The XCP Router will need to be restarted to become aware of these changes.

Cisco Unified Serviceability Alarm Definition Catalog

CiscoUPXCPConfigManager

Severity

CRITICAL_ALARM

Explantion

Cisco UP XCP Config Manager buffer has reached critical levels. System will halt until configuration stabilizes, then regenerate all files. The XCP Router will need to be restarted to become aware of these changes .

Recommended Action

Restart the XCP Router once alarm is sent that configuration has been regenerated successfully.

Routing List

Sys Log, Event Log, Alert Manager

CUPXCPConfigMgrJabberRestartRequired

Cisco UP XCP Config Manager has regenerated XCP XML files after system halt due to buffer size. The XCP Router must now be restarted to pick up changes.

Cisco Unified Serviceability Alarm Definition Catalog

CiscoUPXCPConfigManager

Severity

CRITICAL_ALARM

Explantion

Cisco UP XCP Config Manager has regenerated XCP XML files after system halt due to buffer size. The XCP Router must now be restarted to pick up changes .

Recommended Action

Restart the XCP Router.

Routing List

Sys Log, Event Log, Alert Manager

CUPXCPConfigMgrConfigurationFailure

Cisco UP XCP Config Manager was unable to send configuration to a component. Please check logs.

Cisco Unified Serviceability Alarm Definition Catalog

CiscoUPXCPConfigManager

Severity

CRITICAL_ALARM

Explantion

Cisco UP XCP Config Manager failed to successfully update XCP Configuration.

Recommended Action

See Cisco UP XCP Config Manager logs for further root cause.

Routing List

Sys Log, Event Log, Alert Manager

Parameters

realm (String) component (String)

CUPXCPConfigMgrHostNameResolutionFailed

CUP XCP Config manager hostname resolution failed

Cisco Unified Serviceability Alarm Definition Catalog

CiscoUPXCPConfigManager

Severity

CRITICAL_ALARM

Explantion

Cisco UP XCP Config Manager could not resolve a DNS name to allow XCP Routers to connect to that node.

Recommended Action

Please verify DNS resolvability of all Hostnames and FQDNs in both local and remote clusters. Restart XCP Config Manager then XCP Router after DNS is resolvable.

Routing List

Sys Log, Event Log, Alert Manager

Parameters

hostname (String)

CUPXCPConfigMgrR2RPasswordEncryptionFailed

CUP XCP Config Manager Password Encryption Failed

Cisco Unified Serviceability Alarm Definition Catalog

CiscoUPXCPConfigManager

Severity

CRITICAL_ALARM

Explantion

Cisco UP XCP Config Manager was unable to encrypt the password associated with an Inter-cluster Router-to-Router configuration.

Recommended Action

Restart XCP Config Manager and then restart the XCP Router

Routing List

Sys Log, Event Log, Alert Manager

Parameters

hostname (String)

CertValidfor7days

Alarm to indicate that Certificate has Expired or Expires in less than seven days

Cisco Unified Serviceability Alarm Definition Catalog

CertMonitorAlarmCatalog

Severity

CRITICAL_ALARM

Explantion

The Certifciate is invalid or Validity of the Certificate indicated in the notification less than 7 days.

Recommended Action

Re-generate the certificate that is about to Expire from Certificate Management UI from CUOS Administration web Page. If the Certificate is issued by a CA, Generate a CSR, Submit CSR to CA, obtain a fresh certificate from CA and upload it to CUCM

Routing List

Event Log, Sys Log

Parameters

Message (String)

TomcatCertRegen

Alarm that indicates the tomcat certificate is regenerated

Cisco Unified Serviceability Alarm Definition Catalog

CertMonitorAlarmCatalog

Severity

CRITICAL_ALARM

Explantion

This alarm indicates that tomcat certificate has been regenerated or CA signed Tomcat Certificate has been uploaded.

Recommended Action

Restart the tomcat service for the new tomcat certificate to be effective. If EMCC feature is enabled for the communication across the clusters, perform the bulk certificate management provisioning for tomcat unit from Cisco Unified OS Administration Webpage

Routing List

Event Log, Sys Log

Parameters

Message (String)

Error-Level Alarms

The error-level alarm is 3 and you should investigate important devices or subsystems and determine if immediate action is needed. Errors that do not necessarily impact the ability of the service to continue to function and do not create a system outage. More related to device or subsystems. An example would be a device or subsystem failing for an unexpected reason.

ScheduledCollectionError

An error occurred while executing scheduled collection.

Cisco Unified Serviceability Alarm Definition Catalog

LpmTctCatalog

Severity

ERROR_ALARM

Explantion

Scheduled collection encountered an error during execution.

Recommended Action

Review configuration for scheduled collection job under Job Status window.

Routing List

Sys Log, Event Log

Parameters

JobID (String) Reason (String)

SparePartitionLowWaterMarkExceeded

The percentage of used disk space in the spare partition has exceeded the configured low water mark.

Cisco Unified Serviceability Alarm Definition Catalog

LpmTctCatalog

Severity

ERROR_ALARM

Explantion

The percentage of used disk space in the spare partition has exceeded the configured low water mark.

Recommended Action

Login into RTMT and check the configured threshold value for SparePartitionLowWaterMarkExceeded alert in Alert Central. If the configured value is set to a lower than the default threshold value unintentionally, change the value to default. Also, examine the trace and log file setting for each of the application in trace configuration page under CCM Serviceability. If the number of configured traces / logs is set to greater than 1000, adjust the trace settings from trace configuration page to default. Also, clean up the trace files that are less than a week old. You can clean up the traces using cli "file delete" or using Remote Browse from RTMT Trace and Log Central function.

Routing List

SDI, Sys Log, Event Log, Alert Manager

Parameters

UsedDiskSpace (String) MessageString (String)

PEAutoRecoveryFailed

Cisco UP Presence Engine service auto-recovery failure

Cisco Unified Serviceability Alarm Definition Catalog

Cisco UP Presence Engine

Severity

ERROR_ALARM

Explantion

An error occurred during the startup sequence of the Cisco UP Presence Engine service

Recommended Action

This error may indicate a possible configuration issue. Please correct the problem identified in the failure message

Routing List

SDI, Sys Log, Event Log, Alert Manager

Parameters

AutorecoveryFailedMessage (String)

PECalendarConnectionLoss

Indicates that the Cisco UP Presence Engine service cannot connect to the Calendar Server

Cisco Unified Serviceability Alarm Definition Catalog

Cisco UP Presence Engine

Severity

ERROR_ALARM

Explantion

The Cisco UP Presence Engine service cannot connect to the Calendar Server and will fail all calendar transactions until the connection is restored

Recommended Action

Verify the Calendar Server is running and that the gateway configuration is correct on the Cisco Unified Presence Administration GUI Presence Gateways page

Routing List

SDI, Sys Log, Event Log, Alert Manager

Parameters

CalendarConnectionLossMessage (String)

PEWebDAVInitializationFailure

Cisco UP Presence Engine service attempt to init the WebDAV library failed

Cisco Unified Serviceability Alarm Definition Catalog

Cisco UP Presence Engine

Severity

ERROR_ALARM

Explantion

The Cisco UP Presence Engine service has failed to initialize the WebDAV library. The Calendaring feature will not work without WebDAV

Recommended Action

Restart the Cisco UP Presence Engine service

Routing List

SDI, Sys Log, Event Log, Alert Manager

Parameters

WebDAVInitializationFailure (String)

ESPConfigError

Cisco UP SIP Proxy service configuration file error

Cisco Unified Serviceability Alarm Definition Catalog

CiscoUPSSIPProxy

Severity

ERROR_ALARM

Explantion

This may indicate a formatting error, invalid value, etc with the Cisco UP SIP Proxy service configuration file

Recommended Action

Verify that the Cisco Unified Presence Config Agent service is running. This service is responsible for writing the Proxy configuration file

Routing List

Sys Log, Event Log, Alert Manager

Parameters

SharedMemorySize (String) NumberOfVsa (String) ENUM (String) NumberExpansion (String) NumberServices (String) Registry (String) Routing (String) Radius (String) RAS (String) RPMS (String) MethodRouting (String)

ESPConfigNotFound

Cisco UP SIP Proxy service configuration file not found

Cisco Unified Serviceability Alarm Definition Catalog

CiscoUPSSIPProxy

Severity

ERROR_ALARM

Explantion

This may indicate a formatting error, invalid value, etc, or even a missing configuration file

Recommended Action

Verify that the configuration files /usr/local/sip/conf/sipd.conf and /usr/local/sip/conf/dynamic.sipd.conf exist on the Cisco Unified Presence server

Routing List

Sys Log, Event Log, Alert Manager

Parameters

SipModule (String) SipAuthenModule (String) SipEnum (String) SipNumExpand (String) SipNumServices (String) SipRegistry (String) SipRouting (String) SipAcct (String) SipRpms (String) SipPrivacy (String) SipMethodRoute (String)

ESPCreateLockFailed

Failed to create a lock file

Cisco Unified Serviceability Alarm Definition Catalog

CiscoUPSSIPProxy

Severity

ERROR_ALARM

Explantion

Failed to create a lock file

Recommended Action

Use RTMT to check the Cisco UP SIP Proxy service trace log file for any detailed error messages

Routing List

Sys Log, Event Log, Alert Manager

ESPSocketError

Network socket errors encountered

Cisco Unified Serviceability Alarm Definition Catalog

CiscoUPSSIPProxy

Severity

ERROR_ALARM

Explantion

Network socket errors could be caused by binding errors, get socket address failures, etc

Recommended Action

Use RTMT to check the Cisco UP SIP Proxy service trace log file for any detailed error messages

Routing List

Sys Log, Event Log, Alert Manager

Parameters

Radius (String) RAS (String)

ESPRadiusError

Radius related Error

Cisco Unified Serviceability Alarm Definition Catalog

CiscoUPSSIPProxy

Severity

ERROR_ALARM

Explantion

Radias Error undefined vendor specific attribute id

Recommended Action

Use RTMT to check the Cisco UP SIP Proxy service trace log file for any detailed error messages

Routing List

Sys Log, Event Log, Alert Manager

Parameters

RadiasError (String)

ESPStatsLogFileOpenFailed

Failed to open stats log file

Cisco Unified Serviceability Alarm Definition Catalog

CiscoUPSSIPProxy

Severity

ERROR_ALARM

Explantion

Failed to open the Cisco UP SIP Proxy service stats log file

Recommended Action

Use RTMT to check the Cisco UP SIP Proxy service trace log file for any detailed error messages

Routing List

Sys Log, Event Log, Alert Manager

ESPStatsInitFailed

Failed to initialize the performance interface

Cisco Unified Serviceability Alarm Definition Catalog

CiscoUPSSIPProxy

Severity

ERROR_ALARM

Explantion

Failed to initialize the performance Interface

Recommended Action

Use RTMT to check the Cisco UP SIP Proxy service trace log file for any detailed error messages

Routing List

Sys Log, Event Log, Alert Manager

ESPMallocFailure

Failed to allocate memory

Cisco Unified Serviceability Alarm Definition Catalog

CiscoUPSSIPProxy

Severity

ERROR_ALARM

Explantion

Failed to allocate memory. This may indicate a low/no memory issue with the server

Recommended Action

Use RTMT to check the Cisco UP SIP Proxy service trace log file for any detailed error messages

Routing List

Sys Log, Event Log, Alert Manager

Parameters

SIPProtocol (String) NumberExpansion (String) SipRegistry (String) SipRouting (String) RAS (String) RPMS (String)

ESPWrongIPAddress

Wrong IP address provided

Cisco Unified Serviceability Alarm Definition Catalog

CiscoUPSSIPProxy

Severity

ERROR_ALARM

Explantion

Wrong/invalid IP address was provided

Recommended Action

Use RTMT to check the Cisco UP SIP Proxy service trace log file for any detailed error messages

Routing List

Sys Log, Event Log, Alert Manager

Parameters

ProxyIPAddrTab (String) IPAddrNotMine (String) DNSReturnedBadIP (String) ProxyLoopbackIPA (String) InvalidRASIPAddr (String) InvalidRPMSIPAddr (String)

ESPWrongHostName

Wrong host name

Cisco Unified Serviceability Alarm Definition Catalog

CiscoUPSSIPProxy

Severity

ERROR_ALARM

Explantion

This problem could be due to an invalid IP address, or an unresolvable hostname

Recommended Action

Use RTMT to check the Cisco UP SIP Proxy service trace log file for any detailed error messages

Routing List

Sys Log, Event Log, Alert Manager

ESPMySQLConnectionError

The connection to MySQL database failed

Cisco Unified Serviceability Alarm Definition Catalog

CiscoUPSSIPProxy

Severity

ERROR_ALARM

Explantion

MySQL database connection(s) failed. This could be caused by lost connections, and failed reconnects

Recommended Action

Use RTMT to check the Cisco UP SIP Proxy service trace log file for any detailed error messages

Routing List

Sys Log, Event Log, Alert Manager

Parameters

MySQPError (String)

ESPPassedParamInvalid

Invalid parameter specified

Cisco Unified Serviceability Alarm Definition Catalog

CiscoUPSSIPProxy

Severity

ERROR_ALARM

Explantion

Invalid parameters were specified. This could be because the parameters were NULL

Recommended Action

Use RTMT to check the Cisco UP SIP Proxy service trace log file for any detailed error messages

Routing List

Sys Log, Event Log, Alert Manager

Parameters

MySQL (String) ENUM (String) NumberExpansion (String) RAS (String)

ESPNumsvRouteError

Number services route error

Cisco Unified Serviceability Alarm Definition Catalog

CiscoUPSSIPProxy

Severity

ERROR_ALARM

Explantion

Number services route error encountered

Recommended Action

Use RTMT to check the Cisco UP SIP Proxy service trace log file for any detailed error messages

Routing List

Sys Log, Event Log, Alert Manager

Parameters

NumberServicesRoute (String)

ESPConnectToProvisioningServer

Failed to connect to the provisioning Server

Cisco Unified Serviceability Alarm Definition Catalog

CiscoUPSSIPProxy

Severity

ERROR_ALARM

Explantion

Failed to connect to the provisioning Server

Recommended Action

Use RTMT to check the Cisco UP SIP Proxy service trace log file for any detailed error messages

Routing List

Sys Log, Event Log, Alert Manager

ESPNAPTRInvalidRecord

NAPTR record format error

Cisco Unified Serviceability Alarm Definition Catalog

CiscoUPSSIPProxy

Severity

ERROR_ALARM

Explantion

This error may indicate invalid flag fields, missing delimiter, etc

Recommended Action

Use RTMT to check the Cisco UP SIP Proxy service trace log file for any detailed error messages

Routing List

Sys Log, Event Log, Alert Manager

Parameters

ENUM (String)

ESPASNLibInitError

Failed to initialize ASN encode/decode libraries

Cisco Unified Serviceability Alarm Definition Catalog

CiscoUPSSIPProxy

Severity

ERROR_ALARM

Explantion

Fialed to initialize ASN encode/decode libraries

Recommended Action

Use RTMT to check the Cisco UP SIP Proxy service trace log file for any detailed error messages

Routing List

Sys Log, Event Log, Alert Manager

ESPE164Error

E164 number errors

Cisco Unified Serviceability Alarm Definition Catalog

CiscoUPSSIPProxy

Severity

ERROR_ALARM

Explantion

The root cause could be a NULL (or empty) E164 number

Recommended Action

Use RTMT to check the Cisco UP SIP Proxy service trace log file for any detailed error messages

Routing List

Sys Log, Event Log, Alert Manager

Parameters

RAS (String)

ESPRASSendMessageFailed

RAS message send failure

Cisco Unified Serviceability Alarm Definition Catalog

CiscoUPSSIPProxy

Severity

ERROR_ALARM

Explantion

Failed to send RAS message

Recommended Action

Use RTMT to check the Cisco UP SIP Proxy service trace log file for any detailed error messages

Routing List

Sys Log, Event Log, Alert Manager

Parameters

RAS (String)

ESPVirtualProxyError

Virtual_Proxy_Domain related error.

Cisco Unified Serviceability Alarm Definition Catalog

CiscoUPSSIPProxy

Severity

ERROR_ALARM

Explantion

Virtual_Proxy_Domain related error.

Recommended Action

Use RTMT to check the Cisco UP SIP Proxy service trace log file for any detailed error messages

Routing List

Sys Log, Event Log, Alert Manager

ESPRegistryError

SIP Registry failure

Cisco Unified Serviceability Alarm Definition Catalog

CiscoUPSSIPProxy

Severity

ERROR_ALARM

Explantion

Unable to add registration to the SIP Registry because a resource limit was exceeded

Recommended Action

Use RTMT to check the Cisco UP SIP Proxy service trace log file for any detailed error messages

Routing List

Sys Log, Event Log, Alert Manager

Parameters

InvalidContact (String) ExceedMax (String) RegistryDatabaseError (String)

ESPRegistryInitFailed

SIP Registry initialization failure

Cisco Unified Serviceability Alarm Definition Catalog

CiscoUPSSIPProxy

Severity

ERROR_ALARM

Explantion

Unable to initialize the SIP Registry due to an internal error

Recommended Action

Use RTMT to check the Cisco UP SIP Proxy service trace log file for any detailed error messages

Routing List

Sys Log, Event Log, Alert Manager

Parameters

RegistryInit (String)

ESPRegistryLockFailed

SIP lock registry failure

Cisco Unified Serviceability Alarm Definition Catalog

CiscoUPSSIPProxy

Severity

ERROR_ALARM

Explantion

SIP lock registry failure

Recommended Action

Use RTMT to check the Cisco UP SIP Proxy service trace log file for any detailed error messages

Routing List

Sys Log, Event Log, Alert Manager

ESPRoutingError

SIP route interface error

Cisco Unified Serviceability Alarm Definition Catalog

CiscoUPSSIPProxy

Severity

ERROR_ALARM

Explantion

SIP Route Interface resource limit exceeded error

Recommended Action

Use RTMT to check the Cisco UP SIP Proxy service trace log file for any detailed error messages

Routing List

Sys Log, Event Log, Alert Manager

Parameters

ExceedMax (String) RoutingDatabaseError (String)

ESPRouteInitFailed

SIP Route interface initialization failure

Cisco Unified Serviceability Alarm Definition Catalog

CiscoUPSSIPProxy

Severity

ERROR_ALARM

Explantion

SIP Route interface initialization failed

Recommended Action

Use RTMT to check the Cisco UP SIP Proxy service trace log file for any detailed error messages

Routing List

Sys Log, Event Log, Alert Manager

Parameters

RoutingInit (String)

ESPRouteLockFailed

Failed to lock the Routing Information Base

Cisco Unified Serviceability Alarm Definition Catalog

CiscoUPSSIPProxy

Severity

ERROR_ALARM

Explantion

Failed to lock the Routing Information Base

Recommended Action

Use RTMT to check the Cisco UP SIP Proxy service trace log file for any detailed error messages

Routing List

Sys Log, Event Log, Alert Manager

ESPSIPURLWrong

Wrong SIP URL

Cisco Unified Serviceability Alarm Definition Catalog

CiscoUPSSIPProxy

Severity

ERROR_ALARM

Explantion

Wrong SIP URL

Recommended Action

Use RTMT to check the Cisco UP SIP Proxy service trace log file for any detailed error messages

Routing List

Sys Log, Event Log, Alert Manager

IPPMSCBFindFailed

SCB find failure

Cisco Unified Serviceability Alarm Definition Catalog

CiscoUPSSIPProxy

Severity

ERROR_ALARM

Explantion

A call to find_scb() returned NULL which indicates the SCB lookup failed

Recommended Action

Use RTMT to check the Cisco UP SIP Proxy service trace log file for any detailed error messages

Routing List

Sys Log, Event Log, Alert Manager

Parameters

SCBFindFailure (String)

IPPMSCBGetFailed

SCB get or create failure

Cisco Unified Serviceability Alarm Definition Catalog

CiscoUPSSIPProxy

Severity

ERROR_ALARM

Explantion

A call to tcbtable_acquire_tcb() returned NULL which indicates a SCB get/create failure

Recommended Action

Use RTMT to check the Cisco UP SIP Proxy service trace log file for any detailed error messages

Routing List

Sys Log, Event Log, Alert Manager

Parameters

SCBGetFailure (String)

UASCBFindFailed

SCB find failure

Cisco Unified Serviceability Alarm Definition Catalog

CiscoUPSSIPProxy

Severity

ERROR_ALARM

Explantion

A call to find_scb() returned NULL which indicates the SCB lookup failed

Recommended Action

Use RTMT to check the Cisco UP SIP Proxy service trace log file for any detailed error messages

Routing List

Sys Log, Event Log, Alert Manager

Parameters

SCBFindFailure (String)

UASCBGetFailed

SCB get or create failure

Cisco Unified Serviceability Alarm Definition Catalog

CiscoUPSSIPProxy

Severity

ERROR_ALARM

Explantion

A call to tcbtable_acquire_tcb() returned NULL which indicates a SCB get/create failure

Recommended Action

Use RTMT to check the Cisco UP SIP Proxy service trace log file for any detailed error messages

Routing List

Sys Log, Event Log, Alert Manager

Parameters

SCBGetFailure (String)

IPPMSCBInitFailed

SCB initialization failure

Cisco Unified Serviceability Alarm Definition Catalog

CiscoUPSSIPProxy

Severity

ERROR_ALARM

Explantion

SCB initialization failed

Recommended Action

Use RTMT to check the Cisco UP SIP Proxy service trace log file for any detailed error messages

Routing List

Sys Log, Event Log, Alert Manager

IPPMReadConnectionError

Connection read error

Cisco Unified Serviceability Alarm Definition Catalog

CiscoUPSSIPProxy

Severity

ERROR_ALARM

Explantion

IPPM reported a read error on the connection

Recommended Action

Use RTMT to check the Cisco UP SIP Proxy service trace log file for any detailed error messages

Routing List

Sys Log, Event Log, Alert Manager

Parameters

NonSupported (String)

CTIGWQBEFailedRequest

QBE Request failure

Cisco Unified Serviceability Alarm Definition Catalog

CiscoUPSSIPProxy

Severity

ERROR_ALARM

Explantion

The Cisco CTI Gateway application received a failed response to a request

Recommended Action

Use RTMT to check the Cisco UP SIP Proxy service trace log file for any detailed error messages

Routing List

Sys Log, Event Log, Alert Manager

CTIGWSystemError

Cisco CTI Gateway application system errors

Cisco Unified Serviceability Alarm Definition Catalog

CiscoUPSSIPProxy

Severity

ERROR_ALARM

Explantion

Cisco CTI Gateway application system errors

Recommended Action

Use RTMT to check the Cisco UP SIP Proxy service trace log file for any detailed error messages

Routing List

Sys Log, Event Log, Alert Manager

Parameters

CSTAError (String) InternalError (String) GeneralError (String)

PWSSCBFindFailed

SCB find failure

Cisco Unified Serviceability Alarm Definition Catalog

CiscoUPSSIPProxy

Severity

ERROR_ALARM

Explantion

A call to find_scb() returned NULL which indicates the SCB lookup failed

Recommended Action

Use RTMT to check the Cisco UP SIP Proxy service trace log file for any detailed error messages

Routing List

Sys Log, Event Log, Alert Manager

Parameters

SCBFindFailure (String)

PWSSCBInitFailed

SCB init failure

Cisco Unified Serviceability Alarm Definition Catalog

CiscoUPSSIPProxy

Severity

ERROR_ALARM

Explantion

SCB init failed

Recommended Action

Restart the Cisco UP SIP Proxy service

Routing List

Sys Log, Event Log, Alert Manager

Parameters

SCBInitFailure (String)

RTMT_ALERT

RTMT Alert

Cisco Unified Serviceability Alarm Definition Catalog

RTMTAlarmCatalog

Severity

ERROR_ALARM

Explantion

A Real-Time Monitoring Tool (RTMT) process in the AMC service uses the alarm mechanism to facilitate delivery of RTMT alerts in RTMT AlertCentral or via email.

Recommended Action

Check AlertCentral in RTMT or any alerts that you have received via email to determine what issue has occurred and learn the recommended actions to resolve it. In AlertCentral, right-click the alert to open the alert information.

Routing List

Event Log, Sys Log

Parameters

AlertName (String) AlertDetail (String)

IPMAApplicationError

IPMA Application error

Cisco Unified Serviceability Alarm Definition Catalog

JavaApplications

Severity

ERROR_ALARM

Explantion

IPMA application error

Recommended Action

See application logs for details

Routing List

Event Log, SNMP Traps

Parameters

ServletName (String) Reason (String)

IPMAOverloaded

IPMA Application overloaded

Cisco Unified Serviceability Alarm Definition Catalog

JavaApplications

Severity

ERROR_ALARM

Explantion

IPMA application overloaded

Recommended Action

See application logs for details

Routing List

Event Log, SNMP Traps

Parameters

ServletName (String) Reason (String)

IPMAFilteringDown

IPMA Application filtering is down

Cisco Unified Serviceability Alarm Definition Catalog

JavaApplications

Severity

ERROR_ALARM

Explantion

IPMA Application filtering is down

Recommended Action

Restart Cisco IP Manager Assistant Service

Routing List

Event Log, SNMP Traps

Parameters

ServletName (String) Reason (String)

BDIApplicationError

BDI Application error

Cisco Unified Serviceability Alarm Definition Catalog

JavaApplications

Severity

ERROR_ALARM

Explantion

BDI application error

Recommended Action

See application logs for details

Routing List

Event Log, SNMP Traps

Parameters

Reason (String)

BDIOverloaded

BDI Application overloaded

Cisco Unified Serviceability Alarm Definition Catalog

JavaApplications

Severity

ERROR_ALARM

Explantion

BDI application overloaded

Recommended Action

See application logs for details

Routing List

Event Log, SNMP Traps

Parameters

Reason (String)

WDApplicationError

WebDialer Application error

Cisco Unified Serviceability Alarm Definition Catalog

JavaApplications

Severity

ERROR_ALARM

Explantion

WebDialer application error

Recommended Action

See application logs for details

Routing List

Event Log, SNMP Traps

Parameters

ServletName (String) Reason (String)

WDOverloaded

WebDialer Application overloaded

Cisco Unified Serviceability Alarm Definition Catalog

JavaApplications

Severity

ERROR_ALARM

Explantion

WebDialer application overloaded

Recommended Action

See application logs for details

Routing List

Event Log, SNMP Traps

Parameters

ServletName (String) Reason (String)

CiscoDirSyncProcessFailedRetry

LDAPSync process failed on particular sync agreement

Cisco Unified Serviceability Alarm Definition Catalog

JavaApplications

Severity

ERROR_ALARM

Explantion

LDAPSync process failed to sync user data on the configured agreement id

Recommended Action

No action required. The sync process will automatic retry See application logs for details

Routing List

Sys Log, Event Log, SNMP Traps

Parameters

AgreementId (String) Reason (String)

CiscoDirSyncProcessFailedNoRetry

LDAPSync process failed on particular sync agreement

Cisco Unified Serviceability Alarm Definition Catalog

JavaApplications

Severity

ERROR_ALARM

Explantion

LDAPSync process failed to sync user data on the configured agreement id

Recommended Action

See application logs for details, the application will try to sync again in the next scheduled time

Routing List

Sys Log, Event Log, SNMP Traps

Parameters

AgreementId (String) Reason (String)

CiscoDirSyncProcessConnectionFailed

LDAPSync process failed to connect to LDAP server

Cisco Unified Serviceability Alarm Definition Catalog

JavaApplications

Severity

ERROR_ALARM

Explantion

LDAPSync process failed to connect to LDAP host

Recommended Action

Please make sure the LDAP server is online. If SSL is used, please make sure the required certificate is available on local CM server. The application will automatically retry

Routing List

Sys Log, Event Log, SNMP Traps

Parameters

AgreementId (String) LDAPHost (String) Reason (String)

CiscoDirSyncDBAccessFailure

LDAPSync process failed to access local database

Cisco Unified Serviceability Alarm Definition Catalog

JavaApplications

Severity

ERROR_ALARM

Explantion

CiscoDirSync failed to access local database

Recommended Action

Please make sure the local CallManager database is working properly. The failed sync process will restart at the next scheduled time.

Routing List

Sys Log, Event Log, SNMP Traps

Parameters

AgreementId (String) Reason (String)

DirSyncScheduledTaskFailed

Directory synchronization task failed

Cisco Unified Serviceability Alarm Definition Catalog

JavaApplications

Severity

ERROR_ALARM

Explantion

Directory synchronization task failed

Recommended Action

Check the DirSync configuration and logs

Routing List

Sys Log, Event Log, SNMP Traps

Parameters

ScheduleID (String) ErrorMessage (String)

DirSyncSchedulerFailedToGetDBSchedules

Failed to get directory synchronization schedules from DB

Cisco Unified Serviceability Alarm Definition Catalog

JavaApplications

Severity

ERROR_ALARM

Explantion

Failed to get directory synchronization schedules from DB

Recommended Action

Check the DirSync configuration and logs

Routing List

Sys Log, Event Log, SNMP Traps

Parameters

Message (String)

DirSyncSchedulerInvalidEventReceived

Invalid event received by DirSync scheduler from database

Cisco Unified Serviceability Alarm Definition Catalog

JavaApplications

Severity

ERROR_ALARM

Explantion

Invalid event received by DirSync scheduler from database

Recommended Action

Check the DirSync configuration and logs

Routing List

Sys Log, Event Log, SNMP Traps

Parameters

Action (String) Message (String)

DirSyncInvalidScheduleFound

Invalid schedule read by DirSync scheduler from database

Cisco Unified Serviceability Alarm Definition Catalog

JavaApplications

Severity

ERROR_ALARM

Explantion

Invalid schedule read by DirSync scheduler from database

Recommended Action

Check the DirSync configuration and logs

Routing List

Sys Log, Event Log, SNMP Traps

Parameters

ScheduleID (String)

DirSyncSchedulerFailedToRegisterDBEvents

DirSync scheduler failed to register DB notifications

Cisco Unified Serviceability Alarm Definition Catalog

JavaApplications

Severity

ERROR_ALARM

Explantion

Invalid schedule read by DirSync scheduler from database

Recommended Action

Check the DirSync configuration and logs

Routing List

Sys Log, Event Log, SNMP Traps

Parameters

ScheduleTable (String)

DirSyncSchedulerEngineFailedToStart

DirSync scheduler engine failed to start

Cisco Unified Serviceability Alarm Definition Catalog

JavaApplications

Severity

ERROR_ALARM

Explantion

DirSync scheduler engine failed to start

Recommended Action

Check the DirSync configuration and logs

Routing List

Sys Log, Event Log, SNMP Traps

Parameters

ScheduleTable (String)

DirSyncScheduleDeletionFailed

DirSync schedule deletion request failed

Cisco Unified Serviceability Alarm Definition Catalog

JavaApplications

Severity

ERROR_ALARM

Explantion

DirSync schedule deletion request failed

Recommended Action

Check the DirSync configuration and logs

Routing List

Sys Log, Event Log, SNMP Traps

Parameters

ScheduleID (String)

DirSyncScheduleUpdateFailed

DirSync schedule update request failed

Cisco Unified Serviceability Alarm Definition Catalog

JavaApplications

Severity

ERROR_ALARM

Explantion

DirSync schedule deletion update failed

Recommended Action

Check the DirSync configuration and logs

Routing List

Sys Log, Event Log, SNMP Traps

Parameters

ScheduleID (String)

CiscoDRFDBAccessFailure

DRF process failed to access local database

Cisco Unified Serviceability Alarm Definition Catalog

JavaApplications

Severity

ERROR_ALARM

Explantion

CiscoDirSync failed to access local database

Recommended Action

Please make sure the local CallManager database is working properly. The failed sync process will restart at the next scheduled time.

Routing List

Event Log, SNMP Traps

Parameters

Reason (String)

CiscoDRFMasterAgentStartFailure

DRF Master Agent was not able to start

Cisco Unified Serviceability Alarm Definition Catalog

JavaApplications

Severity

ERROR_ALARM

Explantion

DRF Master Agent might be down

Recommended Action

Check if the Master Agent is running or port 4040 is in use.

Routing List

Event Log, SNMP Traps

Parameters

Reason (String)

CiscoDRFLocalAgentStartFailure

DRF Local Agent was not able to start

Cisco Unified Serviceability Alarm Definition Catalog

JavaApplications

Severity

ERROR_ALARM

Explantion

DRF Local Agent might be down

Recommended Action

Check if the Local Agent is running or port 4343 is in use.

Routing List

Event Log, SNMP Traps

Parameters

Reason (String)

CiscoDRFBackupFailure

DRF Backup process has some problems.

Cisco Unified Serviceability Alarm Definition Catalog

JavaApplications

Severity

ERROR_ALARM

Explantion

DRF Backup process has some problems.

Recommended Action

Check if the disk is full or tape is not online.

Routing List

Event Log, SNMP Traps

Parameters

Reason (String)

CiscoDRFRestoreFailure

DRF Restore process has some problems.

Cisco Unified Serviceability Alarm Definition Catalog

JavaApplications

Severity

ERROR_ALARM

Explantion

DRF Restore process has some problems.

Recommended Action

Check if the disk is full or tape is not online.

Routing List

Event Log, SNMP Traps

Parameters

Reason (String)

CiscoDRFDeviceError

DRF process has the problem with device.

Cisco Unified Serviceability Alarm Definition Catalog

JavaApplications

Severity

ERROR_ALARM

Explantion

DRF process has the problem with device.

Recommended Action

Check if the proper device has been defined in the DB.

Routing List

Event Log, SNMP Traps

Parameters

Reason (String)

CiscoDRFInternalProcessFailure

DRF internal process has some problems.

Cisco Unified Serviceability Alarm Definition Catalog

JavaApplications

Severity

ERROR_ALARM

Explantion

DRF internal process has some problems.

Recommended Action

Check the reason, and restart Master Agent.

Routing List

Event Log, SNMP Traps

Parameters

Reason (String)

CiscoDhcpdFailure

DHCP Daemon stop running.

Cisco Unified Serviceability Alarm Definition Catalog

JavaApplications

Severity

ERROR_ALARM

Explantion

DHCP Daemon can't be brought up due to configuration error or crashed when it's running

Recommended Action

Check application log for error message and correct the configuration. May require restarting the application if nothing found during the previous steps

Routing List

Event Log, SNMP Traps, Sys Log

Parameters

Reason (String)

CiscoLicenseManagerDown

License Manager Down

Cisco Unified Serviceability Alarm Definition Catalog

JavaApplications

Severity

ERROR_ALARM

Explantion

License Manager down - license provisioning will fail

Recommended Action

Restart License Manager service on specified node

Routing List

Sys Log, Event Log, SNMP Traps

Parameters

Reason (String)

CiscoLicenseRequestFailed

License Request Unsuccessful

Cisco Unified Serviceability Alarm Definition Catalog

JavaApplications

Severity

ERROR_ALARM

Explantion

License Manager cannot fulfill the license request

Recommended Action

See application logs for error

Routing List

Sys Log, Event Log, SNMP Traps

Parameters

Reason (String)

CiscoLicenseDataStoreError

License Database error

Cisco Unified Serviceability Alarm Definition Catalog

JavaApplications

Severity

ERROR_ALARM

Explantion

License application cannot fulfill the request - database error

Recommended Action

See application logs for error

Routing List

Sys Log, Event Log, SNMP Traps

Parameters

Reason (String)

CiscoLicenseInternalError

Licensing Internal Error

Cisco Unified Serviceability Alarm Definition Catalog

JavaApplications

Severity

ERROR_ALARM

Explantion

License application internal error

Recommended Action

See application logs for error

Routing List

Sys Log, Event Log, SNMP Traps

Parameters

Reason (String)

CiscoLicenseFileError

License File Error

Cisco Unified Serviceability Alarm Definition Catalog

JavaApplications

Severity

ERROR_ALARM

Explantion

Invalid or tampered license file

Recommended Action

See application logs, verify that the license file is proper

Routing List

Sys Log, Event Log, SNMP Traps

Parameters

Reason (String)

DirSyncSchedulerFailedToUpdateNextExecTime

Scheduler failed to update next execution time

Cisco Unified Serviceability Alarm Definition Catalog

JavaApplications

Severity

ERROR_ALARM

Explantion

Scheduler failed to update next execution time

Recommended Action

Check the DirSync configuration and logs

Routing List

Event Log, SNMP Traps

Parameters

Message (String)

EspConfigAgentMemAllocError

Cisco UP Config Agent service was unable to allocate memory

Cisco Unified Serviceability Alarm Definition Catalog

CiscoUPSConfigAgent

Severity

ERROR_ALARM

Explantion

Cisco UP Config Agent service failed to allocate memory

Recommended Action

Using RTMT, verify system memory is low or exhausted. This alarm may indicate the system is overloaded which may require reassigning users to other nodes in the Cisco Unified Presence cluster. You can reassign users to other nodes using the Topology page on the Cisco Unified Presence Administration GUI

Routing List

Sys Log, Event Log, Alert Manager

Parameters

Location (String)

EspConfigAgentFileWriteError

Cisco UP Config Agent service was unable to write to the filesystem

Cisco Unified Serviceability Alarm Definition Catalog

CiscoUPSConfigAgent

Severity

ERROR_ALARM

Explantion

Cisco UP Config Agent service failed to write to a file. This may indicate the system is out of memory

Recommended Action

Using RTMT, verify disk space is low or exhausted. This alarm may indicate the system is overloaded which may require reassigning users to other nodes in the Cisco Unified Presence cluster. You can reassign users to other nodes using the Topology page on the Cisco Unified Presence Administration GUI

Routing List

Sys Log, Event Log, Alert Manager

Parameters

Reason (String)

EspConfigAgentSharedMemoryStaticRouteError

Cisco UP Config Agent service could not access static route shared memory

Cisco Unified Serviceability Alarm Definition Catalog

CiscoUPSConfigAgent

Severity

ERROR_ALARM

Explantion

Cisco UP Config Agent service failed to access static routes in shared memory. This may indicate the system is out of memory

Recommended Action

Using RTMT, verify system shared memory is low or exhausted. This alarm may indicate the system is overloaded which may require reassigning users to other nodes in the Cisco Unified Presence cluster. You can reassign users to other nodes using the Topology page on the Cisco Unified Presence Administration GUI

Routing List

Sys Log, Event Log, Alert Manager

EspConfigAgentLocalDBAccessError

Cisco UP Config Agent service was unable to access the local CUP database

Cisco Unified Serviceability Alarm Definition Catalog

CiscoUPSConfigAgent

Severity

ERROR_ALARM

Explantion

Cisco UP Config Agent service failed to read or write to the local CUP database. This may indicate a DB health issue.

Recommended Action

Using RTMT, verify system health. Verify that the service "A Cisco DB" is running.

Routing List

Sys Log, Event Log, Alert Manager

CUPInterclusterSyncAgentDuplicateUser

Cisco UP Intercluster Sync Agent service has detected a duplicate user between two (or more) Cisco Unified Presence clusters

Cisco Unified Serviceability Alarm Definition Catalog

CiscoUPInterclusterSyncAgent

Severity

ERROR_ALARM

Explantion

Cisco UP Intercluster Sync Agent service has detected a duplicate licensed user between two (or more) Cisco Unified Presence clusters. Duplicate users across clusters may cause presence outage issues

Recommended Action

Run the Cisco Unified Presence System Troubleshooter for more details related to this issue

Routing List

Sys Log, Event Log, Alert Manager

Parameters

userid (String) servers (String)

XcpDBConnectError

Cisco UP XCP data acces layer was unable to connect to the DB.

Cisco Unified Serviceability Alarm Definition Catalog

CiscoUPXCP

Severity

ERROR_ALARM

Explantion

Cisco UP XCP data access layer was unable to connect to the DB. This may indicate that the local or external database is down or the network connetivity to the external database is lost.

Recommended Action

Please check the System Troubleshooter for more information. Also check that the external database is running healthy and if there is any problem with the network connectivity to the external database server.

Routing List

Sys Log, Event Log, Alert Manager

XcpComponentConnectError

The XCP component failed to connect to the XCP Router. The component is shutting down.

Cisco Unified Serviceability Alarm Definition Catalog

CiscoUPXCP

Severity

ERROR_ALARM

Explantion

The concerned XCP component failed to connect to the XCP Router. The component is shutting down after reaching it~Rs configured number of reconnect attempts.

Recommended Action

Please check the component log file for more details.

Routing List

Sys Log, Event Log, Alert Manager

XcpComponentConfigError

The XCP component detected a bad configuration.

Cisco Unified Serviceability Alarm Definition Catalog

CiscoUPXCP

Severity

ERROR_ALARM

Explantion

The concerned XCP component failed to load the configuration due to an error. This may be due to an invalid element in the configuration file.

Recommended Action

Please check the component log file for more details.

Routing List

Sys Log, Event Log, Alert Manager

XcpMdnsStartError

The XCP Router failed to startup the MDNS.

Cisco Unified Serviceability Alarm Definition Catalog

CiscoUPXCP

Severity

ERROR_ALARM

Explantion

The XCP Router failed to startup the MDNS (Multicast Domain Name Service). This can cause connectivity failures to other routers in the cluster.

Recommended Action

Please check the XCP Router log file for more details.

Routing List

Sys Log, Event Log, Alert Manager

XcpCmPauseSockets

The XCP Router has directed the XCP Connection Manager (CM) to pause listening on its socket due to load on the system.

Cisco Unified Serviceability Alarm Definition Catalog

CiscoUPXCP

Severity

ERROR_ALARM

Explantion

Outstanding XCP internal packet or database requests have reached configured limit. Client connections will be paused until pending requests have dropped back below threshold. Users will experience lag until issue is resolved. Users may be disconnected if configured timeout is reached before resolution.

Recommended Action

Please check the XCP Router log file for more details. Watch for client disconnecting due to timeout from the XCP Connection Managers.

Routing List

Sys Log, Event Log, Alert Manager

XcpCmStartupError

The XCP Connection Manager service failed to startup.

Cisco Unified Serviceability Alarm Definition Catalog

CiscoUPXCP

Severity

ERROR_ALARM

Explantion

The XCP Connection Manager (CM) service failed to startup. One of the configured CM Directors may have failed to startup.

Recommended Action

Please check the CM log file for more details.

Routing List

Sys Log, Event Log, Alert Manager

XcpCmHttpdError

The XCP Connection Manager service has errors in the HTTP interface.

Cisco Unified Serviceability Alarm Definition Catalog

CiscoUPXCP

Severity

ERROR_ALARM

Explantion

The XCP Connection Manager (CM) service has errors in the HTTP interface. This can cause connectivity failures to HTTP based clients.

Recommended Action

Please check the CM log file for more details.

Routing List

Sys Log, Event Log, Alert Manager

XcpCmXmppdError

The XCP Connection Manager service has errors in the XMPP interface.

Cisco Unified Serviceability Alarm Definition Catalog

CiscoUPXCP

Severity

ERROR_ALARM

Explantion

The XCP Connection Manager (CM) service has errors in the XMPP interface. This can cause connectivity failures to XMPP based clients.

Recommended Action

Please check the CM log file for more details.

Routing List

Sys Log, Event Log, Alert Manager

XcpTxtConfGearError

The XCP Text Conference Manager Service failed to load a configured gear.

Cisco Unified Serviceability Alarm Definition Catalog

CiscoUPXCP

Severity

ERROR_ALARM

Explantion

The XCP Text Conference Manager (TC) Service has failed to load a configured component. This can prevent the service to start or behave as expected.

Recommended Action

Please check the XCP Text Conference log file for more details.

Routing List

Sys Log, Event Log, Alert Manager

XcpThirdPartyComplianceConnectError

Cisco XCP Router is unable to connect to Third Party Compliance Server

Cisco Unified Serviceability Alarm Definition Catalog

CiscoUPXCP

Severity

ERROR_ALARM

Explantion

Cisco XCP Router is unable to connect to Third Party Compliance Server. This may be because of a network problem or a Third Party Compliance Server config or licensing problem

Recommended Action

This is a serious error that breaks IM on CUP. Check network connection to and configuration(including licensing) on Third Party Compliance Server. To restore IM services set the Compliance Settings option in the Admin GUI to "Not Configured" until the connection failure cause has been identified

Routing List

Sys Log, Event Log, Alert Manager

kDbConnectionFailed

Database connection failed.

Cisco Unified Serviceability Alarm Definition Catalog

DBAlarmCatalog

Severity

ERROR_ALARM

Explantion

An attempt to connect to database failed.

Recommended Action

Enable trace for the database layer monitor to get specific error information.

Routing List

SDI, Event Log, Sys Log

Parameters

AdditionalInfo (String)

ErrorReadingInstalledRPMS

Could not read installed RPMs to populate component version table

Cisco Unified Serviceability Alarm Definition Catalog

DBAlarmCatalog

Severity

ERROR_ALARM

Explantion

The function that reads the rpm version information and populates database failed

Recommended Action

Please report this error to the administrator.

Routing List

SDI, Event Log, Sys Log

ErrorChangeNotifyClientTimeout

A change notification client was responding slowly and has been removed.

Cisco Unified Serviceability Alarm Definition Catalog

DBAlarmCatalog

Severity

ERROR_ALARM

Explantion

A change notification recipient hasn't responded to change notification in several minutes and was thus removed. This may delay call processing features, such as call forwarding and so on.

Recommended Action

Rebooting the box will clear this situation. Alternatively, dbnotify trace could be analyzed to find the client that was removed and that service could be restarted in Cisco Unified Serviceability.

Routing List

SDI, Event Log, Sys Log

IDSEngineCritical

Pay Attention. This alarm does not compromise data or prevent the use of the system.

Cisco Unified Serviceability Alarm Definition Catalog

DBAlarmCatalog

Severity

ERROR_ALARM

Explantion

Pay Attention. This alarm does not compromise data or prevent the use of the system.

Recommended Action

This alarm needs monitoring by the db admin

Routing List

SDI, Event Log, Sys Log

Parameters

class_id (String) class_msg (String) specific_msg (String)

IDSEngineFailure

Combined alarm for emergency and error situations. Something unexpected occurred that might compromise data or access to data or cause IDS to fail

Cisco Unified Serviceability Alarm Definition Catalog

DBAlarmCatalog

Severity

ERROR_ALARM

Explantion

This alarm indicates combined alarm for emergency and error situations. Something unexpected occurred that might compromise data or access to data or cause IDS to fail

Recommended Action

Requires db admin intervention

Routing List

SDI, Event Log, Sys Log

Parameters

class_id (String) class_msg (String) specific_msg (String)

IDSReplicationFailure

Combined alarm for emergency and error situations. IDS Replication has failed

Cisco Unified Serviceability Alarm Definition Catalog

DBAlarmCatalog

Severity

ERROR_ALARM

Explantion

This alarm indicates combined alarm for emergency and error situations. It indicates failure in IDS Replication

Recommended Action

Requires db admin intervention

Routing List

SDI, Event Log, Sys Log, Alert Manager

Parameters

class_id (String) class_msg (String) specific_msg (String)

CLM_UnrecognizedHost

ClusterMgr unrecognized host.

Cisco Unified Serviceability Alarm Definition Catalog

PlatformCatalog

Severity

ERROR_ALARM

Explantion

ClusterMgr has received a message from an IP address which is not configured as a node in this cluster.

Recommended Action

Verify that this IP address is currently configured as a server in this cluster.

Routing List

Event Log

Parameters

NodeIP (String)

EMCCFailedInLocalCluster

EMCC Login failure in local Call Manager.

Cisco Unified Serviceability Alarm Definition Catalog

EMAlarmCatalog

Severity

ERROR_ALARM

Explantion

EMCC login could fail due to 1. Using devices incompatile with EMCC feature. 2. Unable to retrieve remote cluster information. 3. EMCC is restricted by the local cluster. 4. Untrusted Certificate received from the remote end while trying to establish a connection

Recommended Action

1. Validate if the device model supports EMCC (EMCC Documentation). 2. Ensure that every remote cluster added for EMCC has valid hostname/IP address(es) for EM and PSTN Access in the RemoteCluster administration page (Logon to CUCM Administration page -> System -> EMCC -> Remote Cluster). Also, ensure that these entries are enabled. 3. Ensure that a bundle of all tomcat certificates (PKCS12) has been imported into the local tomcat-trust keystore (Logon to OS Administration page -> Security -> Certificate Management -> Check the certificates in tomcat-trust).

Routing List

Sys Log, Event Log, Alert Manager

Parameters

DeviceName (String) TimeStamp (String) UserID (String) Reason (String)

EMAppInitializationFailed

EM Application not started

Cisco Unified Serviceability Alarm Definition Catalog

EMAlarmCatalog

Severity

ERROR_ALARM

Explantion

Error occurred while starting application.

Recommended Action

See application logs for error. Default location for the logs are at /var/log/active/tomcat/logs/em/log4j/

Routing List

Sys Log, Event Log, Data Collector

Parameters

ServletName (String)

EMServiceConnectionError

EM Service not reachable

Cisco Unified Serviceability Alarm Definition Catalog

EMAlarmCatalog

Severity

ERROR_ALARM

Explantion

EM Service might be down in one or more nodes in the cluster.

Recommended Action

Check if Cisco Extension Mobility service is running on all nodes of the cluster where the service is activated.

Routing List

Sys Log, Event Log

Parameters

ServletName (String)

NodeNotTrusted

Untrusted Node was contacted

Cisco Unified Serviceability Alarm Definition Catalog

EMAlarmCatalog

Severity

ERROR_ALARM

Explantion

Application could not establish secure connection (SSL handshake failure) with another application. It could be due to 1. Certificate for tomcat service where the application is hosted is not trusted (not present in the keytore)

Recommended Action

1. Ensure that "tomcat-trust" keystore on each CCM node contains the tomcat certificates for every other node within a cluster (Logon to OS Administration Page -> Security -> Certificate Management -> Check the certificates in tomcat-trust). 2. If EMCC is enabled, then ensure that a bundle of all tomcat certificates (PKCS12) has been imported into the local tomcat-trust keystore (Logon to OS Administration Page -> Security -> Certificate Management -> Look for certificates in tomcat-trust).

Routing List

Sys Log, Event Log, Alert Manager

Parameters

TimeStamp (String) HostName (String)

DRFTruststoreMissing

DRF uses ipsec truststore certificate for securing communication between the MA and LA service. This certificate is missing on the node

Cisco Unified Serviceability Alarm Definition Catalog

DRFAlarmsCatalog

Severity

ERROR_ALARM

Explantion

DRF uses ipsec truststore certificate for securing communication between the MA and LA service. This certificate is missing on the node, DRF LA will not be able to connect to MA

Recommended Action

Download ipsec.pem file from Publisher and upload it as ipsec-trust only on the missing node then restart Cisco DRF Local service.

Routing List

Event Log, Sys Log

Parameters

Reason (String)

DRFUnknownClient

The DRF Master Agent running on the Publisher has received a Client connection request from an unknown server outside the cluster.The request has been rejected

Cisco Unified Serviceability Alarm Definition Catalog

DRFAlarmsCatalog

Severity

ERROR_ALARM

Explantion

The DRF Master Agent running on the Publisher has received a Client connection request from an unknown server outside the cluster.The request has been rejected.

Recommended Action

Remove the suspect server from the network. Refer to the Reason section for suspect servers: Hostname and IP Address

Routing List

Event Log, Sys Log

Parameters

Reason (String)

DRFSecurityViolation

The DRF System has detected a malicious pattern which could result in a security violation

Cisco Unified Serviceability Alarm Definition Catalog

DRFAlarmsCatalog

Severity

ERROR_ALARM

Explantion

The DRF Network Message contains a malicious pattern which could result in a security violation like code injection or directory traversal. DRF Network Message has been blocked.

Recommended Action

Stop the Cisco DRF Master and Cisco DRF Local Agent Services

Routing List

Event Log, Sys Log

Parameters

Reason (String)

DRFMasterAgentStartFailure

DRF Master Agent was unable to start because it was unable to open port 4040.

Cisco Unified Serviceability Alarm Definition Catalog

DRFAlarmsCatalog

Severity

ERROR_ALARM

Explantion

DRF Master Agent was unable to start because it was unable to open port 4040.

Recommended Action

Check if port 4040 is not already in use.

Routing List

Event Log, Sys Log

Parameters

Reason (String)

DRFLocalAgentStartFailure

DRF Local Agent was not able to start because it was unable to connect to the Master Agent on port 4040

Cisco Unified Serviceability Alarm Definition Catalog

DRFAlarmsCatalog

Severity

ERROR_ALARM

Explantion

DRF Local Agent was not able to start because it was unable to connect to the Master Agent on port 4040

Recommended Action

Check if the CiscoDRFMaster and CiscoDRFLocal services are running

Routing List

Event Log, Sys Log

Parameters

Reason (String)

DRFLA2MAFailure

DRF Local Agent is not able to connect to Master Agent.

Cisco Unified Serviceability Alarm Definition Catalog

DRFAlarmsCatalog

Severity

ERROR_ALARM

Explantion

DRF Local Agent is not able to connect to Master Agent.

Recommended Action

Check if the Master Agent is up and the port is authorized.

Routing List

Event Log, Sys Log

Parameters

Reason (String)

DRFMA2LAFailure

Master Agent was unable to send a backup/restore request to the local agent.

Cisco Unified Serviceability Alarm Definition Catalog

DRFAlarmsCatalog

Severity

ERROR_ALARM

Explantion

Master Agent was unable to send a backup/restore request to the local agent.

Recommended Action

Restart the corresponding local agents and the master agent.

Routing List

Event Log, Sys Log

Parameters

Reason (String)

DRFBackupFailure

Cisco DRF Backup process failed.

Cisco Unified Serviceability Alarm Definition Catalog

DRFAlarmsCatalog

Severity

ERROR_ALARM

Explantion

DRF Backup process encountered errors.

Recommended Action

Check DRF logs for further details.

Routing List

Event Log, Sys Log

Parameters

Reason (String)

DRFRestoreFailure

DRF Restore process failed.

Cisco Unified Serviceability Alarm Definition Catalog

DRFAlarmsCatalog

Severity

ERROR_ALARM

Explantion

DRF Restore process encountered errors.

Recommended Action

Check DRF logs for further details.

Routing List

Event Log, Sys Log

Parameters

Reason (String)

DRFBackupDeviceError

DRF Backup process is failed due to backup device error.

Cisco Unified Serviceability Alarm Definition Catalog

DRFAlarmsCatalog

Severity

ERROR_ALARM

Explantion

DRF Backup process is failed due to backup device error.

Recommended Action

Check if the proper device has been specified in the DRF configurations.

Routing List

Event Log, Sys Log

Parameters

Reason (String)

DRFTapeDeviceError

DRF is unable to access tape device.

Cisco Unified Serviceability Alarm Definition Catalog

DRFAlarmsCatalog

Severity

ERROR_ALARM

Explantion

DRF is unable to access tape device.

Recommended Action

Check if tape drive is working properly and it contains a valid tape.

Routing List

Event Log, Sys Log

Parameters

Reason (String)

DRFLocalDeviceError

DRF is unable to access local device.

Cisco Unified Serviceability Alarm Definition Catalog

DRFAlarmsCatalog

Severity

ERROR_ALARM

Explantion

DRF is unable to access local device.

Recommended Action

Check if local location exists and is accessible.

Routing List

Event Log, Sys Log

Parameters

Reason (String)

DRFInternalProcessFailure

DRF internal process has encountered an error.

Cisco Unified Serviceability Alarm Definition Catalog

DRFAlarmsCatalog

Severity

ERROR_ALARM

Explantion

DRF internal process has encountered an error.

Recommended Action

Check DRF logs for details.

Routing List

Event Log, Sys Log

Parameters

Reason (String)

DRFRestoreInternalError

DRF Restore operation has encountered an error. Restore cancelled internally.

Cisco Unified Serviceability Alarm Definition Catalog

DRFAlarmsCatalog

Severity

ERROR_ALARM

Explantion

DRF Restore operation has encountered an error. Restore cancelled internally.

Recommended Action

Check DRF logs for details.

Routing List

Event Log, Sys Log

Parameters

Reason (String)

DRFMABackupComponentFailure

DRF was unable to backup at least one component.

Cisco Unified Serviceability Alarm Definition Catalog

DRFAlarmsCatalog

Severity

ERROR_ALARM

Explantion

DRF requested a component to backup its' data. However, there was an error during the backup process and the component was not backed up.

Recommended Action

Please check the component backup logs and contact support if needed.

Routing List

Event Log, Sys Log

Parameters

Reason (String)

DRFMARestoreComponentFailure

DRF was unable to restore at least one component.

Cisco Unified Serviceability Alarm Definition Catalog

DRFAlarmsCatalog

Severity

ERROR_ALARM

Explantion

DRF requested a component to restore its' data. However, there was an error during the restore process and the component was not restored.

Recommended Action

Please check the component restore logs and contact support if needed.

Routing List

Event Log, Sys Log

Parameters

Reason (String)

DRFMABackupNodeDisconnect

The node being backed up disconnected from the Master Agent prior to being fully backed up.

Cisco Unified Serviceability Alarm Definition Catalog

DRFAlarmsCatalog

Severity

ERROR_ALARM

Explantion

The DRF Master Agent was running a backup operation on a CCM cluster, when one of the nodes disconnected before the backup operation was completed.

Recommended Action

Please check the computer that disconnected during backup. If the computer was accidentally shutdown, restart the backup.

Routing List

Event Log, Sys Log

Parameters

Reason (String)

DRFNoRegisteredComponent

No registered components available, backup failed.

Cisco Unified Serviceability Alarm Definition Catalog

DRFAlarmsCatalog

Severity

ERROR_ALARM

Explantion

DRF backup failed since no registered components are available.

Recommended Action

Ensure at least one component is registered before attempting a backup.

Routing List

Event Log, Sys Log

Parameters

Reason (String)

DRFNoRegisteredFeature

No feature selected for backup.

Cisco Unified Serviceability Alarm Definition Catalog

DRFAlarmsCatalog

Severity

ERROR_ALARM

Explantion

No feature selected for backup

Recommended Action

Ensure at least one feature is configured before attempting a backup.

Routing List

Event Log, Sys Log

Parameters

Reason (String)

DRFMARestoreNodeDisconnect

The node being restored disconnected from the Master Agent prior to being fully restored.

Cisco Unified Serviceability Alarm Definition Catalog

DRFAlarmsCatalog

Severity

ERROR_ALARM

Explantion

The DRF Master Agent was running a restore operation on a CCM cluster, when one of the nodes disconnected before the restore operation was completed.

Recommended Action

Please check the computer that disconnected during restore. If the computer was accidentally shutdown, restart the restore.

Routing List

Event Log, Sys Log

Parameters

Reason (String)

DRFSftpFailure

DRF sftp operation has failed.

Cisco Unified Serviceability Alarm Definition Catalog

DRFAlarmsCatalog

Severity

ERROR_ALARM

Explantion

DRF sftp operation has failed.

Recommended Action

Ensure that the destination server is available, has appropriate permissions and sftp daemon is running.

Routing List

Event Log, Sys Log

Parameters

Reason (String)

DRFRegistrationFailure

DRF Registration operation failed.

Cisco Unified Serviceability Alarm Definition Catalog

DRFAlarmsCatalog

Severity

ERROR_ALARM

Explantion

DRF Registration operation failed.

Recommended Action

DRF Registration failed for a component due to some internal error. Check the DRF logs and contact support if needed.

Routing List

Event Log, Sys Log

Parameters

Reason (String)

DRFBackupCancelInternalError

DRF Backup operation has encountered an error. Backup cancelled internally.

Cisco Unified Serviceability Alarm Definition Catalog

DRFAlarmsCatalog

Severity

ERROR_ALARM

Explantion

DRF Backup operation has encountered an error. Backup cancelled internally.

Recommended Action

Check DRF logs for details.

Routing List

Event Log, Sys Log

Parameters

Reason (String)

DRFFailure

DRF Backup or Restore process has failed.

Cisco Unified Serviceability Alarm Definition Catalog

DRFAlarmsCatalog

Severity

ERROR_ALARM

Explantion

DRF Backup or Restore process encountered errors.

Recommended Action

Check DRF logs for further details.

Routing List

Event Log, Alert Manager, Sys Log

Parameters

Reason (String)

SyslogStringMatchFound

The configured Syslog Alarm/message string had matched

Cisco Unified Serviceability Alarm Definition Catalog

SyslogCatalog

Severity

ERROR_ALARM

Explantion

Cisco Syslog Agent had detected an alarm which matches the configured string

Recommended Action

Take the necessary action based on the received string matched event

Routing List

SDI, Alert Manager

Parameters

StringMatch (String) MatchedEvent (String)

HardwareFailure

Hardware failure alarm is received

Cisco Unified Serviceability Alarm Definition Catalog

SyslogCatalog

Severity

ERROR_ALARM

Explantion

Cisco Syslog Agent had detected a hardware failure alarm

Recommended Action

Take the necessary action based on the received hardware failure event

Routing List

SDI, Alert Manager

Parameters

hwStringMatch (String)

SyslogSeverityMatchFound

The configured Syslog Alarm/message severity had matched

Cisco Unified Serviceability Alarm Definition Catalog

SyslogCatalog

Severity

ERROR_ALARM

Explantion

Cisco Syslog Agent had detected an alarm which matches the configured severity

Recommended Action

Take the necessary action based on the received severity matched event

Routing List

SDI, Alert Manager

Parameters

SeverityMatch (String) MatchedEvent (String)

CertExpiryError

Alarm that Indicating erros in certificate Expiry Monitor Process

Cisco Unified Serviceability Alarm Definition Catalog

CertMonitorAlarmCatalog

Severity

ERROR_ALARM

Explantion

Certificate is expiring

Recommended Action

Regenerate or reimport certificate.

Routing List

Event Log, Sys Log

Parameters

Message (String)

Warning-Level Alarms

The warning-level alarm is 4 and action is needed but priority of action is determined by the condition. A warning about some bad condition, which is not necessarily an error. Configuration error or an alarm that by itself does not indicate a warning but several instances of the same alarm do. Examples are:
  • Configuration error
  • One alarm of this level may not mean that an error has occurred but multiple of these would be considered an error

AuthenticationFailed

Login Authentication failed.

Cisco Unified Serviceability Alarm Definition Catalog

LoginAlarmCatalog

Severity

WARNING_ALARM

Explantion

Authentication failure for login attempt is detected.

Recommended Action

If this event happens repeatedly, investigate the source of the failed login attempts.

Routing List

Sys Log, Event Log, Alert Manager

Parameters

LoginFrom (String) TimeStamp (String) UserID (String) Interface (String)

TotalProcessesAndThreadsExceededThresholdStart

The current total number of processes and threads has exceeded the maximum number of tasks configured for Cisco RIS Data Collector service parameter. This situation could indicate some process is leaking or some process has thread leaking.

Cisco Unified Serviceability Alarm Definition Catalog

SystemAccessCatalog

Severity

WARNING_ALARM

Explantion

The current total number of processes and threads has exceeded the maximum number of tasks. This situation could indicate some process is leaking or some process has thread leaking.

Recommended Action

Check the Cisco RIS Data Collector service parameter, Maximum Number of Processes and Threads, to see if the parameter has been set to a low value. If it has been, set the value higher or use the default value. Another possible action is that when a new Cisco product is integrated into Cisco Unified Communications Manager (Unified CM), new processes or threads are added to the system. Even in the normal process load situation, it's possible that the total number of processes and threads has exceeded the configured or default value of the Cisco RIS Data Collector service parameter, Maximum Number of Processes and Threads. Set that parameter to the maximum allowed value. You can also review the details of this alarm to check the ProcessWithMostThreads description and the ProcessWithMostInstances description to discover which processes have the most threads and the most instances. Determine whether these values are reasonable for this process; if not, contact the owner of the process for troubleshooting the reasons why the thread count or the number of process instances is so high. It is also possible that Cisco RIS Data Collector sent a false alarm, which would indicate a defect in the Cisco RIS Data Collector service. To determine if this is the cause of the alarm - after you have checked all the other recommended actions described here - use RTMT to check the System object for performance counters Total Threads and Total Processes to confirm that the values in those counters do not exceed the value configured in the Cisco RIS Data Collector service parameter, Maximum Number of Processes and Threads. If the counters do not show a value that is higher than what is configured in the service parameter, restart Cisco RIS Data Collector service. If the alarm persists after restarting the service, go to Cisco Unified Serviceability and collect trace logs (Trace > Configuration) for Cisco Syslog, Cisco RIS Data Collector, Cisco AMC Service, and Cisco RIS Perfmon Logs and contact Cisco Technical Assistance Center (TAC) for detailed assistance.

Routing List

SDI, Sys Log, Event Log, Alert Manager

Parameters

NumberOfProcesses (String) NumberOfThreads (String) Reason (String) ProcessWithMostInstances (String) ProcessWithMostThreads (String)

LogPartitionLowWaterMarkExceeded

The percentage of used disk space in the log partition has exceeded the configured low water mark.

Cisco Unified Serviceability Alarm Definition Catalog

LpmTctCatalog

Severity

WARNING_ALARM

Explantion

The percentage of used disk space in the log partition has exceeded the configured low water mark.

Recommended Action

Login into RTMT and check the configured threshold value for LogPartitionLowWaterMarkExceeded alert in Alert Central. If the configured value is set to a lower than the default threshold value unintentionally, change the value to default. Also, examine the trace and log file setting for each of the application in trace configuration page under CCM Serviceability. If the number of configured traces / logs is set to greater than 1000, adjust the trace settings from trace configuration page to default. Also, clean up the trace files that are less than a week old. You can clean up the traces using cli "file delete" or using Remote Browse from RTMT Trace and Log Central function.

Routing List

SDI, Sys Log, Event Log, Alert Manager

Parameters

UsedDiskSpace (String) MessageString (String)

LogCollectionJobLimitExceeded

The number of Log Collection Jobs have excceded the allowed limit

Cisco Unified Serviceability Alarm Definition Catalog

LpmTctCatalog

Severity

WARNING_ALARM

Explantion

The number of concurrent trace collection from the server has exceeded the allowed limit of trace collection. The allowed limit is defined in the documentation for Trace and Log Central, however this limit can not be changed by sysadmin.

Recommended Action

Cancel one or more of the currently running queries and try again to configure the trace collection.

Routing List

Sys Log, Event Log, Data Collector

Parameters

JobType (String)

SparePartitionHighWaterMarkExceeded

The percentage of used disk space in the spare partition has exceeded the configured high water mark.

Cisco Unified Serviceability Alarm Definition Catalog

LpmTctCatalog

Severity

WARNING_ALARM

Explantion

The percentage of used disk space in the spare partition has exceeded the configured high water mark. Some of the trace files will be purged until the percentage of used disk space in the spare partition gets below the configured low water mark

Recommended Action

Login into RTMT and cheek the configured threshold value for SparePartitionHighWaterMarkExceeded alert in Alert Central. If the configured value is set to a lower than the default threshold value unintentionally, change the value to default. If you continue to receive this alert for half an hour after receiving the 1st alert, check for the disk usage for Spare partition under "Disk Usage" tab in RTMT. If the disk usage shown under that tab is higher than configured value in SparePartitionLowWaterMarkExceeded alert configuration, contact Cisco TAC to troubleshoot the cause of high disk usage in Common partition.

Routing List

SDI, Sys Log, Event Log, Alert Manager

Parameters

UsedDiskSpace (String) MessageString (String)

LegacyCUPCLogin

A legacy Cisco Unified Personal Communicator client attempted to login to the Cisco UP Client Profile Agent service

Cisco Unified Serviceability Alarm Definition Catalog

CiscoUPSSOAP

Severity

WARNING_ALARM

Explantion

A legacy Cisco Unified Personal Communicator client attempted to login to the Cisco UP Client Profile Agent service. Login was denied

Recommended Action

Please upgrade the legacy Cisco Unified Personal Communicator client as it is currently not supported

Routing List

Sys Log, SDI, Event Log, Alert Manager

Parameters

userid (String) version (String)

PENotifyTimeout

Timeout occurred when sending a SIP NOTIFY message to a client

Cisco Unified Serviceability Alarm Definition Catalog

Cisco UP Presence Engine

Severity

WARNING_ALARM

Explantion

Cisco UP Presence Engine service attempted to send a SIP NOTIFY message to a client but the message timed out

Recommended Action

Verify that the client is running and accepting SIP traffic on the configured port

Routing List

SDI, Sys Log, Event Log, Alert Manager

Parameters

DialogInformation (String)

PELoadHighWaterMark

Indicates the Cisco UP Presence Engine service has exceeded a CPU utilization threshold

Cisco Unified Serviceability Alarm Definition Catalog

Cisco UP Presence Engine

Severity

WARNING_ALARM

Explantion

The Cisco UP Presence Engine service has detected that the CPU utilization has exceeded the configured threshold. During this time the Cisco UP Presence Engine service will reject/redirect SIP SUBSCRIBE requests until the CPU utilization drops below the configured threshold

Recommended Action

Using RTMT, inspect the number of active subscription counters: ActiveSubscriptions, ActiveViews, SubscriptionActiveReceivedFromForeign and SubscriptionActiveSentForeign. If this condition persists, you may consider moving users to a different Cisco Unified Presence node in the cluster

Routing List

SDI, Sys Log, Event Log, Alert Manager

Parameters

HighWaterMarkMessage (String)

PEMemoryHighCondition

Indicates the Cisco UP Presence Engine service has hit a high memory threshold

Cisco Unified Serviceability Alarm Definition Catalog

Cisco UP Presence Engine

Severity

WARNING_ALARM

Explantion

The Cisco UP Presence Engine service has encountered a high memory condition. The Cisco UP Presence Engine service will reject or redirect SIP SUBSCRIBE requests until the memory condition has cleared

Recommended Action

Inspect the number of active subscription counters: ActiveSubscriptions, ActiveViews, SubscriptionActiveReceivedFromForeign and SubscriptionActiveSentForeign with RTMT. If this condition occurs consistently, consider offloading some users to a different CUP node in the cluster

Routing List

SDI, Sys Log, Event Log, Alert Manager

Parameters

HighMemoryCondition (String)

PEStateLocked

Cisco UP Presence Engine service is administratively prohibited from processing traffic

Cisco Unified Serviceability Alarm Definition Catalog

Cisco UP Presence Engine

Severity

WARNING_ALARM

Explantion

Cisco UP Presence Engine service is administratively prohibited from processing traffic

Recommended Action

Notification purposes only; no action is required

Routing List

SDI, Sys Log, Event Log, Alert Manager

PEStateDisabled

Cisco UP Presence Engine service is inoperable and unable to process traffic

Cisco Unified Serviceability Alarm Definition Catalog

Cisco UP Presence Engine

Severity

WARNING_ALARM

Explantion

Cisco UP Presence Engine service is inoperable and unable to process traffic

Recommended Action

Check the log files and monitor the Cisco UP Presence Engine service with RTMT

Routing List

SDI, Sys Log, Event Log, Alert Manager

CTIGWModuleNotEnabled

Cisco CTI Gateway application module is either not configured or enabled

Cisco Unified Serviceability Alarm Definition Catalog

CiscoUPSSIPProxy

Severity

WARNING_ALARM

Explantion

The Cisco CTI Gateway application is either not fully configured or enabled

Recommended Action

Configure and enable the Cisco CTI Gateway application using the Cisco Unified Presence Administration GUI CTI Gateway Settings page

Routing List

Sys Log, Event Log, Alert Manager

CTIGWUserNotLicenced

User has no license

Cisco Unified Serviceability Alarm Definition Catalog

CiscoUPSSIPProxy

Severity

WARNING_ALARM

Explantion

User failed to authorize due to no license available

Recommended Action

Check the Cisco CTI Gateway application license and user configuration

Routing List

Sys Log, Event Log, Alert Manager

CTIGWUserNotAuthorized

User not authorized by CTI Gateway

Cisco Unified Serviceability Alarm Definition Catalog

CiscoUPSSIPProxy

Severity

WARNING_ALARM

Explantion

User failed to authorized due to wrong device or line DN

Recommended Action

Verify user device configuration and MOC settings

Routing List

Sys Log, Event Log, Alert Manager

PWSAboveCPULimit

Indicates the Presence Web Service has exceeded a CPU utilization threshold

Cisco Unified Serviceability Alarm Definition Catalog

CiscoUPSSIPProxy

Severity

WARNING_ALARM

Explantion

The Presence Web Service module running in the Cisco UP SIP Proxy service has detected that the CPU utilization has exceeded the configured threshold. During this time new requests will be blocked until the CPU utilization drops below the configured threshold

Recommended Action

Using RTMT, inspect the Cisco UP SIP Proxy service logs for more details

Routing List

Sys Log, Event Log, Alert Manager

Parameters

AboveCPULimit (String)

PWSRequestLimitReached

Proxy service request per second limit reached

Cisco Unified Serviceability Alarm Definition Catalog

CiscoUPSSIPProxy

Severity

WARNING_ALARM

Explantion

The Cisco UP SIP Proxy service request per second limit has been reached

Recommended Action

You may need to throttle back the incoming request rate

Routing List

Sys Log, Event Log, Alert Manager

Parameters

RequestLimitReached (String)

PWSAboveSipSubscriptionLimit

Indicates the Presence Web Service subscription count has exceeded the maximum limit

Cisco Unified Serviceability Alarm Definition Catalog

CiscoUPSSIPProxy

Severity

WARNING_ALARM

Explantion

The Presence Web Service running in the Cisco UP SIP Proxy service has detected that the subscription count has exceeded the configured limit. During this time the Presence Web Service will block new incoming SIP subscriptions until the subscription count drops below the configured limit

Recommended Action

Using RTMT, inspect the Cisco UP SIP Proxy service logs for more details

Routing List

Sys Log, Event Log, Alert Manager

Parameters

AboveSipSubscriptionLimit (String)

IPMAStopped

IPMA Application stopped

Cisco Unified Serviceability Alarm Definition Catalog

JavaApplications

Severity

WARNING_ALARM

Explantion

Application was unloaded from Tomcat

Recommended Action

Check if Tomcat service is up.

Routing List

Event Log, SNMP Traps

Parameters

ServletName (String) Reason (String)

IPMAManagerLogout

IPMA Manager Logged out

Cisco Unified Serviceability Alarm Definition Catalog

JavaApplications

Severity

WARNING_ALARM

Explantion

IPMA Manager Logged out by application

Recommended Action

To re-login the user, click update in the CCMAdmin IPMA Service configuration page for this user.

Routing List

Event Log, SNMP Traps

Parameters

ServletName (String) Reason (String)

BDIStopped

BDI Application stopped

Cisco Unified Serviceability Alarm Definition Catalog

JavaApplications

Severity

WARNING_ALARM

Explantion

Application was unloaded from Tomcat

Recommended Action

Check if Tomcat service is up.

Routing List

Event Log, SNMP Traps

WDStopped

WebDialer Application stopped

Cisco Unified Serviceability Alarm Definition Catalog

JavaApplications

Severity

WARNING_ALARM

Explantion

Application was unloaded from Tomcat

Recommended Action

Check if Tomcat service is up.

Routing List

Event Log, SNMP Traps

Parameters

ServletName (String) Reason (String)

DirSyncNoSchedulesFound

No schedules found in DB for directory synchronization

Cisco Unified Serviceability Alarm Definition Catalog

JavaApplications

Severity

WARNING_ALARM

Explantion

No automatic LDAP directory synchronization possible

Recommended Action

Check the DirSync configuration

Routing List

Sys Log, Event Log, SNMP Traps

Parameters

ScheduleTable (String)

DirSyncScheduledTaskTimeoutOccured

Timeout occurred for directory synchronization task

Cisco Unified Serviceability Alarm Definition Catalog

JavaApplications

Severity

WARNING_ALARM

Explantion

Timeout occurred for directory synchronization task

Recommended Action

Check the DirSync configuration

Routing List

Sys Log, Event Log, SNMP Traps

Parameters

ScheduleID (String) TaskID (String)

CiscoDRFUnknownMessage

DRF process has received an unknown message, and discard.

Cisco Unified Serviceability Alarm Definition Catalog

JavaApplications

Severity

WARNING_ALARM

Explantion

DRF process has received an unknown message, and discard.

Recommended Action

None.

Routing List

Event Log, SNMP Traps

Parameters

Reason (String)

authFail

An attempt to authenticate this user with the given credentials failed.

Cisco Unified Serviceability Alarm Definition Catalog

IMSAlarmCatalog

Severity

WARNING_ALARM

Explantion

Failed to authenticate this user.

Recommended Action

Determine correct credentials and retry.

Routing List

Event Log

Parameters

UserID (String) Message (String)

SSONullTicket

A null ticket was passed.

Cisco Unified Serviceability Alarm Definition Catalog

IMSAlarmCatalog

Severity

WARNING_ALARM

Explantion

Failed to authenticate this user.

Recommended Action

Get non null ticket and retry.

Routing List

Event Log

Parameters

Message (String)

SSOServerUnreachable

SSO server could not be reached.

Cisco Unified Serviceability Alarm Definition Catalog

IMSAlarmCatalog

Severity

WARNING_ALARM

Explantion

SSO server could not be reached.

Recommended Action

Check reachability to SSO server.

Routing List

Event Log

Parameters

Message (String)

LDAPServerUnreachable

Authentication server could not be reached.

Cisco Unified Serviceability Alarm Definition Catalog

IMSAlarmCatalog

Severity

WARNING_ALARM

Explantion

Authentication server could not be reached.

Recommended Action

Check reachability to Authentication server.

Routing List

Event Log

Parameters

Message (String)

SSOuserNotInDB

User was not found in DB.

Cisco Unified Serviceability Alarm Definition Catalog

IMSAlarmCatalog

Severity

WARNING_ALARM

Explantion

User was not found in DB.

Recommended Action

Perform sync manually or wait till next scheduled sync.

Routing List

Event Log

Parameters

Message (String)

SSODisabled

SSO disabled on CUCM.

Cisco Unified Serviceability Alarm Definition Catalog

IMSAlarmCatalog

Severity

WARNING_ALARM

Explantion

SSO disabled on CUCM.

Recommended Action

run CLI command to enable SSO.

Routing List

Event Log

Parameters

Message (String)

SSOInternal

Failedto open a file.

Cisco Unified Serviceability Alarm Definition Catalog

IMSAlarmCatalog

Severity

WARNING_ALARM

Explantion

Failed to authenticate this user.

Recommended Action

Try again after some time.

Routing List

Event Log

Parameters

Message (String)

authLdapInactive

Authentication failed due to the user existing in the local database, but system is configured for LDAP authentication.

Cisco Unified Serviceability Alarm Definition Catalog

IMSAlarmCatalog

Severity

WARNING_ALARM

Explantion

A directory sync was likely done in the immediate past (1 day), This user has yet to be removed from the database. No action should be necessary. This should clear itself within 24 hours.

Recommended Action

No action should be necessary.

Routing List

Event Log

Parameters

UserID (String)

authAdminLock

The Administrator has locked this credential, therfore the authentication failed.

Cisco Unified Serviceability Alarm Definition Catalog

IMSAlarmCatalog

Severity

WARNING_ALARM

Explantion

User is locked out by administrator.

Recommended Action

Administrator may unlock this credential.

Routing List

Event Log

Parameters

UserID (String)

authHackLock

This user attempted to login unsuccessfully the number of times set by the administrator. At that time the credential is locked.

Cisco Unified Serviceability Alarm Definition Catalog

IMSAlarmCatalog

Severity

WARNING_ALARM

Explantion

User attempted too many incorrect authentications in the time frame set by the administrator.

Recommended Action

Wait for administrator specified time to retry, or have administrator unlock the credential.

Routing List

Event Log

Parameters

UserID (String)

authInactiveLock

Authentication failed because the credential is locked due to inactivity.

Cisco Unified Serviceability Alarm Definition Catalog

IMSAlarmCatalog

Severity

WARNING_ALARM

Explantion

User has been inactive for the administrator specified time. The credential is locked.

Recommended Action

Administrator may reset the credential.

Routing List

Event Log

Parameters

UserID (String)

EspConfigAgentNetworkOutage

Cisco UP Config Agent network outage

Cisco Unified Serviceability Alarm Definition Catalog

CiscoUPSConfigAgent

Severity

WARNING_ALARM

Explantion

Cisco UP Config Agent noticed a network outage

Recommended Action

Using RTMT, verify system health and network connectivity.

Routing List

Sys Log, Event Log, Alert Manager

EspConfigAgentNetworkRestored

Cisco UP Config Agent network restored

Cisco Unified Serviceability Alarm Definition Catalog

CiscoUPSConfigAgent

Severity

WARNING_ALARM

Explantion

Cisco UP Config Agent noticed network was restored

Recommended Action

Using RTMT, verify system health and network connectivity.

Routing List

Sys Log, Event Log, Alert Manager

EspConfigAgentHighMemoryUtilization

Virtual memory utilization has exceeded the configured threshold

Cisco Unified Serviceability Alarm Definition Catalog

CiscoUPSConfigAgent

Severity

WARNING_ALARM

Explantion

Available free virtual memory is low

Recommended Action

Use RTMT to monitor memory use and reduce system load to improve performance if necessary. The memory watermark can be configured through the Cisco Unified Presence Administration GUI Service Parameters for the Cisco UP Config Agent

Routing List

Sys Log, Event Log, Alert Manager

EspConfigAgentHighCPUUtilization

CPU utilization has exceeded the configured threshold

Cisco Unified Serviceability Alarm Definition Catalog

CiscoUPSConfigAgent

Severity

WARNING_ALARM

Explantion

CPU use is high

Recommended Action

Use RTMT to monitor CPU use and reduce system load to improve performance if necessary. The CPU watermark can be configured through the Cisco Unified Presence Administration GUI Service Parameters for the Cisco UP Config Agent

Routing List

Sys Log, Event Log, Alert Manager

EspConfigAgentRemoteDBAccessError

Cisco UP Config Agent service was unable to access a remote CUP database

Cisco Unified Serviceability Alarm Definition Catalog

CiscoUPSConfigAgent

Severity

WARNING_ALARM

Explantion

Cisco UP Config Agent service failed to read or write to a remote CUP database in the local cluster. This may indicate the system a DB health issue.

Recommended Action

Verify that the service "A Cisco DB" is running on the node specified in the alert. Sometimes these errors can be transient. In some cases the Config Agent may be accessing remote nodes that are not available for some reason. If that is the case then this error is expected. This would happen in a user reassignment to a node that is not installed or available.

Routing List

Sys Log, Event Log, Alert Manager

EspConfigAgentProxyDomainNotConfigured

Cisco UP Config Agent service requires the Proxy Domain service paramter for service Cisco UP Proxy to be configured.

Cisco Unified Serviceability Alarm Definition Catalog

CiscoUPSConfigAgent

Severity

WARNING_ALARM

Explantion

Cisco UP Config Agent service uses the Proxy Domain to properly generate ACLs. If not configured this could lead to routing failures.

Recommended Action

Go to the Service Parameters drop down menu on the CUP publisher. Select the Cisco UP Proxy service. Enter the CUP domain into the Proxy Domain service parameter and save.

Routing List

Sys Log, Event Log, Alert Manager

CUPICSACertificateCASignedTrustCertFound

Cisco UP Intercluster Sync Agent service detected a signed CA trust certificate

Cisco Unified Serviceability Alarm Definition Catalog

CiscoUPInterclusterSyncAgent

Severity

WARNING_ALARM

Explantion

Cisco UP Intercluster Sync Agent service detected a signed CA trust certificate

Recommended Action

Signed CA trust certificates are not allowed. Only unsigned CA trust certificates are allowed

Routing List

Sys Log, Event Log, Alert Manager

Parameters

SubjectCN (String) IssuerCN (String)

ServiceStartupFailed

Service startup failure.

Cisco Unified Serviceability Alarm Definition Catalog

GenericAlarmCatalog

Severity

WARNING_ALARM

Explantion

An attempt to start the specified service failed.

Recommended Action

Restart the service.

Routing List

Parameters

ServiceName (String)

CLM_ConnectivityTest

CLM Connectivity Test Failed.

Cisco Unified Serviceability Alarm Definition Catalog

PlatformCatalog

Severity

WARNING_ALARM

Explantion

Cluster Manager detected a network error.

Recommended Action

Verify connectivity between cluster nodes and fix any network issues.

Routing List

Event Log

Parameters

NodeIP (String) ErrorString (String)

EMCCFailedInRemoteCluster

EMCC Login failure at a remote Call Manager.

Cisco Unified Serviceability Alarm Definition Catalog

EMAlarmCatalog

Severity

WARNING_ALARM

Explantion

EMCC login could fail due to 1. User does not exist in any of the configured remote cluster. 2. User is not enabled for EMCC. 3. No free EMCC Base Device. 4. EMCC Access was prevented by remote cluster. 5. Untrusted Certificate received from the remote end while trying to establish a connection

Recommended Action

1. Ensure that the user is a valid EMCC user and make sure that user's home cluster is added as a EMCC remote cluster(Logon to CUCM Administration page -> System -> EMCC -> Remote Cluster -> Add New). 2. Contact remote site administrator to enable user for EMCC (Logon to CUCM Administration page -> User Management -> End User -> Select User -> Enable Extension mobility cross cluster checkbox) 3. Contact remote site administrator for adding / freeing up EMCC Base Devices (Logon to CUCM Administration page -> Bulk Administration -> EMCC -> Insert/Update EMCC). 4. Contact remote site administrator to validate the remote cluster setting for this cluster. 5. Ensure that a bundle of all tomcat certificates (PKCS12) has been imported into the local tomcat-trust keystore (Logon to OS Administration Page -> Security -> Certificate Management -> Check for all tomcat certificates in tomcat-trust).

Routing List

Sys Log, Event Log, Alert Manager

Parameters

DeviceName (String) TimeStamp (String) UserID (String) Reason (String)

UserInputFailure

EMCC Login failure due to invalid user input.

Cisco Unified Serviceability Alarm Definition Catalog

EMAlarmCatalog

Severity

WARNING_ALARM

Explantion

EMCC Login failed due to error in user input. This situation can arise due to 1. Invalid User Credentials. 2. Credentials have expired.

Recommended Action

1. Try again with valid credentials or try resetting the credentils.

Routing List

Sys Log, Event Log, Alert Manager

Parameters

DeviceName (String) TimeStamp (String) UserID (String) Reason (String)

CUPXCPConfigMgrQueueAtWarningLevel

Cisco UP XCP Config Manager buffer has reached warning levels.

Cisco Unified Serviceability Alarm Definition Catalog

CiscoUPXCPConfigManager

Severity

WARNING_ALARM

Explantion

Cisco UP XCP Config Manager buffer has reached warning levels.

Recommended Action

Halt configuration changes until Manager buffer has fallen below warning levels.

Routing List

Sys Log, Event Log, Alert Manager

CUPXCPConfigMgrQueueBelowWarningLevel

Cisco UP XCP Config Manager buffer has fallen below warning levels.

Cisco Unified Serviceability Alarm Definition Catalog

CiscoUPXCPConfigManager

Severity

WARNING_ALARM

Explantion

Cisco UP XCP Config Manager buffer has fallen below warning levels.

Recommended Action

System administrator may continue configuration of system.

Routing List

Sys Log, Event Log, Alert Manager

ReplicationFailure

Cisco UP Replication Watcher detected replication failure

Cisco Unified Serviceability Alarm Definition Catalog

CiscoUPReplicationWatcher

Severity

WARNING_ALARM

Explantion

Cisco UP Replication Watcher has detected database replication failure on this node. If this node is currently starting, some services will be prevented from starting until replication is established.

Recommended Action

Please check Cisco UP Replication Watcher logs for details. Replication status can be manually checked via the command line interface.

Routing List

Sys Log, Event Log, Alert Manager

ReplicationFailureClear

Cisco UP Replication Watcher detected that replication has been successfully established on this node.

Cisco Unified Serviceability Alarm Definition Catalog

CiscoUPReplicationWatcher

Severity

WARNING_ALARM

Explantion

Cisco UP Replication Watcher has detected that replication has been successfully established on this node.

Recommended Action

No action required. See Cisco UP Replication Watcher logs for details.

Routing List

Sys Log, Event Log, Alert Manager

ReplicationFailureTimeout

Cisco UP Replication Watcher startup timeout. Cisco UP Replication Watcher is allowing services to continue startup although replication has not completed setup on this publisher node.

Cisco Unified Serviceability Alarm Definition Catalog

CiscoUPReplicationWatcher

Severity

WARNING_ALARM

Explantion

Cisco UP Replication Watcher startup timeout. Cisco UP Replication Watcher is allowing services to continue startup although replication has not completed setup on this publisher node.

Recommended Action

Please check Cisco UP Replication Watcher logs for details. Replication status can be manually checked via the command line interface.

Routing List

Sys Log, Event Log, Alert Manager

DRFLogDirAccessFailure

DRF couldn't access the log directory.

Cisco Unified Serviceability Alarm Definition Catalog

DRFAlarmsCatalog

Severity

WARNING_ALARM

Explantion

DRF couldn't access the log directory.

Recommended Action

Ensure that the DRF user has required permission/enough space on DRF Log and Trace directory

Routing List

Event Log, Sys Log

Parameters

Reason (String)

DRFComponentDeRegistered

DRF succesfully de-registered the requested component.

Cisco Unified Serviceability Alarm Definition Catalog

DRFAlarmsCatalog

Severity

WARNING_ALARM

Explantion

DRF succesfully de-registered the requested component.

Recommended Action

Ensure that the component deregistered is not needed for further backup/restore operation.

Routing List

Event Log, Sys Log

Parameters

Reason (String)

DRFDeRegistrationFailure

DRF de-registration request for a component failed.

Cisco Unified Serviceability Alarm Definition Catalog

DRFAlarmsCatalog

Severity

WARNING_ALARM

Explantion

DRF de-registration request for a component failed.

Recommended Action

Please check the DRF logs and contact support if needed.

Routing List

Event Log, Sys Log

Parameters

Reason (String)

DRFDeRegisteredServer

DRF automatically de-registered all the components for a server.

Cisco Unified Serviceability Alarm Definition Catalog

DRFAlarmsCatalog

Severity

WARNING_ALARM

Explantion

This server might have got disconnected from CCM cluster.

Recommended Action

Nothing.

Routing List

Event Log, Sys Log

Parameters

Reason (String)

DRFSchedulerDisabled

DRF Scheduler is disabled because no configured features available for backup.

Cisco Unified Serviceability Alarm Definition Catalog

DRFAlarmsCatalog

Severity

WARNING_ALARM

Explantion

DRF Scheduler is disabled because no configured features available for backup.

Recommended Action

Ensure at least one feature is configured for the scheduled backup to run.

Routing List

Event Log, Sys Log

Parameters

Reason (String)

DRFNoBackupTaken

A valid backup of the current system was not found.

Cisco Unified Serviceability Alarm Definition Catalog

DRFAlarmsCatalog

Severity

WARNING_ALARM

Explantion

A valid backup of the current system was not found after an Upgarde/Migration or Fresh Install.

Recommended Action

It is recommended to perform a Backup using the Disaster Recovery System.

Routing List

Event Log, Sys Log

Parameters

Reason (String)

CertValidLessThanMonth

Alarm that indicates Certificate Expire in 30 days or lesser

Cisco Unified Serviceability Alarm Definition Catalog

CertMonitorAlarmCatalog

Severity

WARNING_ALARM

Explantion

The Expiry date of the Certificate indicated in the notification is less than a month

Recommended Action

Re-generate the certificate that is about to Expire from Certificate Management UI from CUOS Administration web Page. If the Certificate is issued by a CA, Generate a CSR, Submit CSR to CA, obtain a fresh certificate from CA and upload it to CUCM.

Routing List

Event Log, Sys Log

Parameters

Message (String)

Notice-Level Alarms

The notice-level alarm is 5 and no action is needed unless the information is unexpected. Notifications about interesting system-level conditions which are not error conditions. Informational in nature but having a more important need-to-know status. Examples are:
  • System-wide notifications
  • Process is shutting down gracefully on request
  • Clearing of previously raised conditions
  • A device or subsystem un-registering or shutting down for expected and normal reason (for individual phone related expected and normal unregistering or shutting down, informational level should be used)
  • Password change notification and upgrade notification

TotalProcessesAndThreadsExceededThresholdEnd

The current total number of processes and threads is less than the maximum number of tasks configured in the Cisco RIS Data Collector service parameter, Maximum Number of Processes and Threads.

Cisco Unified Serviceability Alarm Definition Catalog

SystemAccessCatalog

Severity

NOTICE_ALARM

Explantion

The current total number of processes and threads is less than the maximum number of tasks that has been configured in the Cisco RIS Data Collector service parameter, Maximum Number of Processes and Threads. This can occur because a product which was integrated into Cisco Unified Communications Manager has been disabled or deactivated, which reduces the total number of processes and threads running on the system. Another cause for the number of processes or thread to decrease is that one or more processes has been stopped, which reduces the total number of processes and threads running on the system.

Recommended Action

This alarm is for information purposes only; no action is required.

Routing List

SDI, Sys Log, Event Log, Alert Manager

Parameters

NumberOfProcesses (String) NumberOfThreads (String) Reason (String)

PEPeerNodeFailureCleared

Cisco UP Presence Engine service on the clusters peer node has returned to normal operation

Cisco Unified Serviceability Alarm Definition Catalog

Cisco UP Presence Engine

Severity

NOTICE_ALARM

Explantion

The Cisco UP Presence Engine service running on the cluster peer node has returned to normal operation

Recommended Action

Notification purposes only; no action is required

Routing List

SDI, Sys Log, Event Log

Parameters

PeerFailureCleared (String)

PELoadHighWaterMarkCleared

Cisco UP Presence Engine service high water threshold has cleared

Cisco Unified Serviceability Alarm Definition Catalog

Cisco UP Presence Engine

Severity

NOTICE_ALARM

Explantion

The Cisco UP Presence Engine service has cleared the previous high water threshold (which was caused by high CPU utilization), and is now accepting SIP requests

Recommended Action

Notification purposes only; no action is required

Routing List

SDI, Sys Log, Event Log

Parameters

HighWaterMarkCleared (String)

PEIDStoTimestenDatabaseSyncErrorCleared

Synchronization between the Cisco Unified Presence database and the Cisco Unified Presence Engine database established

Cisco Unified Serviceability Alarm Definition Catalog

Cisco UP Presence Engine

Severity

NOTICE_ALARM

Explantion

The Cisco UP Presence Engine service has established synchronization between Cisco Unified Presence database and the Cisco Unified Presence Engine database

Recommended Action

Notification purposes only; no action is required

Routing List

SDI, Sys Log, Event Log

PEMemoryHighConditionCleared

Indicates that the Cisco UP Presence Engine service has cleared the high memory condition

Cisco Unified Serviceability Alarm Definition Catalog

Cisco UP Presence Engine

Severity

NOTICE_ALARM

Explantion

The Cisco UP Presence Engine service has cleared high memory condition and will now accept SIP messages

Recommended Action

Notification purposes only; no action is required

Routing List

SDI, Sys Log, Event Log

Parameters

HighMemoryConditionCleared (String)

PESipSgHostUnavailableClear

Cisco UP Presence Engine service can now contact the outbound proxy server group

Cisco Unified Serviceability Alarm Definition Catalog

Cisco UP Presence Engine

Severity

NOTICE_ALARM

Explantion

Cisco UP Presence Engine service can now contact the outbound proxy server group

Recommended Action

Notification purposes only; no action is required

Routing List

SDI, Sys Log, Event Log

Parameters

SipSgHost (String)

PEOamInitialConfigFileClear

Cisco UP Presence Engine service configuration file now appears to be valid

Cisco Unified Serviceability Alarm Definition Catalog

Cisco UP Presence Engine

Severity

NOTICE_ALARM

Explantion

Cisco UP Presence Engine service configuration file is now correct

Recommended Action

Notification purposes only; no action is required

Routing List

SDI, Sys Log, Event Log

Parameters

PEOamConfigFileURI (String)

PEStateEnabled

Cisco UP Presence Engine service is now able to process traffic

Cisco Unified Serviceability Alarm Definition Catalog

Cisco UP Presence Engine

Severity

NOTICE_ALARM

Explantion

Cisco UP Presence Engine service is now able to process traffic

Recommended Action

Notification purposes only; no action is required

Routing List

SDI, Sys Log, Event Log

PECalendarConnectionLossCleared

Cisco UP Presence Engine service has regained connection to the Calendar Server

Cisco Unified Serviceability Alarm Definition Catalog

Cisco UP Presence Engine

Severity

NOTICE_ALARM

Explantion

The Cisco UP Presence Engine service has successfully committed a transaction to the Calendar Server. The connection has been restored

Recommended Action

Notification purposes only; no action is required

Routing List

SDI, Sys Log, Event Log

Parameters

CalendarConnectionLossCleared (String)

PWSBelowCPULimit

CPU utilization has fallen below the max CPU limit

Cisco Unified Serviceability Alarm Definition Catalog

CiscoUPSSIPProxy

Severity

NOTICE_ALARM

Explantion

CPU utilization has fallen below the max CPU limit, new requests will no longer be blocked

Recommended Action

Notification purposes only; no action is required

Routing List

Sys Log, Event Log

Parameters

BelowCPULimit (String)

PWSBelowSipSubscriptionLimit

Subscriptions have fallen below the max limit

Cisco Unified Serviceability Alarm Definition Catalog

CiscoUPSSIPProxy

Severity

NOTICE_ALARM

Explantion

The Presence Web Service running in the Cisco UP SIP Proxy service has detected that the subscription count has fallen below the configured limit

Recommended Action

Notification purposes only; no action is required

Routing List

Sys Log, Event Log

Parameters

BelowSipSubscriptionLimit (String)

authExpired

The authentication failed because this credential has expired.

Cisco Unified Serviceability Alarm Definition Catalog

IMSAlarmCatalog

Severity

NOTICE_ALARM

Explantion

This user's credentials have expired.

Recommended Action

Administrator may reset the credential.

Routing List

Event Log

Parameters

UserID (String)

authMustChange

Authentication failed because it is marked that it must be changed by the user at this time.

Cisco Unified Serviceability Alarm Definition Catalog

IMSAlarmCatalog

Severity

NOTICE_ALARM

Explantion

User Must Change is set on this credential. The user can gain access after changing the credential.

Recommended Action

User or Administrator may reset credential.

Routing List

Event Log

Parameters

UserID (String)

credReadFailure

Some error was encountered when attempting to read credential from the database. This could be a network or database issue.

Cisco Unified Serviceability Alarm Definition Catalog

IMSAlarmCatalog

Severity

NOTICE_ALARM

Explantion

Error occured attempting to read a credential.

Recommended Action

Ensure credential (user name) exists. Could be database problem.

Routing List

Event Log

Parameters

UserID (String) Message (String)

ServiceActivated

Service Activated.

Cisco Unified Serviceability Alarm Definition Catalog

ServiceManagerAlarmCatalog

Severity

NOTICE_ALARM

Explantion

This service is now activated.

Recommended Action

No action is required.

Routing List

Event Log, SDI, Sys Log

Parameters

ServiceName (String)

ServiceDeactivated

Service Deactivated.

Cisco Unified Serviceability Alarm Definition Catalog

ServiceManagerAlarmCatalog

Severity

NOTICE_ALARM

Explantion

This service is now deactivated.

Recommended Action

No action is required.

Routing List

Event Log, SDI, Sys Log

Parameters

ServiceName (String)

EspConfigAgentServiceStartFailed

Cisco UP Config Agent failed to start a feature service

Cisco Unified Serviceability Alarm Definition Catalog

CiscoUPSConfigAgent

Severity

NOTICE_ALARM

Explantion

Cisco UP Config Agent failed to start one of the feature services

Recommended Action

Please use the serviceability page to check status and start the service manually

Routing List

Sys Log, Event Log

EspConfigAgentServiceStopFailed

Cisco UP Config Agent failed to stop a feature service

Cisco Unified Serviceability Alarm Definition Catalog

CiscoUPSConfigAgent

Severity

NOTICE_ALARM

Explantion

Cisco UP Config Agent failed to stop one of the feature services

Recommended Action

Please use the serviceability page to check status and stop the service manually

Routing List

Sys Log, Event Log

EspConfigAgentHighMemoryUtilizationClear

Virtual memory utilization is below the configured low watermark

Cisco Unified Serviceability Alarm Definition Catalog

CiscoUPSConfigAgent

Severity

NOTICE_ALARM

Explantion

Virtual memory use exceeded the high memory use watermark, but has since fallen below the low memory watermark

Recommended Action

Notification purposes only; no action is required

Routing List

Sys Log, Event Log

EspConfigAgentHighCPUUtilizationClear

CPU utilization is below the configured low watermark

Cisco Unified Serviceability Alarm Definition Catalog

CiscoUPSConfigAgent

Severity

NOTICE_ALARM

Explantion

CPU use exceeded the high CPU use watermark, but has since fallen below the low CPU watermark

Recommended Action

Notification purposes only; no action is required

Routing List

Sys Log, Event Log

EMAppStopped

EM Application stopped

Cisco Unified Serviceability Alarm Definition Catalog

EMAlarmCatalog

Severity

NOTICE_ALARM

Explantion

Application is shutting down gracefully because of an unloaded from Tomcat.

Recommended Action

No action required on this application.

Routing List

Sys Log, Event Log

Parameters

ServletName (String)

CertValidityOver30Days

Alarm to Indicate certificate to Expiry is approaching but expiry date is more than 30 days

Cisco Unified Serviceability Alarm Definition Catalog

CertMonitorAlarmCatalog

Severity

NOTICE_ALARM

Explantion

Information Alarm that Indicates a Certificate Validity Period is approaching and validity of certificate is more than 30 days

Recommended Action

Re-generate the certificate that is about to Expire from Certificate Management UI from CUOS Administration web Page. If the Certificate is issued by a CA, Generate a CSR, Submit CSR to CA, obtain a fresh fresh certificate from CA and upload it to CUCM

Routing List

Event Log, Sys Log

Parameters

Message (String)

Informational-Level Alarms

The informational-level of alarm is 6 and no action is needed. Informational messages provide historical data such as internal flows of the application or per-request information. Informational messages are used for troubleshooting by users who are familiar with the basic flows of the application. An example would be a normal (expected) event occurred that the customer may want to be notified about

AuthenticationSucceeded

Login Authentication succeeded.

Cisco Unified Serviceability Alarm Definition Catalog

LoginAlarmCatalog

Severity

INFORMATIONAL_ALARM

Explantion

Authentication success for login attempt is detected.

Recommended Action

If this event is expected, no action is required; otherwise, notify the administrator.

Routing List

Sys Log, Event Log

Parameters

LoginFrom (String) TimeStamp (String) UserID (String) Interface (String)

LogFileSearchStringFound

The search string has been found in the log file.

Cisco Unified Serviceability Alarm Definition Catalog

LpmTctCatalog

Severity

INFORMATIONAL_ALARM

Explantion

Trace and Log Central has found the search string that the user has configured

Recommended Action

If sysadmin is interested in collecting the traces around the time of generation of alert, use Trace and Log Central to collect the traces for that service.

Routing List

Sys Log, Event Log, Alert Manager

Parameters

SearchString (String)

AdministrativeEvent

Audit Event is generated by this application

Cisco Unified Serviceability Alarm Definition Catalog

AuditLogCatalog

Severity

INFORMATIONAL_ALARM

Explantion

Failed to write into the primary file path.

Recommended Action

Ensure that the primary file path is valid and the corresponding drive has sufficient disk space. Also, make sure that the path has security permissions similar to default log file path.

Routing List

Audit Log

Parameters

UserID (String) ClientAddress (String) Severity (String) EventType (String) ResourceAccessed (String) EventStatus (String) AuditDetails (String) ComponentID (String) CompulsoryEvent (String) AuditCategory (String)

SecurityEvent

Audit Event is generated by this application

Cisco Unified Serviceability Alarm Definition Catalog

AuditLogCatalog

Severity

INFORMATIONAL_ALARM

Explantion

Failed to write into the primary file path.

Recommended Action

Ensure that the primary file path is valid and the corresponding drive has sufficient disk space. Also, make sure that the path has security permissions similar to default log file path.

Routing List

Audit Log, Alert Manager

Parameters

UserID (String) ClientAddress (String) Severity (String) EventType (String) ResourceAccessed (String) EventStatus (String) AuditDetails (String) ComponentID (String) CompulsoryEvent (String) AuditCategory (String)

CriticalEvent

Audit Event is generated by this application

Cisco Unified Serviceability Alarm Definition Catalog

AuditLogCatalog

Severity

INFORMATIONAL_ALARM

Explantion

Failed to write into the primary file path.

Recommended Action

Ensure that the primary file path is valid and the corresponding drive has sufficient disk space. Also, make sure that the path has security permissions similar to default log file path.

Routing List

Audit Log, Sys Log, Alert Manager

Parameters

UserID (String) ClientAddress (String) Severity (String) EventType (String) ResourceAccessed (String) EventStatus (String) AuditDetails (String) ComponentID (String) CompulsoryEvent (String) AuditCategory (String)

PESipMessageTimeout

Timeout occurred on SIP message transmission

Cisco Unified Serviceability Alarm Definition Catalog

Cisco UP Presence Engine

Severity

INFORMATIONAL_ALARM

Explantion

The transmission of an Cisco UP Presence Engine service SIP message timed out

Recommended Action

Look for possible network latency problems

Routing List

SDI, Sys Log, Event Log

Parameters

SipMessageCallID (String)

PEStateStopped

Cisco UP Presence Engine service is terminating

Cisco Unified Serviceability Alarm Definition Catalog

Cisco UP Presence Engine

Severity

INFORMATIONAL_ALARM

Explantion

Cisco UP Presence Engine service is terminating

Recommended Action

Notification purposes only; no action is required

Routing List

SDI, Sys Log, Event Log

PEStateShuttingdown

Cisco UP Presence Engine service is shutting down

Cisco Unified Serviceability Alarm Definition Catalog

Cisco UP Presence Engine

Severity

INFORMATIONAL_ALARM

Explantion

Cisco UP Presence Engine service is shutting down but will continue to process existing transactions. However, no new transactions will be processed

Recommended Action

Notification purposes only; no action is required

Routing List

SDI, Sys Log, Event Log

PEStateUnlocked

Cisco UP Presence Engine service is administratively permitted to process traffic

Cisco Unified Serviceability Alarm Definition Catalog

Cisco UP Presence Engine

Severity

INFORMATIONAL_ALARM

Explantion

Cisco UP Presence Engine service is administratively permitted to process traffic

Recommended Action

Notification purposes only; no action is required

Routing List

SDI, Sys Log, Event Log

ESPStarted

Cisco UP SIP Proxy service child process has been started

Cisco Unified Serviceability Alarm Definition Catalog

CiscoUPSSIPProxy

Severity

INFORMATIONAL_ALARM

Explantion

Cisco UP SIP Proxy service child process has started successfully

Recommended Action

Notification purposes only; no action is required

Routing List

Sys Log, Event Log

Parameters

Version (String)

CTIGWStarted

Cisco CTI Gateway application started

Cisco Unified Serviceability Alarm Definition Catalog

CiscoUPSSIPProxy

Severity

INFORMATIONAL_ALARM

Explantion

Cisco CTI Gateway application started

Recommended Action

Notification purposes only; no action is required

Routing List

Sys Log, Event Log

CTIGWStopped

Cisco CTI Gateway application stopped

Cisco Unified Serviceability Alarm Definition Catalog

CiscoUPSSIPProxy

Severity

INFORMATIONAL_ALARM

Explantion

Cisco CTI Gateway application stopped

Recommended Action

Notification purposes only; no action is required

Routing List

Sys Log, Event Log

CTIGWRestarted

Cisco CTI Gateway application restarted

Cisco Unified Serviceability Alarm Definition Catalog

CiscoUPSSIPProxy

Severity

INFORMATIONAL_ALARM

Explantion

Cisco CTI Gateway application restarted

Recommended Action

Notification purposes only; no action is required

Routing List

Sys Log, Event Log

CTIGWConnectionRestarted

CTI connection was restarted

Cisco Unified Serviceability Alarm Definition Catalog

CiscoUPSSIPProxy

Severity

INFORMATIONAL_ALARM

Explantion

The CTI/QBE connection was restarted

Recommended Action

Notification purposes only; no action is required

Routing List

Sys Log, Event Log

CALBackendCalConn

Calendar server connection was established

Cisco Unified Serviceability Alarm Definition Catalog

CiscoUPSSIPProxy

Severity

INFORMATIONAL_ALARM

Explantion

Connection to the calendar server was established

Recommended Action

Notification purposes only; no action is required

Routing List

Sys Log, Event Log

CALMtngPlSvrConn

MeetingPlace server connection was established

Cisco Unified Serviceability Alarm Definition Catalog

CiscoUPSSIPProxy

Severity

INFORMATIONAL_ALARM

Explantion

Connection to the MeetingPlace server was established

Recommended Action

Notification purposes only; no action is required

Routing List

Sys Log, Event Log

IPMAStarted

IPMA Application started

Cisco Unified Serviceability Alarm Definition Catalog

JavaApplications

Severity

INFORMATIONAL_ALARM

Explantion

Application started successfully

Recommended Action

No action required.

Routing List

Event Log, SNMP Traps

Parameters

ServletName (String) Reason (String)

IPMAInformation

IPMA Information

Cisco Unified Serviceability Alarm Definition Catalog

JavaApplications

Severity

INFORMATIONAL_ALARM

Explantion

Application information

Recommended Action

No action required.

Routing List

Event Log, SNMP Traps

Parameters

ServletName (String) Reason (String)

BDIStarted

BDI Application started

Cisco Unified Serviceability Alarm Definition Catalog

JavaApplications

Severity

INFORMATIONAL_ALARM

Explantion

Application started successfully

Recommended Action

No action required.

Routing List

Event Log, SNMP Traps

WDStarted

WebDialer Application started

Cisco Unified Serviceability Alarm Definition Catalog

JavaApplications

Severity

INFORMATIONAL_ALARM

Explantion

Application started successfully

Recommended Action

No action required.

Routing List

Event Log, SNMP Traps

Parameters

ServletName (String) Reason (String)

WDInformation

WebDialer informational alarm

Cisco Unified Serviceability Alarm Definition Catalog

JavaApplications

Severity

INFORMATIONAL_ALARM

Explantion

WebDialer application informational alarm

Recommended Action

No action required

Routing List

Event Log, SNMP Traps

Parameters

ServletName (String) Reason (String)

CiscoDirSyncStarted

Cisco DirSync Application started

Cisco Unified Serviceability Alarm Definition Catalog

JavaApplications

Severity

INFORMATIONAL_ALARM

Explantion

Application started successfully

Recommended Action

No action required.

Routing List

Sys Log, Event Log, SNMP Traps

CiscoDirSyncProcessStarted

LDAPSync process started on particular sync agreement

Cisco Unified Serviceability Alarm Definition Catalog

JavaApplications

Severity

INFORMATIONAL_ALARM

Explantion

LDAPSync process started to sync user data on the configured agreement id

Recommended Action

No action required

Routing List

Sys Log, Event Log, SNMP Traps

Parameters

AgreementId (String)

CiscoDirSyncProcessCompleted

LDAPSync process completed on particular sync agreement

Cisco Unified Serviceability Alarm Definition Catalog

JavaApplications

Severity

INFORMATIONAL_ALARM

Explantion

LDAPSync process completed to sync user data on the configured agreement id

Recommended Action

No action required

Routing List

Sys Log, Event Log, SNMP Traps

Parameters

AgreementId (String)

CiscoDirSyncProcessStoppedManually

LDAPSync process stopped manually on particular sync agreement

Cisco Unified Serviceability Alarm Definition Catalog

JavaApplications

Severity

INFORMATIONAL_ALARM

Explantion

LDAPSync process stopped manually on the configured agreement id

Recommended Action

No action required

Routing List

Sys Log, Event Log, SNMP Traps

Parameters

AgreementId (String)

CiscoDirSyncProcessStoppedAuto

LDAPSync process stopped automatically on particular sync agreement

Cisco Unified Serviceability Alarm Definition Catalog

JavaApplications

Severity

INFORMATIONAL_ALARM

Explantion

LDAPSync process stopped automatically on the configured agreement id, it will be restarted automatically

Recommended Action

No action required

Routing List

Sys Log, Event Log, SNMP Traps

Parameters

AgreementId (String)

CiscoDirsyncZeroUsersSynced

LDAPSync process synced zero users for the sync agreement

Cisco Unified Serviceability Alarm Definition Catalog

JavaApplications

Severity

INFORMATIONAL_ALARM

Explantion

CiscoDirSync synced zero users

Recommended Action

Check the application logs for details

Routing List

Sys Log, Event Log, SNMP Traps

Parameters

AgreementId (String) Reason (String)

UserUpdated

LDAPSync process found a user with the same userid synced from a different LDAP agreement. Updated the already existing user in the DB with the new user synced

Cisco Unified Serviceability Alarm Definition Catalog

JavaApplications

Severity

INFORMATIONAL_ALARM

Explantion

LDAPSync process found a user with the same userid synced from a different LDAP agreement. Updated the already existing user in the DB with the new user synced

Recommended Action

No action required

Routing List

Sys Log, Event Log, SNMP Traps

Parameters

AgreementId (String) Userid (String) Reason (String)

DirSyncScheduledTaskOver

Directory synchronization operation got over

Cisco Unified Serviceability Alarm Definition Catalog

JavaApplications

Severity

INFORMATIONAL_ALARM

Explantion

Information of the directory synchronization started

Recommended Action

No action required

Routing List

Sys Log, Event Log, SNMP Traps

Parameters

ScheduleID (String) TaskID (String)

DirSyncSchedulerEngineStopped

DirSync scheduler engine stopped

Cisco Unified Serviceability Alarm Definition Catalog

JavaApplications

Severity

INFORMATIONAL_ALARM

Explantion

DirSync scheduler engine stopped

Recommended Action

No action required

Routing List

Sys Log, Event Log, SNMP Traps

Parameters

Version (String)

DirSyncNewScheduleInserted

New schedule inserted in the DirSync Scheduler Engine

Cisco Unified Serviceability Alarm Definition Catalog

JavaApplications

Severity

INFORMATIONAL_ALARM

Explantion

New schedule inserted in the DirSync Scheduler Engine

Recommended Action

No Action Required

Routing List

Sys Log, Event Log, SNMP Traps

Parameters

ScheduleID (String)

CiscoDRFLA2MAFailure

DRF LA to MA connection has some problems.

Cisco Unified Serviceability Alarm Definition Catalog

JavaApplications

Severity

INFORMATIONAL_ALARM

Explantion

DRF LA to MA connection has some problems.

Recommended Action

Check if the Master Agent is up and the port is authorized.

Routing List

Event Log, SNMP Traps

Parameters

Reason (String)

CiscoDRFMA2LAFailure

DRF MA to LA connection has some problems.

Cisco Unified Serviceability Alarm Definition Catalog

JavaApplications

Severity

INFORMATIONAL_ALARM

Explantion

DRF MA to LA connection has some problems.

Recommended Action

Check if the Local Agent is up and the port is authorized.

Routing List

Event Log, SNMP Traps

Parameters

Reason (String)

CiscoDRFHistory

DRF History Report.

Cisco Unified Serviceability Alarm Definition Catalog

JavaApplications

Severity

INFORMATIONAL_ALARM

Explantion

DRF History Report.

Recommended Action

None.

Routing List

Event Log, SNMP Traps

Parameters

Reason (String)

CiscoDhcpdRestarted

DHCP Daemon restarted.

Cisco Unified Serviceability Alarm Definition Catalog

JavaApplications

Severity

INFORMATIONAL_ALARM

Explantion

DHCP Daemon restarted successfully.

Recommended Action

None.

Routing List

Event Log, SNMP Traps, Sys Log

Parameters

Reason (String)

CiscoLicenseFileInvalid

License File Invalid

Cisco Unified Serviceability Alarm Definition Catalog

JavaApplications

Severity

INFORMATIONAL_ALARM

Explantion

Invalid license file due to MAC Address

Recommended Action

License files need to be rehosted.

Routing List

Sys Log, Event Log, SNMP Traps

Parameters

Reason (String)

CiscoHardwareLicenseInvalid

Invalid / Obsolete Hardware. Cannot upload license files.

Cisco Unified Serviceability Alarm Definition Catalog

JavaApplications

Severity

INFORMATIONAL_ALARM

Explantion

Installation on invalid / obsolete hardware. Cannot upload license files.

Recommended Action

Please obtain correct hardware and re-install.

Routing List

Sys Log, Event Log, SNMP Traps

Parameters

Reason (String)

DirSyncScheduleInsertFailed

DirSync schedule insertion failed

Cisco Unified Serviceability Alarm Definition Catalog

JavaApplications

Severity

INFORMATIONAL_ALARM

Explantion

DirSync schedule insertion failed

Recommended Action

Check the DirSync configuration and logs

Routing List

Event Log, SNMP Traps

Parameters

ScheduleID (String)

DirSyncSchedulerEngineStarted

DirSync scheduler engine started

Cisco Unified Serviceability Alarm Definition Catalog

JavaApplications

Severity

INFORMATIONAL_ALARM

Explantion

DirSync scheduler engine started

Recommended Action

No action required

Routing List

Event Log, SNMP Traps

Parameters

Version (String)

authSuccess

User successfully authenticated.

Cisco Unified Serviceability Alarm Definition Catalog

IMSAlarmCatalog

Severity

INFORMATIONAL_ALARM

Explantion

Successfully authenticated this user.

Recommended Action

No action required.

Routing List

Event Log

Parameters

UserID (String)

credUpdateFailure

There are a number of reasons an update of a credential could fail. Likely cause is that the credential doesn't pass security requirements (too short for example), has been used previously, etc.

Cisco Unified Serviceability Alarm Definition Catalog

IMSAlarmCatalog

Severity

INFORMATIONAL_ALARM

Explantion

Some problem updating the credential.

Recommended Action

Determine issue (check length requirements, etc.) for this credential and retry.

Routing List

Event Log

Parameters

UserID (String)

credUpdateSuccess

The credential has been updated.

Cisco Unified Serviceability Alarm Definition Catalog

IMSAlarmCatalog

Severity

INFORMATIONAL_ALARM

Explantion

Credential was successfully updated.

Recommended Action

No action required.

Routing List

Event Log

Parameters

UserID (String)

credFullUpdateSuccess

Fields associated with this credential have been successfully updated.

Cisco Unified Serviceability Alarm Definition Catalog

IMSAlarmCatalog

Severity

INFORMATIONAL_ALARM

Explantion

Credential was successfully updated.

Recommended Action

No action required.

Routing List

Event Log

Parameters

Message (String)

credFullUpdateFailure

The update for the fields associated with this credential failed.

Cisco Unified Serviceability Alarm Definition Catalog

IMSAlarmCatalog

Severity

INFORMATIONAL_ALARM

Explantion

An error was encountered during update of credential fields.

Recommended Action

Determine issue and retry.

Routing List

Event Log

Parameters

Message (String)

credReadSuccess

This credential was successfully accessed from the databse.

Cisco Unified Serviceability Alarm Definition Catalog

IMSAlarmCatalog

Severity

INFORMATIONAL_ALARM

Explantion

Successfully read a credential.

Recommended Action

No action required.

Routing List

Event Log

Parameters

UserID (String)

AdminPassword

Administrative password changed successfully, or unsuccessfully based on message displayed.

Cisco Unified Serviceability Alarm Definition Catalog

IMSAlarmCatalog

Severity

INFORMATIONAL_ALARM

Explantion

Password change succeeded or failed based on message displayed.

Recommended Action

No further recommendation.

Routing List

Event Log

Parameters

Message (String)

CUPICSACertificateDBDeletionFailed

Cisco UP Intercluster Sync Agent service failed to remove certificate information

Cisco Unified Serviceability Alarm Definition Catalog

CiscoUPInterclusterSyncAgent

Severity

INFORMATIONAL_ALARM

Explantion

Cisco UP Intercluster Sync Agent service failed to remove Certificate information from the database because it was non-existent

Recommended Action

Notification purposes only; no action is required

Routing List

Sys Log, Event Log

PermissionDenied

Permission has been denied.

Cisco Unified Serviceability Alarm Definition Catalog

GenericAlarmCatalog

Severity

INFORMATIONAL_ALARM

Explantion

An operation could not be completed because the process did not have authority to perform it.

Recommended Action

This alarm is for information purposes only; no action is required.

Routing List



ServiceStopped

Service stopped.

Cisco Unified Serviceability Alarm Definition Catalog

GenericAlarmCatalog

Severity

INFORMATIONAL_ALARM

Explantion

A service has stopped.

Recommended Action

This alarm is for information purposes only; no action is required.

Routing List

Parameters

IPAddress (String) Hostname (String) ServiceName (String) ProcessID (ULong)

ServiceStarted

Service started.

Cisco Unified Serviceability Alarm Definition Catalog

GenericAlarmCatalog

Severity

INFORMATIONAL_ALARM

Explantion

A service has started.

Recommended Action

This alarm is for information purposes only; no action is required.

Routing List

Parameters

IPAddress (String) IPV6Address (String) Hostname (String) ServiceName (String) VersionInfo (String) ProcessID (ULong)

XcpDBConnectRestore

Cisco UP XCP data access layer was able to restore connection to the DB.

Cisco Unified Serviceability Alarm Definition Catalog

CiscoUPXCP

Severity

INFORMATIONAL_ALARM

Explantion

Cisco UP XCP data access layer was able to restore connection to the DB. The alert condition, if any, caused by the connection failure will be cleared.

Recommended Action

None.

Routing List

Sys Log, Event Log

XcpCmResumeSockets

Outstanding internal packet or database requests have dropped back below configured threshold.

Cisco Unified Serviceability Alarm Definition Catalog

CiscoUPXCP

Severity

INFORMATIONAL_ALARM

Explantion

XCP Connection Manager has been notified to resume listening on client connections.

Recommended Action

Please check the XCP Router log file for more details.

Routing List

Sys Log, Event Log

XcpTxtConfRoomLimitError

This server has a limit on the maximum number of supported text conference rooms.

Cisco Unified Serviceability Alarm Definition Catalog

CiscoUPXCP

Severity

INFORMATIONAL_ALARM

Explantion

There is a maximum limit of 16500 text conference rooms per server. This limit is the combined total of both persistent chat rooms and adhoc chat rooms.

Recommended Action

In order to increase the maximum supported text chat room capacity, additional servers must be deployed.

Routing List

Sys Log, Event Log

XcpThirdPartyComplianceConnectRestore

Cisco XCP Router is reconnected to Third Party Compliance Server

Cisco Unified Serviceability Alarm Definition Catalog

CiscoUPXCP

Severity

INFORMATIONAL_ALARM

Explantion

Cisco XCP Router is reconnected to Third Party Compliance Server. This indicates an initial connection or reconnection

Recommended Action

None.

Routing List

Sys Log, Event Log

IDSEngineDebug

Indicates debug events from IDS database engine.

Cisco Unified Serviceability Alarm Definition Catalog

DBAlarmCatalog

Severity

INFORMATIONAL_ALARM

Explantion

This alarm provides low-level debugging information from IDS database engine. System administrator can disregard this alarm.

Recommended Action

This is for debug information purposes only; no action is required.

Routing List

SDI, Event Log

Parameters

class_id (String) class_msg (String) specific_msg (String)

IDSEngineInformation

No error has occurred but some routine event completed in IDS database engine.

Cisco Unified Serviceability Alarm Definition Catalog

DBAlarmCatalog

Severity

INFORMATIONAL_ALARM

Explantion

This alarm is informational. No error has occurred but some routine event completed in IDS database engine.

Recommended Action

This is for information purposes only; no action is required.

Routing List

SDI, Event Log

Parameters

class_id (String) class_msg (String) specific_msg (String)

IDSReplicationInformation

Information about IDS replication

Cisco Unified Serviceability Alarm Definition Catalog

DBAlarmCatalog

Severity

INFORMATIONAL_ALARM

Explantion

This alarm provides information about IDS replication.

Recommended Action

Informational purposes only; no action is required

Routing List

SDI, Event Log

Parameters

class_id (String) class_msg (String) specific_msg (String)

CLM_IPSecCertUpdated

IPSec self-signed cert updated.

Cisco Unified Serviceability Alarm Definition Catalog

PlatformCatalog

Severity

INFORMATIONAL_ALARM

Explantion

The IPSec self-signed cert from a peer node in the cluster has been imported due to a change.

Recommended Action

No action is required.

Routing List

Event Log

Parameters

NodeName (String)

CLM_IPAddressChange

IP address change in cluster.

Cisco Unified Serviceability Alarm Definition Catalog

PlatformCatalog

Severity

INFORMATIONAL_ALARM

Explantion

The IP address of a peer node in the cluster has changed.

Recommended Action

No action is required.

Routing List

Event Log

Parameters

NodeName (String) NodeOldIP (String) NodeNewIP (String)

CLM_PeerState

Current ClusterMgr session state.

Cisco Unified Serviceability Alarm Definition Catalog

PlatformCatalog

Severity

INFORMATIONAL_ALARM

Explantion

The ClusterMgr session state with another node in the cluster has changed to the current state.

Recommended Action

No action is required.

Routing List

Event Log

Parameters

NodeName (String) NodeState (String)

EMCCUserLoggedIn

EMCC login was successful.

Cisco Unified Serviceability Alarm Definition Catalog

EMAlarmCatalog

Severity

INFORMATIONAL_ALARM

Explantion

The user has successfully logged in to extension mobility cross-cluster (EMCC).

Recommended Action

Informational purposes only; no action is required.

Routing List

Sys Log, Event Log

Parameters

DeviceName (String) TimeStamp (String) UserID (String)

EMCCUserLoggedOut

EMCC logout was successful.

Cisco Unified Serviceability Alarm Definition Catalog

EMAlarmCatalog

Severity

INFORMATIONAL_ALARM

Explantion

The user has successfully logged out of extension mobility cross-cluster (EMCC).

Recommended Action

Informational purposes only; no action is required.

Routing List

Sys Log, Event Log

Parameters

DeviceName (String) TimeStamp (String) UserID (String)

EMAppStarted

EM Application started

Cisco Unified Serviceability Alarm Definition Catalog

EMAlarmCatalog

Severity

INFORMATIONAL_ALARM

Explantion

Application started successfully.

Recommended Action

No action required.

Routing List

Sys Log, Event Log

Parameters

ServletName (String)

DRFComponentRegistered

DRF Succesfully Registered the requested component.

Cisco Unified Serviceability Alarm Definition Catalog

DRFAlarmsCatalog

Severity

INFORMATIONAL_ALARM

Explantion

DRF Succesfully Registered the requested component.

Recommended Action

Ensure that the registered component is needed for backup/restore operation.

Routing List

Event Log, Sys Log

Parameters

Reason (String)

DRFSchedulerUpdated

DRF Scheduled backup configurations is updated automatically due to feature DeRegistration.

Cisco Unified Serviceability Alarm Definition Catalog

DRFAlarmsCatalog

Severity

INFORMATIONAL_ALARM

Explantion

DRF Scheduled backup configurations is updated automatically due to feature DeRegistration.

Recommended Action

Ensure that the new configurations is appropriate one for the backup/restore operation.

Routing List

Event Log, Sys Log

Parameters

Reason (String)

DRFBackupCompleted

DRF backup completed successfully.

Cisco Unified Serviceability Alarm Definition Catalog

DRFAlarmsCatalog

Severity

INFORMATIONAL_ALARM

Explantion

DRF backup completed successfully.

Recommended Action

Ensure that the backup operation completed successfully.

Routing List

Event Log, Sys Log

Parameters

Reason (String)

DRFRestoreCompleted

DRF restore completed successfully.

Cisco Unified Serviceability Alarm Definition Catalog

DRFAlarmsCatalog

Severity

INFORMATIONAL_ALARM

Explantion

DRF restore completed successfully.

Recommended Action

Ensure that the restore operation completed successfully.

Routing List

Event Log, Sys Log

Parameters

Reason (String)

CertExpiryApproaching

Information Alarm that Indicates a Certificate Validity Period is approaching and the expiry date is within the notification window configured

Cisco Unified Serviceability Alarm Definition Catalog

CertMonitorAlarmCatalog

Severity

INFORMATIONAL_ALARM

Explantion

Certificate Expiry Date is approaching shortly and Certificate is going to be invalid.

Recommended Action

Re-generate the certificate that is about to Expire from Certificate Management UI from CUOS Administration web Page. If the Certificate is issued by a CA, Generate a CSR, Submit CSR to CSA ,obtain a fresh certificate from CA and upload it to CUCM

Routing List

Event Log, Sys Log

Parameters

Message (String)