Table Of Contents

Viewing Results with the Monitoring Console

Opening the Monitoring Console

Displaying the Diagnostic Results

Notifications and Their Console Display

Example of a Monitoring Console

Monitoring Console Toolbar Buttons

Displaying Notification Properties on the Monitoring Console

General Tab

Codebook Tab

Details Tab

Identifying Trends with Graphs

Viewing Results with the Monitoring Console

---

These topics describe how to access your domain manager and view the diagnostic result from the Monitoring Console:

•Opening the Monitoring Console

•Displaying the Diagnostic Results

The Administration Console and the Polling and Thresholds Console are described in Chapter 5, "The DFM Administration Console and Polling and Thresholds Console."

Opening the Monitoring Console

The Monitoring Console is designed specifically for viewing diagnostic results. This section describes the most common ways to open a new Monitoring Console. For instructions on how to open an existing console that is stored remotely, see the "Opening the Monitoring Console" section on page 13-2.

To open a Monitoring Console:

•Select Device Fault Manager  > Monitoring Console. This opens a Monitoring Console that, by default, does not display the Inventory Browser.

•You can also open a new Monitoring Console from any running console in a session. From any running console, select File > New > Monitoring Console (or, from the Administration Console, click the Monitoring Console toolbar button).

This opens a Monitoring Console that, by default, does display the Inventory Browser, and attaches it to the same domain manager as the running console. The Monitoring Console automatically begins receiving notifications. The new Monitoring Console is part of the same session as the running console.

Displaying the Diagnostic Results

One of the unique features of DFM is its ability to identify the cause of problems. It also determines the overall effects of each problem and can display all of the possible symptomatic events that a problem may cause.

If any abnormal conditions are observed, notifications begin to appear in the Alarm Log view of your Monitoring Console. Detailed explanations of notifications are described in "Faults and Exceptions Diagnosed by DFM."

---

Note If a DFM client resides in a time zone different from that of the DFM server machine, times displayed in the Alarm Log are converted to the client's time zone. For additional information on how CiscoWorks2000 handles time zones, refer to the Release Notes for CiscoWorks2000 CD One, 3rd Edition.

---

The remaining topics described in this section are:

•Notifications and Their Console Display

•Example of a Monitoring Console

•Monitoring Console Toolbar Buttons

•Displaying Notification Properties on the Monitoring Console

•Identifying Trends with Graphs

For information about how to rearrange the columns of your Alarm Log, notifications, and other operator tasks such as customizing your Alarm Log with filters for incoming notifications, see the "Alarm Log Tasks" section on page 13-5.

Notifications and Their Console Display

DFM generates two kinds of notifications: compound events and symptomatic events. (Symptomatic events and compound events are all types of events.)

•Compound event notifications identify a managed object that has one or more symptomatic events associated with it. Compound event notifications are aggregated ("rolled up") to the device or the VLAN level.

•Symptomatic event notifications indicate abnormal conditions. Events are primarily used as symptoms for root-cause analysis.

These notifications are displayed in two places:

•In an Alarm Log, when they occur.

•On the Events tab of the property sheet for the object where the event occurs. (A property sheet is displayed in the DFM Inventory Browser view or by using the Browse button from the Notification Properties window. For information about DFM Inventory Property Sheets, see the "Displaying the DFM Inventory with the Inventory Browser" section on page 13-15.)

Table 12-1 summarizes all types of notifications and how they display in your Alarm Log.

Table 12-1 Notification Colors 

Notification	Description	Displays in Console
Compound Event	Represents one or more specific events	Colored purple
Symptomatic Event	An event that DFM uses as a symptom for root-cause analysis or for compound events	Colored orange or yellow
Other Items	Description	Displays in Console
Inactive Cleared	State changes to inactive and notification turns transparent	Colored white with blue text
Inactive Unsubscribed	State changes to inactive as a result of unsubscribing using a subscription profile	Colored white with gray text
Selected	Clicking on notification	Colored blue

The shades of color for notifications change with count and certainty. The more severe the problem, the brighter its shade. A legend in the Alarm Log identifies the different shades. Table 12-2 lists the rules that determine the shades. If an event recurs after it has cleared, the domain manager sends another notification and increments the event counter.

Table 12-2 Color Shading Rules

Color Shading Rules
if certainty > 50% and count >= 5, brightest shade
if certainty > 50% and count < 5, medium shade

When an event changes its state from active to inactive, the notification turns transparent (white). An inactive state means that the event has been addressed or is no longer occurring; Codebook information will no longer be displayed; after a certain number of polling cycles (the default is ten) the event is removed from the display. An inactive state may change back to active if the event recurs. To remove from the Alarm Log, select Remove Cleared Events from the Log menu, or select the automatic removal option on the Alarm Log filter. (For information about Alarm Log filters, see the "Alarm Log Tasks" section on page 13-5.)

Example of a Monitoring Console

When you first open the Monitoring Console, it displays two views: the DFM Inventory Browser view and the Alarm Log view. You may customize a Monitoring Console to include these views in any combination:

•The DFM Inventory Browser view displays the classes, their instances, and their relationships. (For information about DFM Inventory Browser views, see the "Displaying the DFM Inventory with the Inventory Browser" section on page 13-15.)

•The Alarm Log view displays notifications as they occur. (For information about notification properties, see the "Displaying Notification Properties on the Monitoring Console" section. For information about Alarm Log views, see the "Alarm Log Tasks" section on page 13-5.)

You can also add the following view:

•The Trend view displays a graph of numeric attributes for specified instances. (For information about Trend views, see the "Identifying Trends with Graphs" section.)

Each view can be customized to address your operational needs. (For information about adding views, see the "Creating Multiple Views in the Monitoring Console" section on page 13-12.)

For example, Figure 12-1 illustrates a typical DFM Monitoring Console with two views, the DFM Inventory Browser and Alarm Log.

Figure 12-1 An Example of a Monitoring Console

Monitoring Console Toolbar Buttons

In the Monitoring Console, certain File menu commands are provided as toolbar buttons. They are summarized in Table 12-3.

Table 12-3 Monitoring Console Toolbar Buttons 

Button	Description
	Opens a remote console.
	Saves a remote console.
	Adds another view to the console.
	Deletes a view from the console.
	Attaches a domain manager to a session.
	Disconnects a domain manager from a session.
	Acknowledges an active event.
	Displays the Notification Properties window.

For information about related tasks, see Chapter 13, "Common Monitoring Console Tasks."

Displaying Notification Properties on the Monitoring Console

There are many ways to display the Notification Properties window:

•Double-click on a notification in the Alarm Log view

•Click the Properties toolbar button

•Select the Properties option in the Event menu

•Right-click a selected event and select the Properties option in the popup menu

•Double-click the event name in the Event tab of the DFM Inventory Property Sheet for a specific instance

The Notification Properties window displays up to three tabs depending on the type of event and information available for display:

•General Tab

•Codebook Tab

•Details Tab

Each tab displays three buttons: Refresh to update values, Browse to display the DFM Inventory Browser for the instance of the event, and Close to exit the window.

The window is available regardless of the event's state (active or inactive).

General Tab

The General tab displays notification information such as a description, certainty, last notify, first notify, count, and domain name.

Codebook Tab

The Codebook tab displays the possible causes or events used in the analysis. For a compound event notification, symptomatic events labeled as component notifications display in the Codebook tab.

Figure 12-2 Notification Properties Codebook Tab

To change the display of the Codebook tab, right-click in the tab and select:

•Show Active Only to display only active events. To display active and inactive events, select Show Active Only again to deselect it.

•Collapsed to collapse the subtree hierarchy. To expand the subtree, deselect Collapsed.

For compound events, Show Active Only is selected by default. To display both active and inactive events, deselect Show Active Only. For an inactive compound event, the Codebook tab initially appears blank. In this case, deselect Show Active Only to display all the events.

Details Tab

The Details tab displays the instance's attributes and their corresponding values. The tab presents information in one of three formats: a list of attributes and values, a list of thresholds and their related attributes and values, and a sum or total value with a list of other attributes compared against a threshold value.

Figure 12-3 Notification Properties Details Tab

If a gray line appears in place of an attribute value, the value cannot be obtained by DFM because:

•It is unnecessary for the domain manager to poll the attribute value of an external device at this time. (To minimize network overhead, the domain manager only polls those values it needs to analyze your devices. For example, if a device is unmanaged, the domain manager stops polling the device's MIB attributes.)

•The domain manager has encountered an error while polling the attribute value of an external device. For example, the device might be down, or it might be up but inaccessible due to network problems.

The gray line may appear in either the Details tab of the Notification Properties window or the Attribute tab of a property sheet in the DFM Inventory Browser view.

Identifying Trends with Graphs

Viewing trends with graphs is not supported.