Table Of Contents

Using Fault History

Getting Started with Fault History

Starting Fault History

Starting Fault History from the Alerts and Activities Display

Generating a 24-Hour Report on All Alerts in the Current View

Generating a 24-Hour Report on All Events on a Device Component

Starting Fault History from the DFM Home Page

Getting All Stored Information on an Alert

Getting All Stored Fault History on an Event

Understanding the Fault History: Alerts and Activities Display

Understanding the Fault History: Events Display

Using Fault History

---

These topics explain how to use Device Fault Manager (DFM) Fault History:

•Getting Started with Fault History

•Starting Fault History

•Understanding the Fault History: Alerts and Activities Display

•Understanding the Fault History: Events Display

Getting Started with Fault History

Fault History allows you to store and view the history of DFM events and alerts from the past 31 days (this setting cannot be changed). The stored history includes alert information and annotations (informational text that you enter), and event information and properties (for example, the values of MIB attributes at the time of the event, polling and threshold information, and utilization information). For an example of what kind of information Fault History displays, see Figure 6-1 and Figure 6-2.

You can also customize the names of events displayed by Fault History (and the Alerts and Activities display) using the Notification Customization feature in Notification Services. For more information, refer to Customizing the Names of DFM Events.

You can start Fault History from within DFM in one of two ways:

•To generate the most granular reports using all saved information in the Fault History database, start Fault History by selecting Fault History from the DFM home page. See Starting Fault History from the DFM Home Page.

•To generate a quick, contextual 24-hour report, start Fault History from the Alerts and Activities display. See Starting Fault History from the Alerts and Activities Display.

A link to Fault History is also provided in the Device Center, which you can open by selecting Device Troubleshooting > Device Center from the CiscoWorks home page. The Device Center provides a number of device-centric troubleshooting tools. This Fault History link is useful when you are troubleshooting a specific device, allowing you to quickly search the Fault History database for problems on that device. For more information, open the Device Center and click Help.

If Fault History finds more than 2,000 records while generating a report, a popup window tells you the total number of records found. The Fault History displays can show up to 2,000 records as a table you can scroll or page through. If your report exceeds 2,000 records and you want to view all of them, you can use the Export tool button to save all of the information to a CSV or PDF file.

You can use Fault History to generate customized tabular displays of specific alerts, specific events, event dates, event severity, and so forth. You might want to generate a Fault History report when:

•A significant alert is shown in the Alerts and Activities display, and you want to see how often the alert has been generated in the last month.

•You receive an e-mail notification that an unusual event has occurred.

•You want to search for information on events and alerts other than those you are tracking in your customized Alerts and Activities display.

The Fault History database is stored at NMSROOT\databases\dfmFH\dfmFH.db. The database stores a maximum of 31 days of data and is purged according to the DFM database purging schedule (see Configuring the Daily Purging Schedule.)

If the DFM server is using Access Control Server (ACS) mode, ACS may limit the devices you are permitted to view and for which you can create Fault History displays. For more information, refer to Device-Based Filtering.

---

Note Because DFM 2.0 does not report alerts generated on VLANs, Fault History does not store VLAN fault information in its database. However, you can view VLAN information on the event properties page and in the Detailed Device View. (Refer to Viewing Event Properties and Starting the Detailed Device View.)

---

Starting Fault History

DFM provides two starting points from which you can generate Fault History reports:

•To create a context-sensitive 24-hour report, use Fault History from the Alerts and Activities display. See Starting Fault History from the Alerts and Activities Display.

•To create filtered reports using all of the stored information in the Fault History database, use the DFM home page. See Starting Fault History from the DFM Home Page.

Starting Fault History from the Alerts and Activities Display

Start Fault History from the Alerts and Activities display to create a 24-hour report on:

•All alerts in your current view, as described in Generating a 24-Hour Report on All Alerts in the Current View.

•All events on a specific device component, as described in Generating a 24-Hour Report on All Events on a Device Component.

Generating a 24-Hour Report on All Alerts in the Current View

To create a report on all the alerts that have occurred in your current view in the past 24 hours, start Fault History from the window tools area in the Alerts and Activities display. (See Window Tools Area.)

---

Step 1 From the DFM home page, select Alerts and Activities > Alerts and Activities. The Alerts and Activities display appears.

Step 2 Select a view from the view object selector. (See Configuring Views for the Alerts and Activities Display.)

Step 3 Launch Fault History from the window tools area to open a 24-hour Fault History tabular display of information about all alerts on all devices in the most recently accessed view. If Fault History finds more than 2,000 records, a popup window reports the total number of records found.

The Fault History: Alerts and Activities display appears. Understanding the Fault History: Alerts and Activities Display, describes the report contents.

Step 4 To see if any user annotations are associated with a specific alert, click the Status link. If a user has entered an annotation for this alert, the alert annotations page appears. (Annotations are entered from the Alerts and Activities display. See Annotating an Alert for more information on annotations.)

---

If Fault History finds more than 2,000 records based on your search criteria, you can view all of the reports by clicking the Export button (in the upper-right corner of the display) and saving your report to a PDF or CSV file.

Generating a 24-Hour Report on All Events on a Device Component

To create a report on all events that have occurred on a specific device component in the past 24 hours, use the Fault History tool in the Alerts and Activities Detail display.

---

Step 1 From the DFM home page, select Alerts and Activities > Alerts and Activities. The Alerts and Activities display appears.

Step 2 Click an alert ID. The Alerts and Activities Detail display appears.

Locate the device component in which you are interested, and select Fault History from the list in the Tools column (see Figure 3-6 for an example). If Fault History finds more than 2,000 records, a popup window reports the total number of records found.

The Fault History: Events display appears. Understanding the Fault History: Events Display, describes the display contents.

Step 3 If you want to view more details about the event, such as the value of MIB attributes at the time of the event, click the appropriate event ID. The event properties page appears.

---

If Fault History found more than 2,000 records based on your search criteria, you can view all of the reports found by clicking the Export button (in the upper-right corner of the display) and saving your report to a PDF or CSV file.

Starting Fault History from the DFM Home Page

To gather historical information on alerts and events in the past 31 days, start Fault History from the CiscoWorks navigation tree by selecting Fault History from the DFM home page. The following topics explain how you can apply filters and generate reports based on all of the saved information in the Fault History database:

•To search for alerts by alert ID, device, or group, see Getting All Stored Information on an Alert.

•To search for events by event ID, device, alert ID, or group, see Getting All Stored Fault History on an Event.

Getting All Stored Information on an Alert

Fault History provides the following methods for searching for alerts that are in the saved Fault History database:

•Searching for Alerts by Alert ID

•Searching for Alerts by Device

•Searching for Alerts by Group

Searching for Alerts by Alert ID

To determine how often a specific alert has occurred, search for the alert by its alert ID. The alert ID is displayed in the Alerts and Activities display.

---

Step 1 From the DFM home page, select Fault History > Alert Filtering > Search By Alert ID. The Alert Filtering: Search by Alert ID page appears.

Step 2 Set your filtering criteria:

a. Enter the alert ID.

b. Activate all alert severity levels for which you want to search.

c. Enter the date, selecting either Current Date, One Month, or Range. (The Current Date and One Month fields are read-only and cannot be changed.)

Step 3 Click View. If Fault History finds more than 2,000 records, a popup window reports the total number of records found.

The Fault History: Alerts and Activities display appears. (See Understanding the Fault History: Alerts and Activities Display, for an explanation of the display contents, and how to get more information on the alerts.)

---

If Fault History finds more than 2,000 records based on your search criteria, you can view them by clicking the Export button (in the upper-right corner of the display) and saving your report to a PDF or CSV file.

Searching for Alerts by Device

Use this procedure to determine what types of alerts are occurring on a specific device.

A link to Fault History is also provided in the Device Center, which provides a number of device-centric troubleshooting tools. This Fault History link is useful when you are troubleshooting a specific device, allowing you to quickly search the Fault History database for problems on that device. For more information, select Device Troubleshooting > Device Center from the CiscoWorks home page and click Help.

If the DFM server is using Access Control Server (ACS) mode, ACS may limit the devices you are permitted to view and for which you can create Fault History displays. For more information, refer to Device-Based Filtering.

---

Step 1 From the DFM home page, select Fault History > Alert Filtering > Search By Device. The Alert Filtering: Search by Device page appears.

Step 2 Set your filtering criteria:

a. Enter a comma-separated list of devices (as they are listed by Device Management).

b. Activate all alert severity levels for which you want to search.

c. Enter the date, selecting either Current Date, One Month, or Range. (The Current Date and One Month fields are read-only and cannot be changed.)

Step 3 Click View. If Fault History finds more than 2,000 records, a popup window reports the total records found.

The Fault History: Alerts and Activities display appears. (See Understanding the Fault History: Alerts and Activities Display, for an explanation of the display contents, and how to get more information on the alerts.)

---

If Fault History found more than 2,000 records based on your search criteria, you can view all of the reports found by clicking the Export button (in the upper-right corner of the display) and saving your report to a PDF or CSV file.

Searching for Alerts by Group

---

Step 1 From the DFM home page, select Fault History > Alert Filtering > Search By Group. The Alert Filtering: Search by Group page appears.

Step 2 Set your filtering criteria:

a. Select the device group. You can select multiple devices from different groups.

b. Activate all alert severity levels for which you want to search.

c. Enter the date, selecting either Current Date, One Month, or Range. (The Current Date and One Month fields are read-only and cannot be changed.)

Step 3 Click View. If Fault History finds more than 2,000 records, a popup window reports the total records found.

The Fault History: Alerts and Activities display appears. (See Understanding the Fault History: Alerts and Activities Display, for an explanation of the display contents, and how to get more information on the alerts.)

---

If Fault History found more than 2,000 records based on your search criteria, you can view all of the reports found by clicking the Export button (in the upper-right corner of the display) and save your report to a PDF or CSV file.

Getting All Stored Fault History on an Event

Fault History provides the following methods for searching for alerts that are in the saved Fault History database:

•Searching for Events by Event ID

•Searching for Events by Device

•Searching for Events by Alert ID

•Searching for Events by Group

Searching for Events by Event ID

To determine how often a specific event has occurred, search for the event by its event ID. The event ID is displayed on the Alerts and Activities Detail display.

Remember that an event ID is not the same thing as the event codes provided by Notification Services. For more information, refer to Customizing the Names of DFM Events.

---

Step 1 From the DFM home page, select Fault History > Event Filtering > Search By Event ID. The Event Filtering: Search by Event ID page appears.

Step 2 Set your filtering criteria:

a. Enter the event ID.

b. Enter the date, selecting either Current Date, One Month, or Range. (The Current Date and One Month fields are read-only and cannot be changed.)

Step 3 Click View. If Fault History finds more than 2,000 records, a popup window reports the total records found.

The Fault History: Events display appears. (See Understanding the Fault History: Events Display, for an explanation of the display contents.)

Step 4 If you want to view more information about an event, such as the value of MIB attributes at the time of the event, click the appropriate event ID. The event properties page appears.

---

If Fault History found more than 2,000 records based on your search criteria, you can view all of the reports found by clicking the Export button (in the upper-right corner of the display) and save your report to a PDF or CSV file.

Searching for Events by Device

---

Step 1 From the DFM home page, select Fault History > Event Filtering > Search By Device. The Event Filtering: Search by Device page appears.

Step 2 Set your filtering criteria:

a. Enter a comma-separated list of devices (as they are listed by Device Management). You can select multiple devices from different groups.

b. Enter the event description by clicking the popup selector box and activating the events for which you want to search. By default, all events are selected.

c. Enter the date, selecting either Current Date, One Month, or Range. (The Current Date and One Month fields are read-only and cannot be changed.)

Step 3 Click View. If Fault History finds more than 2,000 records, a popup window reports the total records found.

The Fault History: Events display appears. (See Understanding the Fault History: Events Display, for an explanation of the display contents.)

Step 4 If you want to view more information about an event, such as the value of MIB attributes at the time of the event, click the appropriate event ID. The event properties page appears.

---

If Fault History found more than 2,000 records based on your search criteria, you can view all of the reports found by clicking the Export button (in the upper-right corner of the display) and save your report to a PDF or CSV file.

Searching for Events by Alert ID

---

Step 1 From the DFM home page, select Fault History > Event Filtering > Search By Alert ID. The Event Filtering: Search by Alert ID page appears.

Step 2 Set your filtering criteria:

a. Enter the Alert ID.

b. (Optional) Enter the event description by clicking the popup selector box and activating the events for which you want to search.

c. Enter the date, selecting either Current Date, One Month, or Range. (The Current Date and One Month fields are read-only and cannot be changed.)

Step 3 Click View. If Fault History finds more than 2,000 records, a popup window reports the total records found.

The Fault History: Events display appears. (See "Understanding the Fault History: Events Display" section, for an explanation of the display contents.)

Step 4 If you want to view more information about an event, such as the value of MIB attributes at the time of the event, click the appropriate event ID. The event properties page appears.

---

If Fault History found more than 2,000 records based on your search criteria, you can view all of the reports found by clicking the Export button (in the upper-right corner of the display) and save your report to a PDF or CSV file.

Searching for Events by Group

---

Step 1 From the DFM home page, select Fault History > Alert Filtering > Search By Group. The Event Filtering: Search by Group page appears.

Step 2 Set your filtering criteria:

a. Enter the group.

b. Enter the event description by clicking the popup selector box and activating the events for which you want to search.

c. Enter the date, selecting either Current Date, One Month, or Range. (The Current Date and One Month fields are read-only and cannot be changed.)

Step 3 Click View. If Fault History finds more than 2,000 records, a popup window reports the total records found.

The Fault History: Events display appears. (See Understanding the Fault History: Events Display, for an explanation of the display contents.)

Step 4 If you want to view more information about an event, such as the value of MIB attributes at the time of the event, click the appropriate event ID. The event properties page appears.

---

If Fault History found more than 2,000 records based on your search criteria, you can view all of the reports found by clicking the Export button (in the upper-right corner of the display) and save your report to a PDF or CSV file.

Understanding the Fault History: Alerts and Activities Display

The Fault History: Alerts and Activities display is shown in Figure 6-1. You can generate this display as described in these sections:

•Generating a 24-Hour Report on All Alerts in the Current View

•Getting All Stored Information on an Alert

The tabular display is a scrollable table that lists up to 2,000 records, based on your filtering criteria. If you want to view database contents beyond the 2,000 records, click the Export tool button in the upper-right corner.

Figure 6-1 Fault History: Alerts and Activities Display

The Fault History: Alerts and Activities display provides two tools, as shown in Table 6-1.

Table 6-1 Fault History: Alerts and Activities Display—Window Tools

Icon	Meaning	Described in...
	Exports all records found by Fault History to a PDF or CSV file.	Exporting Data from Tabular Displays
	Opens a printer-friendly version for printing (maximum of 2,000 records)	Printing Tabular Displays

Table 6-2 describes the contents of the Fault History: Alerts and Activities tabular display.

Table 6-2 Fault History: Alerts and Activities
Tabular Display—Contents 

Heading	Description
Alert ID	Alert identifier number. Clicking this link opens the Fault History: Events display (see Figure 6-2), which provides details about the events associated with the alert.
Device Name	Device name or IP address. (If the DFM server is using Access Control Server (ACS) mode, ACS may limit the devices you are permitted to view and for which you can create Fault History displays. (For more information, refer to Device-Based Filtering.)
Device	Device type. Learning indicates that DFM was discovering the device at the time of the alert. The actual device type is reflected when new events occur. For more information, see Using Device Management.
Description	Alert category, one of the following: Application, Connectivity, Environment, Interface, Other, Reachability, System Hardware, Utilization. For alerts containing multiple events, the tabular display shows the category of the event with the most recent change. For alerts containing multiple events, the display shows the category of the event with the most recent change.
Severity	Critical, Warning, or Informational.
Time	Date and time when the alert was generated.
Status	Alert status, based on last polling. Clicking this link opens the alert annotation page, which contains user annotations associated with the alert.
	Active	Alert is live.
	Cleared	Alert is no longer live. Also, when a device is suspended, all alerts are cleared. When DFM polling determines that the alarm has been in the Cleared state for 30 minutes or more (from the time of polling), the alarm expires and is removed from the Alerts and Activities display.
	Acknowledged	Alert was manually recognized by a user (from Alerts and Activities Detail display).

Understanding the Fault History: Events Display

The Fault History: Events display is shown in Figure 6-2. This display is generated as described in these sections:

•Generating a 24-Hour Report on All Events on a Device Component

•Getting All Stored Fault History on an Event

The tabular display is a scrollable table that lists up to 2,000 records, based on your filtering criteria. If you want to view database contents beyond the 2,000 records, click the Export tool button in the upper-right corner.

Figure 6-2 Fault History: Events Display

The Fault History: Events display provides two tools, described in Table 6-3.

Table 6-3 Fault History: Events Display—Window Tools

Icon	Meaning	Described in...
	Exports the current tabular display to a PDF file.	Exporting Data from Tabular Displays
	Opens a printer-friendly version for printing.	Printing Tabular Displays

Table 6-4 describes the contents of the Fault History: Events tabular display.

Table 6-4 Fault History: Events Tabular Display—Contents 

Heading	Description
Event ID	Event identifier number. Clicking this link opens the event properties page, which describes the value of MIB attributes at the time of the event.
Device Name	Device name or IP address. (If the DFM server is using Access Control Server (ACS) mode, ACS may limit the devices you are permitted to view and for which you can create Fault History displays. (For more information, refer to Device-Based Filtering.)
Component	Device element on which the event occurred.
Description	DFM event name (as described in Events Processed). You can also customize the names of events displayed by Fault History (and the Alerts and Activities display) using the Notification Customization feature in Notification Services. For more information, refer to Customizing the Names of DFM Events.
Time	Date and time when the event was generated.
Status	Event status, based on last polling.
	Active	Event is live.
	Cleared	Event is no longer live. Also, when a device is suspended, all alerts are cleared. When DFM polling determines that an alarm has been in the Cleared state for 30 minutes or more (from the time of polling), the alarm expires and is removed from the Alerts and Activities display.
	Suspended	Device is suspended.
	Resumed	Device is being resumed.
	Deleted	Device has been deleted.
Alert ID	Alert identifier number associated with this event.