-
User Guide for Device Fault Manager 2.0.3 (With LMS 2.5.1)
-
User Guide for Device Fault Manager 2.0.3 - PDF of Entire Book
-
Index
-
Preface
-
Introduction
-
Getting Started with DFM
-
Using the Alerts and Activities Display
-
Using Device Management
-
Using Notification Services
-
Using Fault History
-
Configuring and Administering DFM (Basic)
-
Managing Groups
-
Configuring Views for the Alerts and Activities Display
-
Configuring Polling and Thresholds
-
Administering DFM (Advanced)
-
MIBs Polled
-
Processed, Pass-Through and Unidentified SNMP Traps
-
Notification MIB
-
Events Processed
-
Polling--SNMP and ICMP
-
How DFM Calculates Repeated Restarts and Flapping
-
CiscoWorks Navigation Changes
-
Table Of Contents
Using the Alerts and Activities Display
How to Use the Alerts and Activities Display
Starting the Alerts and Activities Display
Understanding the Layout of the Alerts and Activities Display
Customizing the Alerts and Activities Display
Selecting Views for Alerts and Activities
Filtering Alerts and Activities
Starting the Alerts and Activities Detail Page
Understanding the Layout of the Alerts and Activities Detail Page
Viewing Events Associated with an Alert
Getting Device Information (Detailed Device View)
Starting the Detailed Device View
Understanding the Layout of the Detailed Device View
Suspending/Resuming a Device Component
Acknowledging, Annotating, and Sending E-Mail Notifications of Alerts
Sending E-Mail in Response to an Alert
Using the Alerts and Activities Display
These topics describe how to use the Alerts and Activities display:
•
How to Use the Alerts and Activities Display
•
•
•
•
How to Use the Alerts and Activities Display
The Alerts and Activities display provides real-time information about the operational status of your network. The displays are designed so that you can set them up and leave them running, providing an ongoing monitoring tool that signals you when something needs attention. When a fault occurs in your network, Device Fault Manager (DFM) generates an event. All events occurring on the same device are rolled up into a single alert. If the alert occurs on an element in your active Alerts and Activities view, it is shown on your Alerts and Activities display. When you click the Alert ID, the Alerts and Activities Detail display opens and lists all events in that particular alert. Alerts are displayed by severity; the most severe and recent alerts are listed first. The alert severity is the severity of the alert's most critical event.
If desired, you can change event names to names that are more meaningful to you. These customized names will be reflected in both the Alerts and Activities display and any Fault History reports you generate. For information on changing DFM event names using Notification Customization, see Customizing the Names of DFM Events.
You can monitor all devices that DFM supports, once you have added those devices using Device Management and ensured that the devices are in your view. However, DFM reports alerts on specific devices or components, not on entire device groups.
You can start the Alerts and Activities display from the DFM home page. If the DFM server is using Access Control Server (ACS) mode, ACS may limit the devices you are permitted to view. For more information, refer to Device-Based Filtering.
Note
Starting the Alerts and Activities Display
To start the Alerts and Activities display, from the DFM home page select Alerts and Activities. Figure 3-1 shows an example of an Alerts and Activities display.
Tip
Figure 3-1 Alerts and Activities Display
View pane. See View Pane.
Tabular display pane. See Tabular Display Pane.
Launch information and view status bar area. See Launch Information and View Status Bar Area.
Window tools area. See Window Tools Area.
Understanding the Layout of the Alerts and Activities Display
These topics provide details about the information in the Alerts and Activities display.
View Pane
The view pane lists the currently available views, or logical groupings of device groups. Views must be created and activated before they will be shown in the Alerts and Activities display. By default, two views—All Alerts and Suspended Devices—are always shown, and cannot be deleted from your Alerts and Activities display. (To create and activate a view or remove an unwanted view from your display, see Configuring Views for the Alerts and Activities Display.)
The current view is highlighted in the view pane. The contents of the current view are shown in the tabular display pane to the right of the view pane. To select another view, simply click the view name in the view pane.
Figure 3-2 shows four active views; the current view is All Alerts. Icons next to the views indicate the severity of the alerts received from devices in those views, signaling you that the devices may need attention.
Figure 3-2 Alerts and Activities Display—View Pane and Severity Icons
For the current view (All Alerts in this example), severity icons also appear next to the alerts in the tabular display, as shown in Figure 3-2, to help you quickly locate a specific alert.
The view pane is updated every two minutes. You can have up to 18 views in the view pane in a single Alerts and Activities display.
Launch Information and View Status Bar Area
The launch information area shows the time on the server when the Alerts and Activities display was started.
The view status bar lists the selected view, which is shown in the tabular display pane, and the number of alerts in that view.
Tabular Display Pane
The tabular display pane is the core of the Alerts and Activities display. It contains a list of all alerts that are occurring on the devices in your current view. This pane is refreshed every 30 seconds. For an explanation for all of the items in the tabular display, see Table 3-2.
Icons alert you to what needs attention; for example:
•
•
The tabular display pane is scrollable and can store up to 1,000 records. See Figure 3-3 for an illustration of the tabular display pane.
Window Tools Area
The top-right corner of the Alerts and Activities display contains buttons for the available window tools. All buttons are described in Table 3-1.
Table 3-1 Alerts and Activities Display—Window Tools
Exports the current tabular display to a PDF file.
Opens the Filter page, for refining the tabular display in the Alerts and Activities display.
Opens a printer-friendly version for printing.
Opens a DFM Tools window with link to Fault History
Generating a 24-Hour Report on All Alerts in the Current View
Opens the DFM help window.
Getting Alert Details
Use the tabular display in the Alerts and Activities display to obtain more information about the alerts that are occurring in your current view. In the tabular display, as shown in Figure 3-3, alerts are grouped by their severity: critical, warning, or informational. Within these severity groupings, or buckets, alerts with the latest change are listed first.
When an alert is generated, it remains in the Alerts and Activities display until it expires. DFM sets an alert state to Expired when DFM performs its normal polling and determines that the alarm has been in the Cleared state for 30 minutes or longer (from the time of polling). While the alert is in the display, if any of its events recur, the alert is updated. If an expired alert recurs, a new alert with a new ID is shown.
Note
Figure 3-3 provides an example of an Alerts and Activities tabular display. This display is refreshed every 30 seconds.
Figure 3-3 Alerts and Activities—Tabular Display
Table 3-2 defines the table elements. All elements are updated every 30 seconds.
Tip
Table 3-2 Alerts and Activities Tabular Display—Contents
Severity of alert. The alert severity is determined by the severity of the most critical event in the alert.
Critical
Warning
Informational Unidentified Trap alert
(no icon)
Informational (for all other alerts)
Alert identifier number. Clicking this link opens an Alerts and Activities Detail page (see Starting the Alerts and Activities Detail Page).
Device type. Learning indicates that DFM was discovering the device when the alert occurred. The actual device type is reflected when new events occur. For more information, see Using Device Management. If the DFM server is using Access Control Server (ACS) mode, ACS may limit the devices you are permitted to view. For more information, refer to Device-Based Filtering.
Time span since alert creation, depending upon alert status:
Active or Acknowledged
Time span between alert creation and current server time.
Cleared
Time span between alert creation and Last Change time (the Last Change time may also represent when the alert was cleared).
Date and time alert last occurred or was changed. Diamonds indicate alert activity, such as a new event, alert acknowledgement, new user annotation, and so forth; no diamonds indicates that the alert is stale. Alerts are grouped by severity, and within severities, alerts with the latest change are listed first.
Alert was updated within last 15 minutes.
Alert was updated within last 16-30 minutes.
Alert was updated within last 31-45 minutes.
No diamonds
Alert was updated over 46 minutes ago.
Device name or IP address. Clicking this link opens the Detailed Device View (see Understanding the Layout of the Detailed Device View).
Event category of the most critical event in the alert, one of the following: Environment, Interface, Other, Reachability, System Hardware, Utilization. For alerts containing multiple events, the tabular display shows the category of the event with the most recent change.
Alert status, based on last polling.
Active
Alert is live. (Note that alerts on suspended devices remain active; see Sending E-Mail in Response to an Alert.)
Cleared
Alert is no longer live. If the alarm has been in the Cleared state for 30 minutes or more (from the time of polling), the alert expires and is removed from the display.
Acknowledged
Alert was manually acknowledged by a user (from Alerts and Activities Detail page).
Customizing the Alerts and Activities Display
After adding your devices to a view, you can customize your Alerts and Activities display by selecting specific views and using filters:
•
•
You can also change the names of DFM events to names that are more meaningful to you. These names will be reflected in both the Alerts and Activities display and in any Fault History reports you generate. For information on changing DFM event names using Notification Customization, see Customizing the Names of DFM Events.
If the DFM server is using Access Control Server (ACS) mode, ACS may limit the devices you are permitted to view. For more information, refer to Device-Based Filtering.
Selecting Views for Alerts and Activities
When you select Alerts and Activities from the DFM home page to open the Alerts and Activities display, all available views are listed in the view pane on the left side of the display. If the views shown do not meet your needs, you can create a new view as described in Creating a View.
The view pane is updated every two minutes. You can have up to 18 views in the view pane in a single Alerts and Activities display. See Activating and Deactivating a View for information on how to manage your views.
Filtering Alerts and Activities
Filters allow you to manipulate the Alerts and Activities display to show alerts based on their severity, status, and originating device type.
Note
Step 1
Step 2
Step 3
Step 4
Step 5
Getting Event Details
These topics address how to start and use the Alerts and Activities Detail page to get more information on events:
•
•
•
You can change the names of DFM events using Notification Services. Refer to Customizing the Names of DFM Events.
Starting the Alerts and Activities Detail Page
The Alerts and Activities Detail page provides information about all of the events that were rolled up into a specific alert. Figure 3-4 provides an example of an Alerts and Activities Detail page.
Note
Step 1
Step 2
Figure 3-4 Alerts and Activities Detail Page
Alerts status bar. See the Alert Status Bar.
Tools drop-down list. See Tools Drop-Down List.
Launch information area. See Launch Information Area.
Command button area. See Command Button Area.
Tabular display pane. See Tabular Display Pane.
Notes pane. See Notes Pane.
Window tools area. See Window Tools Area.
Understanding the Layout of the Alerts and Activities Detail Page
These topics provide details about the information in the Alerts and Activities display.
Alert Status Bar
The alert status bar lists details about the alert with which the listed events are associated. Table 3-3 explains the contents of the alert status bar area.
Table 3-3 Alerts and Activities Detail Page—Alert Status Bar Contents
Device name or IP address.
Device type. Learning indicates that DFM was discovering the device when the alert occurred. The actual device type is reflected when new events occur. For more information, see Using Device Management If the DFM server is using Access Control Server (ACS) mode, ACS may limit the devices you are permitted to view. For more information, refer to Device-Based Filtering.
Alert status, based on last polling.
Active
Alert is live. (Note that alerts on suspended devices remain active; see Sending E-Mail in Response to an Alert.)
Cleared
Alert is no longer live. If the alarm has been in the Cleared state for 30 minutes or more (from the time of polling), the alert expires and is removed from the page.
Acknowledged
Alert was manually acknowledged by a user (from Alerts and Activities Detail page). If an event on the alert recurs, the alert state reverts back to Active.
Alert identifier number.
Time span since alert creation, depending upon alert status:
Active or Acknowledged
Time span between alert creation and current server time.
Cleared
Time span between alert creation and Last Change time (the Last Change time may also represent when the alert was cleared).
Time and date of last alert update (indicates activity, such as an event recurrence, alert acknowledgement, the addition of an annotation, and so forth). Alerts are grouped by severity, and within severities, alerts with the latest change are listed first.
Tabular Display Pane
In the Alerts and Activities Detail page, the tabular display pane contains a table that lists details about events. These events are associated with the alert listed in the alert status bar. You can refresh the display by clicking Refresh at the bottom of the pane. For an explanation of all of the items in the table, see Table 3-6.
The tabular display is scrollable and can store up to 1,000 records. See Figure 3-4 for an illustration of the actions you can perform from this window.
Launch Information Area
The launch information area shows the time on the server when the Alerts and Activities Detail page was started.
Window Tools Area
The top-right corner of the Alerts and Activities Detail page contains a printer tool button, as described in Table 3-4.
Table 3-4 Alerts and Activities Detail Page—Window Tool
Opens a printer-friendly version for printing
Tools Drop-Down List
The Tools drop-down list contains a list of applications that can provide more information, depending on your installation. For more information, see Table 3-6.
Notes Pane
The notes pane lists any alert annotations that users have entered. The notes pane is a convenient tool for making sure that all users see alert information. You can add an annotation by clicking the Annotate button. Adding an annotation is described in Starting the Alerts and Activities Display.
Command Button Area
In addition to the Annotate button in the notes pane, the command button area provides other ways to respond to alerts.
Table 3-5 Alerts and Activities Detail Page—Command Buttons
Refresh
Refreshes the tabular display.
Acknowledge
Changes the event status to Acknowledged. See Acknowledging an Alert for more information.
Suspend
Suspends polling and trap processing on the device or device component by opening a Detailed Device View (DDV), from which you can perform the suspend command. The DDV is described in Starting the Detailed Device View.
Notify
Sends e-mail notification of the alert. See Sending E-Mail in Response to an Alert for more information.
Close
Closes the Alerts and Activities Detail page.
Viewing Events Associated with an Alert
Use the tabular display in the Alerts and Activities Detail page to obtain more information about all of the events associated with a specific alert. In the tabular display, as shown in Figure 3-5, events with the latest change are listed first.
Events remain on the Alerts and Activities Detail page until the parent alert expires. If you suspend a device, all the events are cleared, but the alert remains active. (This way, users cannot remove important information from the display, and you can easily resume the device.)
If an event recurs, the existing event is not updated. Instead, the recurrence is shown as a new event with a new event ID.
Figure 3-5 provides an example of an Alerts and Activities Detail table.
Figure 3-5 Alerts and Activities Detail Page—Tabular Display
Table 3-6 defines the table elements. Click Refresh at the bottom of the page to refresh the table contents.
Tip
Table 3-6 Alerts and Activities Detail Tabular Display—Contents
Event identifier number. Clicking this link opens the event properties page (see Getting Event Details). Note that this Event ID is not the same as the Event Code provided by Notification Services. For more information, see Customizing the Names of DFM Events.
DFM event name (as described in Events Processed). You can also change the names of DFM events to names that are more meaningful to you. For information on changing DFM event names using Notification Customization, see Customizing the Names of DFM Events.
Device element on which the event occurred.
Time at which the event occurred.
Event status, based on last polling.
Active
Event is live.
Cleared
Event is no longer live. (Note that events on suspended devices are moved to Cleared, but the alert remains active. See Sending E-Mail in Response to an Alert.)
Suspended
Device is suspended.
Resumed
Device is being resumed.
Deleted
Device has been deleted.
A drop-down list of applications that can provide more information (see Figure 3-6). The Tools drop-down list can include the following, depending upon the applications installed on your server:
•
•
•
•
Figure 3-6 provides an example of an Alerts and Activities Detail tools drop-down list.
Figure 3-6 Alerts and Activities Detail Tools Drop-Down List
Viewing Event Properties
The event properties page provides additional details about the event, such as the values of MIB attributes at the time of the event, polling and threshold information, and utilization information.
Note
Step 1
Step 2
Step 3
The information that is shown on the event properties page depends on the event type.
Getting Device Information (Detailed Device View)
The Detailed Device View (DDV) provides extensive information on the devices and device components listed in Starting the Detailed Device View. You can view information on devices that DFM is currently managing, as well as devices whose management you have suspended (regardless of whether the device is generating an alert):
•
•
•
See these topics for more information:
•
•
•
Starting the Detailed Device View
You can open a DDV for any device in the Alerts and Activities page—or for any known device in the DFM inventory (regardless of whether it is currently managed).
Note
Step 1
•
•
The DDV opens. (See Figure 3-7 for an example.)
Step 2
Step 3
Step 4
•
•
Step 5
Figure 3-7 provides an example of device information for a Cisco 3640 router.
Figure 3-7 Detailed Device View—Cisco 3640 Router
Component categories pane. See Component Categories Pane.
Command button area. See Command Buttons Area.
System information pane. See System Information Pane.
Launch information area. See Launch Information.
Record count. See Record Count.
Understanding the Layout of the Detailed Device View
These topics provide details about the information in the DDV.
Component Categories Pane
The component categories pane lists the components of the device: Environment, System, and/or Interface (what is shown depends on the device being viewed). The following are some examples of what you may see in these categories:
•
•
•
From a DDV for an aggregate (containing) device, you can launch a DDV for the contained device. For example, for a router containing MSFCs, open a DDV for the router. From the router DDV, you can launch a new DDV for the MSFC. See Detailed Device View Examples.
System Information Pane
The system information pane provides information such as the system name, IP address, SysObjectID, system contact, and so forth. The device type determines what is displayed by the DDV. Examples of different DDVs are provided in Detailed Device View Examples.
If the system information pane lists an attribute with no value, it is because of one of the following reasons:
•
•
•
You can suspend or resume device or component monitoring by clicking the Suspend or Resume button (the button shown depends on the component's current managed state). These functions are described in these sections:
•
Record Count
The record count lists the number of information types available on the device.
Command Buttons Area
In addition to the Suspend and Resume button in the system information pane, the command button area provides other ways to respond to alerts.
Table 3-7 Detailed Device View—Command Buttons
Refresh
Refreshes the DDV page. (The DDV is not automatically refreshed; you must do so manually.)
Close
Closes the DDV page.
Launch Information
The launch information tells you when the DDV was started. If you refresh the page, the time is updated.
Detailed Device View Examples
Figure 3-8 shows a DDV for a Cisco Catalyst 6513 switch. This switch (the containing device) contains an MSFC card (a contained device). Containing and contained devices must be added separately (refer to How DFM Handles Containing and Contained Devices for more information).
Figure 3-8 Detailed Device View—Cisco Catalyst 6513 Switch
This switch contains an MSFC card. If you select the MSFC card, the DDV displays the managed state of the subcomponent on the right side of the display (see Figure 3-9), and a new DDV launch point is provided.
Figure 3-9 Launching a Detailed Device View for an MSFC Card
To display a DDV for the MSFC card, click Launch New DDV For This Device. The new DDV appears, as shown in Figure 3-10.
Figure 3-10 Detailed Device View—Cisco MSFC Card
Suspending Device Monitoring
You can stop monitoring a device by selecting it and clicking the Suspend button in the DDV. Conversely, you can resume monitoring by clicking the Resume button. These actions are also available for suspending and resuming specific components. See these topics for more information:
•
Suspending/Resuming Devices
When you unmanage a device—changing its managed state to false—DFM no longer polls that device for information. Subsequent events (including traps) are ignored and no longer processed.
When you suspend a device, all of the active events on the device are moved to the Cleared state, but the alert remains in the Active state. This happens to ensure that:
•
•
Note
Step 1
Step 2
•
•
Step 3
Suspending/Resuming a Device Component
You can unmanage or remanage device components using the DDV. When you unmanage a component—changing its managed state to false—DFM no longer polls that component for information. Subsequent events (including traps) are ignored and no longer processed.
Note
Step 1
Step 2
Step 3
Step 4
Step 5
Figure 3-11 shows the location of the ManagedState column for one of the managed interfaces on a Cisco 3620 router.
Figure 3-11 Editing the Managed State of a Device Component
Acknowledging, Annotating, and Sending E-Mail Notifications of Alerts
As shown in Figure 3-4, the Alerts and Activities Detail page provides command buttons in the bottom-right corner of the page. The Suspend button is discussed in Suspending Device Monitoring. This topic explains how you can use the Acknowledge, Annotate, and Notify buttons to respond to alerts.
See these topics for more information:
•
Acknowledging an Alert
Acknowledging an active alert signals other users that you are aware of the alert. When you click the Acknowledge button on the Alerts and Activities Detail page, this status change is populated to all Alerts and Activities displays.
If an event on the alert recurs, the event status reverts to Active.
Step 1
Step 2
Annotating an Alert
You can annotate an alert by clicking the Annotate button from the Alerts and Activities Detail page. An editable Annotation dialog box opens; in the dialog box, you can enter up to 255 characters. An annotation will be shown whenever other users view the alert from an Alerts and Activities Detail page.
Step 1
Step 2
Step 3
Figure 3-12 shows the Alerts and Activities Detail page, containing a previously created annotation.
Figure 3-12 Annotation on the Alerts and Activities Detail Page
Sending E-Mail in Response to an Alert
When you click the Notify button on the Alerts and Activities Detail page, DFM opens a dialog box that you can complete to manually send an e-mail notification to multiple recipients. The e-mail notification will contain only the text you add; it will not append any alert or event information. (If you want to send automatic e-mail notifications when alerts or events occur on certain devices, use Notification Services to set up an E-mail Notification subscription. Refer to Managing E-Mail Notifications.)
CiscoWorks Common Services controls the SMTP server used by DFM. For more information, from the CiscoWorks home page, select Common Services > Server > Admin > System Preferences, and click Help.
Step 1
Step 2
a.
•
•
b.
c.
d.
e.
f.
g.
