-
User Guide for Device Fault Manager 3.0.2 (With LMS 3.0 December 2007 Update)
-
Open Source License Acknowledgements
-
Preface
-
Introduction
-
Getting Started with DFM
-
Using the Alerts and Activities Display
-
Using Device Management
-
Using Notification Services
-
Using Fault History
-
Configuring and Administering DFM (Basic)
-
Managing Groups
-
Configuring Views for the Alerts and Activities Display
-
Configuring Polling and Thresholds
-
Administering DFM (Advanced)
-
MIBs Polled
-
Processed and Pass-Through Traps, and Unidentified Traps and Events
-
Notification MIB
-
Events Processed
-
PollingSNMP and ICMP
-
How DFM Calculates Repeated Restarts and Flapping
-
Index
-
Table Of Contents
How Will I Use DFM for Day-to-Day Operations?
What Are Alerts and Activities?
What Are Notification Services?
Users Perform Device Management and Configuration
DFM Performs Ongoing Monitoring, Analysis, and Notification
Users Respond to Notifications and Alerts
Introduction
These topics provide an overview of Device Fault Manager (DFM):
•
How Will I Use DFM for Day-to-Day Operations?
What Is DFM?
DFM offers the following real-time assistance to network operations personnel:
•
•
•
Figure 1-1 shows the series of activities that DFM performs when a user imports a Cisco 3640 router into DFM. The figure also shows how a user can confirm that these activities have occurred.
Figure 1-1 Importing a Router into DFM
DFM performs the following tasks after you import a device:
•
This was supplied when the device was added to the DCR.
•
You can see the results of this discovery using Device Management.
•
You can see which devices are members of each system-defined group using Group Management; the Membership Details page for any group will display them.
•
You can see alerts for a device on the Alerts and Activities display when events occur on the device. You can see the polling and threshold group that DFM uses for DFM polling parameters and threshold values for the device on the Polling Parameters Summary and Thresholds Summary pages.
The following sections help you to get started with DFM:
•
What's New in DFM 3.0.2?
DFM 3.0.2 provides the following new features and enhancements:
•
There are three different flavors of SNMPv3 credentials - NoAuthNoPriv, AuthNoPriv, and AuthPriv. When a device is imported into DCR with SNMPv3 Credentials, DFM reacts to each of the SNMPv3 credentials in the following ways:
–
–
–
•
Is DFM Ready to Use?
Before you start working with DFM, ensure that the initial configuration has been completed.
The instructions for configuring DFM are included in Installing and Getting Started with CiscoWorks LAN Management Solution 3.0.
To use DFM, you must import devices into the DFM inventory as explained in Importing Devices into DFM. Make sure that your devices are forwarding traps to DFM on port 162 (if port 162 is occupied, DFM uses port 9000).
The ports that are occupied by CiscoWorks are listed in Installation and Getting Started Guide for LAN Management Solution 3.0.
After you have imported devices, DFM is ready to monitor and analyze events, and provide notification of alerts on the Alerts and Activities display. DFM uses the default polling parameters and threshold values, default rediscovery and purging schedules, and default views. You should determine whether the default values are adequate for your use.
Table 1-1 lists tasks that you may attend to, at your discretion, after the initial configuration. The table lists optional configuration tasks and some day-to-day tasks that you may want to address when you first start to use DFM.
Table 1-1 Tasks to Consider when Initially Setting Up DFM
Subscribe users to receive e-mail notification of alerts and subscribe hosts to receive DFM-generated SNMP trap, e-mail, and syslog messages.
DFM displays the operational health of the network on the Alerts and Activities display.
In addition, you can subscribe users and hosts to receive e-mail, syslog, or SNMP trap notifications, in response to alerts.
How to Use the Alerts and Activities Display
Update polling parameters and threshold values.
DFM provides default values. However, you can update the values based on your experience of the network.
Update device rediscovery schedules.
DFM provides a single default schedule for device rediscovery. You can use that schedule or create additional rediscovery schedules.
Several schedules can be active at the same time.
Add Alerts and Activities views.
Alerts and Activities views control which groups of devices are the focus of the Alerts a nd Activities display.
DFM provides two default view; All Alerts and Suspended Devices. You can add more views.
Update the daily purging schedule.
By default, DFM purges the database at midnight. You can modify the schedule.
Configure DFM to forward traps to a Network Management System (NMS).
DFM can forward traps to other NMSs, such as HP OpenView and NetView.
Integrating SNMP Trap Receiving with Other Trap Daemons or NMSs
How Will I Use DFM for Day-to-Day Operations?
These topics briefly describe the DFM functions and how they are used, often on a daily basis:
Note
•
•
•
•
•
To make the most effective use of DFM on a day-to-day basis, users need to understand the impact of operations on configuration and administration tasks. An overview is provided in Performing Scheduling Tasks.
The DFM functions that support day-to-day operations are further described in the following topics:
•
•
What Are Alerts and Activities?
The Alerts and Activities display provides a consolidated real-time view of the operational status of your network. When a fault occurs in your network, DFM generates an event. All events occurring on the same device are rolled up into a single alert. You can also use Notification Services to change an event name to something that is more meaningful to you.
When an alert occurs on an element in your active view (a logical group of devices), it is displayed on your Alerts and Activities display. Either you or anyone with the necessary privileges, can customize your view to include only those device groups that are important to you.
From the Alerts and Activities display you can also:
•
•
•
•
To see which components of the device are in the DFM manageable inventory:
Step 1
Step 2
The DDV displays the manageable components of the device.
From the DDV, a user with the necessary privileges can suspend monitoring of a device component. Later you can continue to monitor the device component.
Suspended devices are moved to the Suspended Devices view.
To launch a DDV for devices that currently have no alerts, use Device Management > Device Details.
What Is Device Management?
Device Management involves keeping the inventory of devices that DFM monitors up-to-date. Before devices can be in the DFM inventory, they must be added to the Device and Credentials Repository (DCR). The DCR is a centralized device repository for sharing device information across CiscoWorks.
You can control whether all DCR devices are automatically added to the DFM inventory. You can decide whether DCR devices must match customized filters that you create, in order to be added. You can also manually add individual DCR devices to the DFM inventory.
Synchronization is controlled using the Device Import page. By default, DFM is configured to use manual device import.
The DCR is the front-end for adding devices to and exporting devices from CiscoWorks, and modifying device credentials. DFM provides a user interface to perform the following on devices in the DFM inventory:
•
•
•
•
The following scenario describes the process for managing devices:
1.
2.
3.
You can click View Discovery Status to see the status of the device import.)
4.
You can update the default Discovery schedule or add Discovery schedules.
What Are Notification Services?
In addition to watching network conditions as they change on the Alerts and Activities display, you can use notification services to automatically notify users and other systems when specific changes occur on selected devices.
To do so, you create subscriptions for e-mail notifications, DFM-generated SNMP trap notifications, or syslog notifications. You can also change event names to names that are more meaningful to you. These names will be reflected in the DFM displays and notifications.
DFM subscriptions comprise:
•
•
You can add, modify, and delete subscriptions whenever you need to disseminate the status and severity of alarm and event changes.
What Is Fault History?
Fault History provides the history of DFM events and alerts. The stored history includes alert information and annotations (informational text entered by DFM users), and event information and properties (component name and MIB attributes).
You can start Fault History in the following ways:
•
From here, you can generate a Fault History display with information about alerts and events from the last 24 hours.
•
This method provides historical information about all alerts and events in the Fault History database. The Fault History database keeps information for the alerts and events that occurred within the last 31 days.
•
From here, you can select a single device and generate a 24-hour or 31-day display.
You can use Fault History to generate customized tabular displays of specific alerts, specific events, event dates, and event severity.
What Is Configuration?
The Configuration pages provide a centralized location for all DFM configuration tasks. Configuration tasks are divided into two categories: Polling and Thresholds, and Other Configurations.
•
•
How Does DFM Work?
These topics provide a simplified view of DFM user tasks and DFM processing:
•
•
•
Users Perform Device Management and Configuration
Users supply the information that tells DFM what to monitor. Figure 1-2 shows a user importing devices, and performing optional configuration tasks to optimize DFM.
Figure 1-2 The Role of User Input
You must import devices and, as your network changes, you must add and delete them accordingly. DFM performs periodic rediscovery, refreshing the inventory of known devices and device components.
Note
You can decide how to manage the information about alerts, events, and traps that DFM produces. For example, you can:
•
•
•
•
You can also control how often DFM gathers data. DFM receives traps in real time, but you can change the frequency with which DFM performs the following tasks:
•
•
DFM Performs Ongoing Monitoring, Analysis, and Notification
DFM continuously gathers information from devices and device components, analyzing and prioritizing events, and raising alerts.
Figure 1-3 DFM Continuously Monitors the Network
DFM generates alerts based on the following activities:
•
•
•
As DFM generates alerts and alert conditions change, DFM determines when to send e-mail or syslog notifications to subscribers and when to generate SNMP traps to send to other systems.
For additional information, see the following topics:
•
•
Users Respond to Notifications and Alerts
Most users will monitor the condition of DFM by using the Alerts and Activities display; others will respond to e-mail. External hosts will receive generated SNMP traps or syslog notifications. Figure 1-4 shows how you can respond using Alerts and Activities.
Figure 1-4 Users Respond to Alerts
