Table Of Contents

Using the Alerts and Activities Display

How to Use the Alerts and Activities Display

Starting the Alerts and Activities Display

Understanding the Layout of the Alerts and Activities Display

Getting Alert Details

Clearing Alerts

Customizing the Alerts and Activities Display

Selecting Views for Alerts and Activities

Filtering Alerts and Activities

Getting Event Details

Starting the Alerts and Activities Detail Page

Understanding the Layout of the Alerts and Activities Detail Page

Command Button Area

Viewing Events Associated with an Alert

Viewing Event Properties

Clearing an Event

Getting Device Information (Detailed Device View)

Starting the Detailed Device View

Understanding the Detailed Device View

Managing/Unmanaging a Single Device Component

Suspending Device and Element Monitoring

Suspending and Resuming Devices

Performing Bulk Manage and Unmanage Operations

Acknowledging, Annotating, and Sending E-Mail Notifications of Alerts

Acknowledging an Alert

Annotating an Alert

Sending E-Mail in Response to an Alert

Using the Alerts and Activities Display

---

These topics describe how to use the Alerts and Activities display:

•How to Use the Alerts and Activities Display

•Starting the Alerts and Activities Display

•Getting Alert Details

•Customizing the Alerts and Activities Display

•Getting Event Details

•Getting Device Information (Detailed Device View)

•Suspending Device and Element Monitoring

•Acknowledging, Annotating, and Sending E-Mail Notifications of Alerts

How to Use the Alerts and Activities Display

The Alerts and Activities display provides real-time information about the operational status of your network. The displays are designed so that you can set them up and leave them running. These displays have a monitoring tool that alerts you when something needs attention.

When a fault occurs in your network, Device Fault Manager (DFM) generates an event. All events occurring on the same device are rolled up into a single alert. If the alert occurs on an element in your active Alerts and Activities view, it is shown on your Alerts and Activities display.

When you click the Alert ID, the Alerts and Activities Detail display opens and lists all events in that particular alert. Alerts are displayed by severity; the most severe and recent alerts are listed first. The alert severity is the severity of the alert's most critical event.

You can change event names to names that are more meaningful to you. These customized names will be reflected in both the Alerts and Activities display and any Fault History reports you generate. For information on changing DFM event names using Notification Customization, see Customizing the Names of DFM Events.

You can monitor all devices that DFM supports, after you have added those devices using Device Management and ensured that the devices are in your view. However, DFM reports alerts on specific devices or components, not on entire device groups.

You can start the Alerts and Activities display from DFM. If the DFM server is using Access Control Server (ACS) mode, ACS may limit the devices you are permitted to view. For more information, see Device-Based Filtering.

All Fault History reports generated from within the Alerts and Activities display provide information from the past 24 hours.

To generate a Fault History report on time spans beyond the last 24 hours, use Fault History from DFM by selecting Fault History. For more information, see Starting Fault History from the DFM Home Page.

Starting the Alerts and Activities Display

You can start the Alerts and Activities display several ways:

•From the LMS portal Functional view, select Alerts and Activities in the DFM portlet.

•From the DFM home page, select Faults > Alerts.

•By clicking the Alerts and Activities tab and then clicking Alerts and Activities.

Traps received from the Devices are also shown in Alerts and Activities display. For more information on Traps, see Processed and Pass-Through Traps, and Unidentified Traps and Events

Figure 3-1 shows an example of an Alerts and Activities display.

---

Tip After you become familiar with the Alerts and Activities display, you can modify the information it provides as described in Customizing the Alerts and Activities Display.

---

Figure 3-1 Alerts and Activities Display

1	View pane. See View Pane.	3	Tabular display pane. See Tabular Display Pane.
2	Launch information and view status bar area. See Launch Information and View Status Bar Area.	4	Window tools area. See Window Tools Area.

Understanding the Layout of the Alerts and Activities Display

These topics provide details about the information in the Alerts and Activities display.

View Pane

The view pane lists the currently available views, or logical groupings of device groups. Views must be created and activated before they can appear on the Alerts and Activities display. By default, two views—All Alerts and Suspended Devices—are always shown.

You can delete alerts from your Alerts and Activities display. (To create and activate a view or remove an unwanted view from your display, see Configuring Views for the Alerts and Activities Display.)

The current view is highlighted in the view pane. The contents of the current view are shown in the tabular display pane to the right of the view pane. To select another view, click the view name in the view pane.

In Figure 3-2 the current view is View1. Icons next to the views indicate the severity of the alerts received from devices in those views. These icons indicate that the devices may need attention.

Figure 3-2 Alerts and Activities Display—View Pane and Severity Icons

For the current view (View1 in this example), severity icons also appear next to the alerts in the tabular display, as shown in Figure 3-2, to help you quickly locate a specific alert.

The view pane is updated every two minutes. You can have up to 18 views in the view pane in a single Alerts and Activities display.

Launch Information and View Status Bar Area

The launch information area shows the time on the server when the Alerts and Activities display was started.

The view status bar lists the selected view, which is shown in the tabular display pane.

Tabular Display Pane

The tabular display pane is the core of the Alerts and Activities display. It is a paging table that contains a list of all alerts that are occurring on the devices in your current view. Alerts are polled every 30 seconds, and the data is refreshed if a change has occurred.

The information is always updated every 6 minutes, regardless of whether changes are detected. For an explanation of all of the items in the tabular display, see Alerts and Activities Tabular Display—Contents.

Icons alert you to what needs attention. For example:

•The severity icons indicate which views and alerts require attention.

•The diamond symbols in the Last Change column indicate which alerts have experienced recent activity. When no diamonds appears in the Last Change column, the alert is no longer current, or stale.

You can page through the tabular display to view all records. See Figure 3-3 for an illustration of the tabular display pane.

Window Tools Area

The top-right corner of the Alerts and Activities display contains buttons for the available window tools. All buttons are described in Table 3-1.

Table 3-1 Alerts and Activities Display—Window Tools 

Icon	Meaning	Described in...
	Exports the current tabular display to a PDF file.	Exporting Data from Tabular Displays
	Opens the Filter page, for refining the tabular display in the Alerts and Activities display.	Filtering Alerts and Activities
	Opens a printer-friendly version for printing.	Printing Tabular Displays
	Opens a DFM Tools window with link to Fault History	Generating a 24-Hour Report on All Alerts in the Current View
	Opens the DFM help window.	Using Help

Getting Alert Details

Use the tabular display in the Alerts and Activities display to obtain more information about the alerts that are occurring in your current view.

In the tabular display, as shown in Figure 3-3, alerts are grouped by their severity: critical, warning, or informational. Within these severity groupings, or buckets, alerts with the latest change are listed first.

When an alert is generated, it remains in the Alerts and Activities display until it expires. DFM sets an alert state to Expired when DFM determines that the alert has been in the Cleared state for 20 minutes.

Alerts are moved to Cleared when their last active event has been in the Cleared state for 20 minutes. You can also clear an event manually (see Clearing Alerts).

While the alert is in the display, if any of its events recur, the alert is updated. If an expired alert recurs, a new alert with a new ID is shown.

The Alerts and Activities display does not report alerts generated on VLANs. However, the event properties page will show the VLAN number to which the port belongs (see Viewing Event Properties).

The Detailed Device View will display to which VLAN ports belong (see Starting the Detailed Device View).

Figure 3-3 provides an example of an Alerts and Activities tabular display. Alerts are polled every 30 seconds, and the data is refreshed if a change has occurred. The information is always updated every 6 minutes, regardless of whether changes are detected.

Figure 3-3 Alerts and Activities—Tabular Display

Table 3-2 defines the table elements.

---

Tip You can generate a 24-hour Fault History report on all alerts that occurred on devices in your view by opening Fault History from the DFM home page or the window tools area of the Alerts and Activities display.

---

Table 3-2 Alerts and Activities Tabular Display—Contents 

Heading	Description
!	Severity of alert. The alert severity is determined by the severity of the most critical event in the alert. Critical alerts always remain at the top of the column, even if you click the column to do a reverse sort.
		Critical
		Warning
		Informational Unidentified Trap alert
	(no icon)	Informational (for all other alerts)
Alert ID	Alert identifier number. Clicking this link opens an Alerts and Activities Detail page (see Starting the Alerts and Activities Detail Page).
Device	Device type. Indicates that DFM was discovering the device when the alert occurred. The actual device type is reflected when new events occur. For more information, see Using Device Management. If the DFM server is using Access Control Server (ACS) mode, ACS may limit the devices you are permitted to view. For more information, see Device-Based Filtering.
Duration	Time span since alert creation, depending upon alert status:
	Active or Acknowledged	Time span between alert creation and current server time.
	Cleared	Time span between alert creation and Last Change time (the Last Change time may also represent when the alert was cleared).
Last Change	Date and time alert last occurred or was changed. Diamonds indicate alert activity, such as a new event, alert acknowledgement, new user annotation, and so forth. If there are no diamonds, it indicates that the alert is stale. Alerts are grouped by severity. Within severities, alerts with the latest change are listed first.
		Alert was updated within last 15 minutes.
		Alert was updated within last 16-30 minutes.
		Alert was updated within last 31-45 minutes.
	No diamonds	Alert was updated over 46 minutes ago.
Device Name	Device name or IP address. Clicking this link opens the Detailed Device View (see Understanding the Detailed Device View).
Event Updated	Category of the event with the most recent change, one of the following: Environment, Interface, Other, Reachability, System Hardware, Utilization.
Status	Alert status, based on last polling.
	Active	Alert is live. (Note that alerts on suspended devices remain active; see Sending E-Mail in Response to an Alert.)
	Cleared	Alert is no longer live (Its last active event has been in the Cleared state for 20 minutes). When the alert has been in the Cleared state for 20 minutes, it expires and is removed from the display.
	Acknowledged	Alert was manually acknowledged by a user (from Alerts and Activities Detail page).

Clearing Alerts

You can manually clear alerts.  

You are asked to confirm if you want to clear the alert. Enter your user ID. This will be used as a reference to identify who cleared the alert.

---

Step 1 From the Alerts and Activities display page, check the checkbox of the alert that you need to clear.

Step 2 Click Clear.

A confirmation window opens.

Step 3 Click OK to confirm and clear the alert, or click Cancel to retain the alert.

---

You can clear multiple alerts with a single click from the Alerts and Activities display page.

---

Step 1 From the Alerts and Activities display page, check the checkboxes of alerts that you need to clear.

Step 2 Click Clear.

A confirmation window opens.

Step 3 Click OK to confirm and clear the alert, or click Cancel to retain the alert.

---

You can also clear alerts from the Alerts and Activities Detail page.

---

Step 1 From the Alerts and Activities display page, click the alert that you need to clear.

Alerts and Activities Detail page displays the alert details.

Step 2 Click Clear.

A confirmation window opens.

Step 3 Click OK to confirm and clear the alert, or click Cancel to retain the alert.

---

The alert status is changed to Cleared and remains in that state for twenty minutes. After that time it is removed from the Alerts and Activities Display.

If the status of the alert changes during the twentyminutes, the alert goes to the active state.

Customizing the Alerts and Activities Display

After adding your devices to a view, you can customize your Alerts and Activities display by selecting specific views and using filters:

•Views control the device groups that appear on the Alerts and Activities display. See Selecting Views for Alerts and Activities.

•Filters control the specific device types you monitor, along with alert severities and their status. See Filtering Alerts and Activities.

You can also change the names of DFM events to names that are more meaningful to you. These names will be reflected in both the Alerts and Activities display and in any Fault History reports you generate. For information on changing DFM event names using Notification Customization, see Customizing the Names of DFM Events.

If the DFM server is using Access Control Server (ACS) mode, ACS may limit the devices you are permitted to view. For more information, see Device-Based Filtering.

Selecting Views for Alerts and Activities

When you open the Alerts and Activities display, all available views are listed in the view pane on the left side of the display. If the views shown do not meet your needs, you can create a new view as described in Creating a View.

The view pane is updated every two minutes. You can have up to 18 views in the view pane in a single Alerts and Activities display. See Activating and Deactivating a View for information on how to manage your views.

Filtering Alerts and Activities

You can filter the alerts on the Alerts and Activities so that only the alerts that match your filters are displayed. You can create a filter based on alert severity, status, and ID, and based on the originating device type or name.

If you use an alert filter, the filter is applied to all of your views until you change the filter; other clients are not affected. When you end your session, your filters are lost. Filters do not affect severity icons in the view pane.

To start the Alerts and Activities display,

---

Step 1 Select Alerts and Activities from the LMS portal. You can also select Faults > Alerts from the DFM home page.

The Alerts and Activities display opens.

Step 2 Click the filtering button in the tool button area at the top-right of the Alerts and Activities display.

The Alert Filters page opens. You can populate the Device Type box by selecting device types from the button to the right of the Device Type box. By default, all device types are selected.

Step 3 Select the appropriate criteria:

•Alert severity and status.

•Advanced filtering by AlertID and Device Name. (You can use "*" for wild card matches and "?" for single-character matches in the Device Name field. Do not use "*" by itself in the AlertID field; you will get too many results, most of which will be unrelated to your search.)

Step 4 Click OK.

---

Getting Event Details

These topics address how to start and use the Alerts and Activities Detail page to get more information on events:

•Starting the Alerts and Activities Detail Page

•Understanding the Layout of the Alerts and Activities Detail Page

•Viewing Events Associated with an Alert

•Viewing Event Properties

You can change the names of DFM events using Notification Services. See Customizing the Names of DFM Events.

Starting the Alerts and Activities Detail Page

The Alerts and Activities Detail page provides information about all of the events that were rolled up into a specific alert. Figure 3-4 provides an example of an Alerts and Activities Detail page.

The Alerts and Activities Detail page does not report alerts generated on VLANs. However, the event properties page will show the VLAN number to which the port belongs (see Viewing Event Properties).

The Detailed Device View will display to which VLAN ports belong (see Starting the Detailed Device View).

You can start the Alerts and Activities Detail page two ways:

•From the LMS portal DFM view, select a high-severity alert.

•From the Alerts and Activities display, select an alert.

Figure 3-4 Alerts and Activities Detail Page

1	Alerts status bar. See the Alert Status Bar.	5	Tools drop-down list. See Tools Drop-Down List.
2	Launch information area. See Launch Information Area.	6	Command button area. See Command Button Area.
3	Tabular display pane. See Tabular Display Pane.	7	Notes pane. See Notes Pane.
4	Window tools area. See Window Tools Area.

Understanding the Layout of the Alerts and Activities Detail Page

These topics provide details about the information in the Alerts and Activities display.

Alert Status Bar

The alert status bar lists details about the alert with which the listed events are associated. Table 3-3 explains the contents of the alert status bar area.

Table 3-3 Alerts and Activities Detail  Page—Alert Status Bar Contents 

Field	Description
Device Name	Device name or IP address.
Device	Device type. Learning indicates that DFM was discovering the device when the alert occurred. The actual device type is reflected when new events occur. For more information, see Using Device Management If the DFM server is using Access Control Server (ACS) mode, ACS may limit the devices you are permitted to view. For more information, see Device-Based Filtering.
Status	Alert status, based on last polling.
	Active	Alert is live. (Note that alerts on suspended devices remain active; see Sending E-Mail in Response to an Alert.)
	Cleared	Alert is no longer live (its last active event has been in the Cleared state for 20 minutes). When the alert has been in the Cleared state for 20 minutes, it expires and is removed from the display.
	Acknowledged	Alert was manually acknowledged by a user (from Alerts and Activities Detail page). If an event on the alert recurs, the alert state reverts to Active.
Alert ID	Alert identifier number.
Duration	Time span since alert creation, depending upon the alert status:
	Active or Acknowledged	Time span between alert creation and current server time.
	Cleared	Time span between alert creation and Last Change time (the Last Change time may also represent when the alert was cleared).
Last Change	Time and date of last alert update (indicates activity, such as an event recurrence, alert acknowledgement, the addition of an annotation, and so forth). Alerts are grouped by severity, and within severities. Alerts with the latest change are listed first.

Tabular Display Pane

In the Alerts and Activities Detail page, the tabular display pane contains a table that lists details about events. These events are associated with the alert listed in the alert status bar.

You can refresh the display by clicking Refresh at the bottom of the pane. For an explanation of all of the items in the table, see Alerts and Activities Detail Tabular Display—Contents.

You can page through the tabular display to view all records. See Figure 3-3 for an illustration of the tabular display pane.

See Figure 3-4 for an illustration of the actions you can perform from this window.

Launch Information Area

The launch information area shows the time on the server when the Alerts and Activities Detail page was started.

Window Tools Area

The top-right corner of the Alerts and Activities Detail page contains a printer tool button, as described in Table 3-4.

Table 3-4 Alerts and Activities Detail Page—Window Tool

Icon	Meaning	Described in...
	Opens a printer-friendly version for printing	Printing Tabular Displays

Tools Drop-Down List

The Tools drop-down list contains a list of applications that can provide more information, depending on your installation. For more information, see Alerts and Activities Detail Tabular Display—Contents.

Notes Pane

The notes pane lists any alert annotations that users have entered. The notes pane is a convenient tool for making sure that all users see alert information. You can add an annotation by clicking the Annotate button. Adding an annotation is described in Starting the Alerts and Activities Display.

Command Button Area

In addition to the Annotate button in the notes pane, the command button area provides other ways to respond to alerts.

Table 3-5 Alerts and Activities Detail  Page—Command Buttons 

Button	Action
Refresh	Refreshes the tabular display.
Acknowledge	Changes the event status to Acknowledged. See Acknowledging an Alert for more information.
Clear	Clears and deletes alarms and events.
Suspend	Suspends polling and trap processing on the device or device component by opening a Detailed Device View (DDV), from which you can perform the suspend command. The DDV is described in Starting the Detailed Device View.
Notify	Sends e-mail notification of the alert. See Sending E-Mail in Response to an Alert for more information.
Close	Closes the Alerts and Activities Detail page.

Viewing Events Associated with an Alert

Use the tabular display in the Alerts and Activities Detail page to obtain more information about all of the events associated with a specific alert. In the tabular display, as shown in Figure 3-5, events with the latest change are listed first.

Events remain on the Alerts and Activities Detail page until the parent alert expires. If you suspend a device, all the events are cleared, but the alert remains active. (This way, users cannot remove important information from the display, and you can easily resume the device.)

If an event recurs, the existing event is not updated. Instead, the recurrence is shown as a new event with a new event ID.

Figure 3-5 provides an example of an Alerts and Activities Detail table.

Figure 3-5 Alerts and Activities Detail Page—Tabular Display

Table 3-6 defines the table elements. Click Refresh at the bottom of the page to refresh the table contents.

---

Tip You can generate a 24-hour Fault History report on all events that occurred on a selected component by opening Fault History from the window tools area of the Alerts and Activities display or from the DFM home page.

---

Table 3-6 Alerts and Activities Detail Tabular Display—Contents 

Event ID	Event identifier number. Clicking this link opens the event properties page (see Getting Event Details). Note that this Event ID is not the same as the Event Code provided by Notification Services. For more information, see Customizing the Names of DFM Events.
Description	DFM event name (as described in Events Processed). You can also change the names of DFM events to names that are more meaningful to you. For information on changing DFM event names using Notification Customization, see Customizing the Names of DFM Events.
Component	Device element on which the event occurred.
Time	Time at which the event occurred.
Status	Event status, based on last polling.
	Active	Event is live.
	Cleared	Event is no longer live. When the event has been in the Cleared state for 20 minutes, it expires and is removed from the display. Note that events on suspended devices are moved to Cleared, but the alert remains active. See Suspending and Resuming Devices.
	Suspended	Device is suspended.
	Resumed	Device is being resumed.
	Deleted	Device has been deleted.
Tools	A drop-down list of applications that can provide more information. The Tools drop-down list can include the following, depending upon the applications installed on your server: •Fault History—Opens a 24-hour Fault History report on the component. See Understanding the Fault History: Events Display. •Device Ctr.—Opens the CiscoWorks Device Center, which provides a centralized point for reports, tools, and tasks that you can perform on the selected device. •UT Report—Opens a User Tracking End Host report that lists end-user hosts in the network. (This tool is available if Campus Manager is installed.) •CiscoView—Opens the CiscoView chassis view for the device. (This tool is available if CiscoView is installed.)

Viewing Event Properties

The event properties page provides additional details about the event, such as the values of MIB attributes at the time of the event, polling and threshold information, and utilization information.

You can view VLAN properties on the event properties page, if applicable, although DFM does not display alerts generated on VLANs. The Detailed Device View will display to which VLAN ports belong (see Starting the Detailed Device View).

---

Step 1 From the Alerts and Activities display, locate the alert you want to investigate and click the alert ID.

The Alerts and Activities Detail page appears.

Step 2 Locate the event you want to investigate, and click the event ID.

The event properties page appears.

---

The information that is shown on the event properties page depends on the event type.

Clearing an Event

You can manually clear events. To do this:

---

Step 1 From the Event Description window, select the event and click Clear to remove the event from DFM. 

You are prompted to confirm if you want to clear the event.

Step 2 Enter your user ID. This will be used as a reference to identify who cleared the event.

Step 3 Click OK to confirm and clear the event

or

Click Cancel to retain the event.

The event description window shows that the event was cleared.

---

Getting Device Information (Detailed Device View)

The Detailed Device View (DDV) provides extensive information on the devices and device components listed in Starting the Detailed Device View.

You can view information on devices that DFM is currently managing, as well as devices whose management you have suspended (regardless of whether the device is generating an alert):

•View hardware and software information on system, environment, and interface components (including port VLAN information)

•View hardware and software information on subcomponents of aggregate devices. For example, Multilayer Switch Feature Cards (MSFCs) on switches.

•Suspend or resume management of a device or a device component so the device or component s no longer polled, or polling is resumed

See these topics for more information:

•Starting the Detailed Device View

•Understanding the Detailed Device View

•Managing/Unmanaging a Single Device Component

Starting the Detailed Device View

You can open a DDV for any device in the Alerts and Activities page—or for any known device in the DFM inventory (regardless of whether it is currently managed).

You cannot display a DDV for unidentified trap devices. For more information on unidentified traps, refer to Processed and Pass-Through Traps, and Unidentified Traps and Events

---

Step 1 Open the DDV as follows:

•For any known device, from the DFM home page, select Device Management > View Device Details and click the device link.

•For devices with alerts, click the device link in the Alerts and Activities display Device Name column.

The DDV opens. See Figure 3-6 for an example.

Step 2 Select an instance from the device tree.

The details table is populated.

If the item you select is the subdevice of an aggregated device—for example, an MSFC/RSM in a switch—the DDV will show the subdevice's managed state and device capability.

To display a complete DDV of the subcomponent, click Launch New DDV For This Device.

If you want to suspend a managed device so it is no longer polled and its traps are no longer processed or if you want to resume a suspended device:

•Click Suspend to change the device's managed state to Suspended.

DFM no longer polls any device components, nor does it process any traps.

All alerts and activities change to the Cleared state, and the device is moved to the Suspended Devices view. Subsequent events (including traps) are ignored and no longer processed.

•Click Resume to change the device's managed state to Active.

DFM resumes polling and trap processing on the device, and the device is moved out of the Suspended Devices view and back into its previous view.

If you resumed any devices and if you have completed your monitoring status changes, select Configuration > Polling and Thresholds > Apply Changes from the DFM home page so that DFM will resume polling according to the polling and threshold settings for the device.

Since this action is CPU-intensive, wait until you have made all of your monitoring status changes before you apply them.

---

Figure 3-6 provides an example of device information for a Cisco 3745 router.

Figure 3-6 Detailed Device View—Cisco 3745 Router

1	Component categories pane. See Component Categories Pane.	4	Command button area. See Command Buttons Area.
2	System information pane. See System Information Pane.	5	Launch information area. See Launch Information.
3	Record count. See Record Count.

Understanding the Detailed Device View

These topics provide details about the information in the DDV.

Component Categories Pane

The component categories pane lists the components of the device: Environment, System, and Interface (what is shown depends on the device being viewed). The following are some examples of what you may see in these categories:

•Environment: Temperature, fan, power supply, voltage information

•System: Hard disk, RAM, processor, memory information

•Interface: Interface, port, card information; IP addresses on the device

---

Note Avoid using non US (eg.8 bit ASCII) characters in the description of an Interface. When an interface description includes these characters, an error occurs when you try to change the managed state of a device in the Detailed Device View page.

---

From a DDV for an aggregate (containing) device, you can launch a DDV for the contained device. For example, for a router containing MSFCs, open a DDV for the router. From the router DDV, you can launch a new DDV for the MSFC.

System Information Pane

The system information pane provides information such as the system name, IP address, SysObjectID, system contact, and so forth. The device type determines what is displayed by the DDV.

If the system information pane lists an attribute with no value, it is because of one of the following reasons:

•The attribute is not populated.

•The attribute is not configured correctly.

•The attribute does not apply to the device.

If the current view is of a parent (or containing) device—for example, a Catalyst 6513 switch with an MSFC card—the System Information Pane will contain a button, Launch New DDV For This Device button. If you click that button, a DDV for the MSFC is displayed.

You can suspend or resume device or component monitoring by clicking the Suspend or Resume button (The button shown depends on the component's current managed state). These functions are described in these sections:

•Suspending and Resuming Devices

•Managing/Unmanaging a Single Device Component

Record Count

The record count lists the number of information types available on the device.

Command Buttons Area

In addition to the Suspend and Resume buttons in the system information pane, the Command Button area provides other ways to respond to alerts.

Table 3-7 Detailed Device View—Command Buttons

Button	Action
Get Troubleshooting Info	Launches a CiscoWorks Assistant Troubleshooting Report, which helps identify the cause of a device being unreachable. (For more information, see the User Guide for CiscoWorks Assistant 1.1.)
Refresh	Refreshes the DDV page. (The DDV is not automatically refreshed; you must do so manually.)
Close	Closes the DDV page.

Launch Information

The launch information tells you when the DDV was started. If you refresh the page, the time is updated.

Managing/Unmanaging a Single Device Component

You can unmanage or remanage device components using the DDV (cards, interfaces, ports, IP addresses, and so forth). If you unmanage a component, DFM will ignore subsequent events (including traps).

---

Note You cannot resume a device component if the parent device is suspended. You must resume the parent device first. If a parent device is suspended, the device components are also suspended.

---

---

Step 1 From the Alerts and Activities display, click a device in the Device Name column.

The DDV opens.

Step 2 Select the component with the instance you want to unmanage or manage.

Step 3 Locate the instance you want to unmanage or manage, and make your change using the list in the ManagedState column.

Note that:

•You can change the unmanaged state of an IP component of a device to managed state, only if its underlying interface is in a managed state.

•You cannot change the state of a management IP because it is not displayed in the DDV page.

•You can place the cursor on Details to see the Interface/Port details of a specific device. This option is available only for Port and Interface components. See Figure 3-8 for more information.

Figure 3-7 is an example where the management IP 10.77.210.189 is not displayed in the DDV page. This is to prevent you from accidentally unmanaging the management IP.

Figure 3-7 Example of a Management IP not displayed in the DDV page

•You cannot unmanage the interface of the management IP. Its status is static and there is no option to unmanage it.

Figure 3-8 is an example where the Managed State of the IP 13.0.1.4 is displayed as True. You can manage or unmanage the other interfaces but not the interface of the IP 13.0.1.4.

Figure 3-8 Example displaying the static Managed State of a management IP

Step 4 Click Submit.

If you resumed any devices (and you are finished making all of your monitoring status changes), select Configuration > Polling and Thresholds > Apply Changes from the DFM home page. This causes DFM to resume polling according to the polling and threshold settings for the device.

Since this action is CPU-intensive, wait until you have made all of your monitoring status changes before you apply them.

---

Managing Interfaces with ONDEMAND mode

Interfaces with ONDEMAND mode are not managed by default.

To manage them using the dmctl CLI command, enter:

get Ethernet_Performance_Setting:: "Thresholds setting group" ::AnalysisModeOfSubInterfacePerformance ENABLED

invoke ICF_PolicyManager::ICF-PolicyManager reconfigure

For example: get Ethernet_Performance_Setting:: "SET-CFG-Interface Groups/1 Gb Ethernet/Ethernet_Performance_Setting" ::AnalysisModeOfSubInterfacePerformance ENABLED

invoke ICF_PolicyManager::ICF-PolicyManager reconfigure

Suspending Device and Element Monitoring

You can stop monitoring a device by selecting it and clicking the Suspend button in the DDV. Conversely, you can resume monitoring by clicking the Resume button.

See these topics for more information:

•Suspending and Resuming Devices

•Performing Bulk Manage and Unmanage Operations

Suspending and Resuming Devices

When you unmanage a device (changing its managed state to False) DFM no longer polls that device for information. Subsequent events (including traps) are ignored and no longer processed.

When you suspend a device, all of the active events on the device are moved to the Cleared state, but the alert remains in the Active state. This happens to ensure that:

•You cannot mistakenly remove important information from the display when you suspend a device (When alerts are cleared, they are removed from the Alerts and Activities display).

•You can easily resume the device.

---

Note Your login determines whether you can perform this operation.

---

---

Step 1 From the Alerts and Activities display, start the view that contains your device. Devices not managed will be in the Suspended Devices view.

The DDV opens. Depending upon the managed state of the device, either the Suspend or the Resume button is shown.

Step 2 Click either:

•Suspend to change the device's current managed state to Suspended.

DFM no longer polls any device components, nor does it process any traps. All alerts and activities change to the Cleared state, and the device is moved to the Suspended Devices view. Subsequent events (including traps) are ignored and no longer processed.

Or

•Resume to change the device's current managed state to Active.

DFM resumes polling and trap processing on the device, and the device is moved out of the Suspended Devices view and back into its previous view.

If you resumed any devices (and you are finished making all of your monitoring status changes), select Configuration > Polling and Thresholds > Apply Changes from the DFM home page. This causes DFM to resume polling according to the polling and threshold settings for the device.

Since this action is CPU-intensive, wait until you have made all of your monitoring status changes before you apply them.

---

Performing Bulk Manage and Unmanage Operations

You can use ASL scripts to perform bulk manage and unmanage operations of interfaces, ports, IP addresses, processors, and memory, as described in this topic.

You can create and edit a generated file so that it reflects the management state you want. Later you can apply the change to the DFM inventory, so that DFM will use your new settings when gathering device information.

In the following procedures, NMSROOT represents the CiscoWorks installation directory. By default, these directories are:

•Solaris: /opt/CSCOpx

•Windows: C:\Progra~1\CSCOpx (which stands for C:\Program Files\CSCOpx)

---

Step 1 Depending on your platform, run one of the following scripts to create the generated files that are necessary for the operation:

Operating System/Element		Command
Solaris
Interfaces/Ports		NMSROOT/objects/smarts/utils/getStateIntPort.ksh
IP Addresses		NMSROOT/objects/smarts/utils/getStateIP.ksh
Processor		NMSROOT/objects/smarts/utils/getStateProc.ksh
Memory		NMSROOT/objects/smarts/utils/getStateMem.ksh
Windows
Interfaces/Ports		NMSROOT\objects\smarts\utils\getStateIntPort.bat
IP Addresses		NMSROOT\objects\smarts\utils\getStateIP.bat
Processor		NMSROOT\objects\smarts\utils\getStateProc.bat
Memory		NMSROOT\objects\smarts\utils\getStateMem.bat

Step 2 Open the appropriate generated file:

Operating System/Element		Command
Solaris
Interfaces		NMSROOT/objects/smarts/local/logs/expInterface.log
		NMSROOT/objects/smarts/local/logs/expInterface1.log
Ports		NMSROOT/objects/smarts/local/logs/expPort.log
		NMSROOT/objects/smarts/local/logs/expPort1.log
IP Addresses		NMSROOT/objects/smarts/local/logs/expIP.log
		NMSROOT/objects/smarts/local/logs/expIP1.log
Processor		NMSROOT/objects/smarts/local/logs/expProc.log
		NMSROOT/objects/smarts/local/logs/expProc1.log
Memory		NMSROOT/objects/smarts/local/logs/expMem.log
		NMSROOT/objects/smarts/local/logs/expMem1.log
Windows
Interfaces		NMSROOT\objects\smarts\local\logs\expInterface.log
		NMSROOT\objects\smarts\local\logs\expInterface1.log
Ports		NMSROOT\objects\smarts\local\logs\expPort.log
		NMSROOT\objects\smarts\local\logs\expPort1.log
IP Addresses		NMSROOT\objects\smarts\local\logs\expIP.log
		NMSROOT\objects\smarts\local\logs\expIP1.log
Processor		NMSROOT\objects\smarts\local\logs\expProc.log
		NMSROOT\objects\smarts\local\logs\expProc1.log
Memory		NMSROOT\objects\smarts\local\logs\expMem.log
		NMSROOT\objects\smarts\local\logs\expMem1.log

Step 3 Edit the generated file to reflect one of the following states:

MANAGED_STATE:EXPLICITLY_MANAGED

MANAGED_STATE:EXPLICITLY_UNMANAGED

Step 4 Set and apply your state changes so DFM will collect the proper device information

Operating System/Element		Command
Solaris
Interfaces/Ports		NMSROOT/objects/smarts/utils/setStateIntPort.ksh
IP Addresses		NMSROOT/objects/smarts/utils/setStateIP.ksh
Processor		NMSROOT/objects/smarts/utils/setStateProc.ksh
Memory		NMSROOT/objects/smarts/utils/setStateMem.ksh
Windows
Interfaces/Ports		NMSROOT\objects\smarts\utils\setStateIntPort.bat
IP Addresses		NMSROOT\objects\smarts\utils\setStateIP.bat
Processor		NMSROOT\objects\smarts\utils\setStateProc.bat
Memory		NMSROOT\objects\smarts\utils\setStateMem.bat

:

---

The following example shows a session in which you can perform a bulk unmanage on interfaces.

# /opt/CSCOpx/objects/smarts/utils/getStateIntPort.ksh

Get Managed state for interfaces from DfmServer

MAIN-N-Closing this log file at 13-Jan-2007 19:05:45; continuing in

    /opt/CSCOpx/objects/smarts/local/logs/expInterface.log

Get Managed state for Ports from DfmServer

MAIN-N-Closing this log file at 13-Jan-2007 19:05:49; continuing in

    /opt/CSCOpx/objects/smarts/local/logs/expPort.log

# cd /opt/CSCOpx/objects/smarts/local/logs

You can open the exp.Interface.log file and locate the interfaces to be unmanaged:

INTERFACE:IF-12.9.150.46/2 MANAGED_STATE:MANAGED

INTERFACE:IF-12.9.150.76/5 MANAGED_STATE:MANAGED

INTERFACE:IF-12.9.150.63/2 MANAGED_STATE:MANAGED

...

You can change the MANAGED_STATE value:

INTERFACE:IF-12.9.150.46/2 MANAGED_STATE:EXPLICITLY_UNMANAGED

INTERFACE:IF-12.9.150.76/5 MANAGED_STATE:EXPLICITLY_UNMANAGED

INTERFACE:IF-12.9.150.63/2 MANAGED_STATE:EXPLICITLY_UNMANAGED

...

# /opt/CSCOpx/objects/smarts/utils/setStateIntPort.ksh

Set Managed state for interfaces for DfmServer

MAIN-N-Closing this log file at 13-Jan-2007 19:12:18; continuing in

    /opt/CSCOpx/objects/smarts/local/logs/intfOut.log

Set Managed state for Ports for DfmServer

MAIN-N-Closing this log file at 13-Jan-2007 19:12:22; continuing in

    /opt/CSCOpx/objects/smarts/local/logs/portOut.log

Apply changes and reconfigure on DfmServer

MAIN-N-Closing this log file at 13-Jan-2007 19:12:33; continuing in

    /opt/CSCOpx/objects/smarts/local/logs/apply.log

Acknowledging, Annotating, and Sending E-Mail Notifications of Alerts

As shown in Figure 3-4, the Alerts and Activities Detail page provides command buttons in the bottom-right corner of the page. The Suspend button is discussed in Suspending Device and Element Monitoring. This section explains how you can use the Acknowledge, Annotate, and Notify buttons to respond to alerts. It contains:

•Acknowledging an Alert

•Annotating an Alert

•Sending E-Mail in Response to an Alert

Acknowledging an Alert

Acknowledging an active alert signals other users that are aware of the alert. When you click Acknowledge, this status change is populated to all Alerts and Activities displays.

If an event on the alert recurs, the event status reverts to Active.

---

Step 1 From the Alerts and Activities display page, check the checkbox of the alert that you need to acknowledge.

Step 2 Click Acknowledge.

A confirmation window opens.

Step 3 Click OK.

---

You can acknowledge multiple alerts with a single click from the Alerts and Activities display page.

---

Step 1 From the Alerts and Activities display page, check the checkboxes of alerts that you need to acknowledge.

Step 2 Click Acknowledge.

A confirmation window opens.

Step 3 Click OK.

---

You can also acknowledge alerts from the Alerts and Activities Detail page.

---

Step 1 From the Alerts and Activities display page, click the alert that you need to acknowledge.

Alerts and Activities Detail page displays the alert details.

Step 2 Click Acknowledge.

A confirmation window opens.

Step 3 Click OK.

---

Annotating an Alert

You can annotate an alert by clicking Annotate from the Alerts and Activities Detail page. An editable Annotation dialog box opens; in the dialog box, you can enter up to 255 characters. An annotation will be shown whenever other users view the alert from an Alerts and Activities Detail page.

---

Step 1 From the Alerts and Activities Detail page, click Annotate.

The Annotation dialog box opens.

Step 2 Enter your text.

Text that exceeds 255 characters will be truncated without warning. If this happens, you can add another annotation.

Step 3 Click OK.

The annotated text is displayed in the Notes box.

---

Figure 3-9 shows the Alerts and Activities Detail page, containing a previously created annotation.

Figure 3-9 Annotation on the Alerts and Activities Detail Page

Sending E-Mail in Response to an Alert

When you click the Notify button on the Alerts and Activities Detail page, DFM opens a dialog box that you can complete to manually send an e-mail notification to multiple recipients. The e-mail notification contains the text you add with any alert or event information.

If you want to send automatic e-mail notifications when alerts or events occur on certain devices, use Notification Services to set up an E-mail Notification subscription. See Managing E-Mail Notifications.

CiscoWorks Common Services controls the SMTP server used by DFM. For more information, from the Common Services home page, select Server > Admin > System Preferences, and click Help.

---

Step 1 From the Alerts and Activities Detail page, click Notify.

The E-mail Notification Recipients dialog box opens.

Step 2 In the E-mail Notification Recipients dialog box:

a. Select your SMTP server by doing one of the following:

•Click the SMTP Server button and select the SMTP server you want to use.

•Enter a fully qualified DNS name or IP address for an SMTP server.

b. Click the Domain Names button and select the domain you want to use.

c. Enter your e-mail address in the Sender Address field.

d. Enter a comma-separated list of e-mail addresses in the Recipient Address(es) field.

e. Enter a subject heading in the Header field.

f. (Optional) Enter a message in the Message field.

g. Click Send.

---