Table Of Contents

Using Fault History

Getting Started with Fault History

Starting Fault History

Starting Fault History from the Alerts and Activities Display

Generating a 24-Hour Report on All Alerts in the Current View

Generating a 24-Hour Report on All Events on a Device Component

Starting Fault History from the DFM Home Page

Searching for Faults on Devices or Device Groups

Searching for Faults Using Event or Alert Criteria

Understanding the Fault History: Alerts and Activities Display

Understanding the Fault History: Events Display

Using Fault History

---

These topics explain how to use Device Fault Manager (DFM) Fault History:

•Getting Started with Fault History

•Starting Fault History

•Understanding the Fault History: Alerts and Activities Display

•Understanding the Fault History: Events Display

Getting Started with Fault History

Fault History allows you to store and view the history of DFM events and alerts from the past 31 days. This setting cannot be changed.

The stored history includes alert information and annotations (informational text that you enter), and event information and properties (for example, the values of MIB attributes at the time of the event, polling and threshold information, and utilization information).

For an example of the information that Fault History displays, see Figure 6-1 and Figure 6-2.

You can also customize the names of events displayed by Fault History (and the Alerts and Activities display) using the Notification Customization feature in Notification Services. For more information, refer to Customizing DFM Events.

You can start Fault History from within DFM in one of two ways:

•To generate the most granular reports using all saved information in the Fault History database, start Fault History by selecting Fault History from the DFM home page. See Starting Fault History from the DFM Home Page.

•To generate a quick, contextual 24-hour report, start Fault History from the Alerts and Activities display. See Starting Fault History from the Alerts and Activities Display.

A link to Fault History is also provided in the Device Center, which you can open by selecting Device Diagnostic Tools > Device Center from the LMS portal. The Device Center provides a number of device-centric troubleshooting tools.

This Fault History link is useful when you are troubleshooting a specific device, allowing you to quickly search the Fault History database for problems on that device. For more information, open the Device Center and click Help.

If Fault History finds more than 2,000 records while generating a report, a popup window tells you the total number of records found. The Fault History displays can show up to 2,000 records as a table you can scroll or page through.

If your report exceeds 2,000 records and you want to view all of them, you can use the Export tool button to save all of the information to a CSV or PDF file.

You can use Fault History to generate customized tabular displays of specific alerts, specific events, event dates, event severity, and so forth. You might want to generate a Fault History report when:

•A significant alert is shown in the Alerts and Activities display, and you want to see how often the alert has been generated in the last month.

•You receive an e-mail notification that an unusual event has occurred.

•You want to search for information on events and alerts other than those you are tracking in your customized Alerts and Activities display.

The Fault History database is stored at NMSROOT\databases\dfmFH\dfmFH.db. The database stores a maximum of 31 days of data and is purged according to the DFM database purging schedule (see Configuring the Daily Purging Schedule.)

If the DFM server is using Access Control Server (ACS) mode, ACS may limit the devices you are permitted to view and for which you can create Fault History displays. For more information, refer to Device-Based Filtering.

---

Note Because DFM does not report alerts generated on VLANs, Fault History does not store VLAN fault information in its database. However, you can view VLAN information on the event properties page and in the Detailed Device View. See Viewing Event Properties and Starting the Detailed Device View.

---

Starting Fault History

DFM provides two starting points from which you can generate Fault History reports:

•To create a context-sensitive 24-hour report, use Fault History from the Alerts and Activities display. See Starting Fault History from the Alerts and Activities Display.

•To create filtered reports using all of the stored information in the Fault History database, use the DFM home page. See Starting Fault History from the DFM Home Page.

Starting Fault History from the Alerts and Activities Display

Start Fault History from the Alerts and Activities display to create a 24-hour report on:

•All alerts in your current view, as described in Generating a 24-Hour Report on All Alerts in the Current View.

•All events on a specific device component, as described in Generating a 24-Hour Report on All Events on a Device Component.

Generating a 24-Hour Report on All Alerts in the Current View

To create a report on all the alerts that have occurred in your current view in the past 24 hours, start Fault History from the window tools area in the Alerts and Activities display. (See Window Tools Area.)

---

Step 1 From the Alerts and Activities display, select a view from the view object selector. (See Configuring Views for the Alerts and Activities Display.)

Step 2 Launch Fault History from the window tools area.

A 24-hour Fault History tabular display opens. It contains information about all alerts on all devices in the most recently accessed view. If Fault History finds more than 2,000 records, a popup window reports the total number of records found.

The Fault History: Alerts and Activities display appears. Understanding the Fault History: Alerts and Activities Display, describes the report contents.

To see if any user annotations are associated with a specific alert, click the Status link. If a user has entered an annotation for this alert, the alert annotations page appears.

Annotations are entered from the Alerts and Activities display. See Annotating an Alert for more information on annotations.

---

If Fault History finds more than 2,000 records based on your search criteria, you can view all of the reports by clicking the Export button (in the upper-right corner of the display) and saving your report to a PDF or CSV file.

Generating a 24-Hour Report on All Events on a Device Component

To create a report on all events that have occurred on a specific device component in the past 24 hours, use the Fault History tool in the Alerts and Activities Detail display.

---

Step 1 From the Alerts and Activities display, click an alert ID.

The Alerts and Activities Detail display appears.

Step 2 Locate the device component in which you are interested, and select Fault History from the list in the Tools column.

If Fault History finds more than 2,000 records, a popup window reports the total number of records found.

The Fault History: Events display appears. Understanding the Fault History: Events Display, describes the display contents.

If you want to view more details about the event, such as the value of MIB attributes at the time of the event, click the appropriate event ID. The event properties page appears.

---

If Fault History found more than 2,000 records based on your search criteria, you can view all of the reports found by clicking the Export button (in the upper-right corner of the display) and saving your report to a PDF or CSV file.

Starting Fault History from the DFM Home Page

To gather historical information on alerts and events in the past 31 days, start Fault History by selecting Faults > Fault History from the DFM home page. The following topics explain how you can apply filters and generate reports based on all of the saved information in the Fault History database:

•To search for alerts based on device groups or individual devices, see Searching for Faults on Devices or Device Groups.

•To search for information using alert or event criteria, see Searching for Faults Using Event or Alert Criteria.

Searching for Faults on Devices or Device Groups

To get information about the alerts and events that occur on a specific device or device group, use the Group/Device Filtering option.

A link to Fault History is also provided in the Device Center, which provides a number of device-centric troubleshooting tools.

This Fault History link is useful when you are troubleshooting a specific device, allowing you to quickly search the Fault History database for problems on that device. For more information, select Device Diagnostic Tools > Device Center from the LMS portal and click Help.

If the DFM server is using Access Control Server (ACS) mode, ACS may limit the devices you are permitted to view and for which you can create Fault History displays. For more information, refer to Device-Based Filtering.

---

Step 1 After starting Fault History from the DFM home page, select Group/Device Filtering.

The Group/Device Filtering page appears.

Step 2 Select the devices in which you are interested from the device selector.

With many devices in DFM, it can sometimes be difficult to locate the devices you are interested in. To assist you in locating devices, use the search option in the device selector. For more information, see Selecting Objects and Groups.

The device selector includes devices that were removed from the DFM inventory; therefore you can still search for information on those devices.

Step 3 To search for alerts:

a. Select View Alert in the View Option drop-down list.

b. Select the search date and alert severities.

Step 4 To search for events:

a. Select View Event in the View Option drop-down list.

b. Select the search date, event severities, and events. Use the Event Description popup to select multiple events. If you select any severities, the events list is filtered accordingly.

Step 5 Click View.

If Fault History finds more than 2,000 records, a popup window reports the total number of records found.

---

If Fault History finds more than 2,000 records based on your search criteria, you can view them by clicking the Export button (in the upper-right corner of the display) and saving your report to a PDF or CSV file.

Searching for Faults Using Event or Alert Criteria

To get information about all instances of alerts and events that occur in your network, use the Alert/Event ID Filtering option.

If the DFM server is using Access Control Server (ACS) mode, ACS may limit the devices you are permitted to view and for which you can create Fault History displays. For more information, refer to Device-Based Filtering.

---

Step 1 After starting Fault History from the DFM home page, select Alert/Event ID Filtering.

The Group/Device Filtering page appears.

Step 2 To search for alerts by ID, severity, and time frame:

a. Select View Alert in the View Option drop-down list.

b. Select the search date and alert severities, and enter the Alert ID.

Step 3 To search for events related by Alert ID, event type, event severity, and time frame:

a. Select View Event for Alert ID in the View Option drop-down list.

b. Enter the Alert ID and select the search date, event severities, and event types. Use the Event Description popup to select multiple events. If you select any severities, the events list is filtered accordingly.

c. Use the Event Description popup to select multiple events.

Step 4 To search for specific events by their ID and time frame:

a. Select View Event for Event ID in the View Option drop-down list.

b. Select the search date and enter the Event ID.

Step 5 Click View.

If Fault History finds more than 2,000 records, a popup window reports the total number of records found. You can view these records by clicking the Export button (in the upper-right corner of the display) and saving your report to a PDF or CSV file.

---

Understanding the Fault History: Alerts and Activities Display

The Fault History: Alerts and Activities display is shown in Figure 6-1. You can generate this display as described in these sections:

•Generating a 24-Hour Report on All Alerts in the Current View

•Searching for Faults on Devices or Device Groups

The tabular display is a scrollable table that lists up to 2,000 records, based on your filtering criteria. If you want to view database contents beyond the 2,000 records, click the Export tool button in the upper-right corner.

Figure 6-1 Fault History: Alerts and Activities Display

The Fault History: Alerts and Activities display provides Export and Printer-friendly tools. For more information on the tools, see Using Window Tools.

Table 6-1 describes the contents of the Fault History: Alerts and Activities tabular display.

Table 6-1 Fault History: Alerts and Activities Tabular Display—Contents 

Heading	Description
Alert ID	Alert identifier number. Clicking this link opens the Fault History: Events display (see Figure 6-2), which provides details about the events associated with the alert.
Device Name	Device name or IP address. If the DFM server is using Access Control Server (ACS) mode, ACS may limit the devices you are permitted to view and for which you can create Fault History displays. For more information, refer to Device-Based Filtering.
Device	Device type. Learning indicates that DFM was discovering the device at the time of the alert. The actual device type is reflected when new events occur. For more information, see Using Device Management.
Description	Alert category, one of the following: Application, Connectivity, Environment, Interface, Other, Reachability, System Hardware, Utilization. For alerts containing multiple events, the tabular display shows the category of the event with the most recent change. For these alerts, the display shows the category of the event with the most recent change.
Severity	Critical or Informational.
Time	Date and time when the alert was generated.
Status	Alert status, based on last polling. Clicking this link opens the Alert Annotation page, which contains user annotations associated with the alert.
	Active	Alert is live.
	Cleared	Alert is no longer live. Also, when a device is suspended, all alerts are cleared. When DFM polling determines that the alarm has been in the Cleared state for 30 minutes or more (from the time of polling), the alarm expires and is removed from the Alerts and Activities display.
	Acknowledged	Alert was manually recognized by a user (from Alerts and Activities Detail display).

Understanding the Fault History: Events Display

The Fault History: Events display is shown in Figure 6-2. This display is generated as described in these sections:

•Generating a 24-Hour Report on All Events on a Device Component

•Searching for Faults Using Event or Alert Criteria

The tabular display is a scrollable table that lists up to 2,000 records, based on your filtering criteria. If you want to view database contents beyond the 2,000 records, click the Export tool button in the upper-right corner.

Figure 6-2 Fault History: Events Display

The Fault History: Events display provides Export and Printer-friendly tools. For more information on the tools, see Using Window Tools.

Table 6-2 describes the contents of the Fault History: Events tabular display.

Table 6-2 Fault History: Events Tabular Display—Contents 

Heading	Description
Event ID	Event identifier number. Clicking this link opens the event properties page, which describes the value of MIB attributes at the time of the event.
Device Name	Device name or IP address. If the DFM server is using Access Control Server (ACS) mode, ACS may limit the devices you are permitted to view and for which you can create Fault History displays. For more information, see Device-Based Filtering.
Component	Device element on which the event occurred.
Description	DFM event name (as described in Events Processed). You can also customize the names of events displayed by Fault History (and the Alerts and Activities display) using the Notification Customization feature in Notification Services. For more information, see Customizing DFM Events.
Time	Date and time when the event was generated.
Status	Event status, based on last polling.
	Active	Event is live.
	Cleared	Event is no longer live. Also, when a device is suspended, all alerts are cleared. When DFM polling determines that an alarm has been in the Cleared state for 30 minutes or more (from the time of polling), the alarm expires and is removed from the Alerts and Activities display.
	Suspended	Device is suspended.
	Resumed	Device is being resumed.
	Deleted	Device has been deleted.
Alert ID	Alert identifier number associated with this event.