Table Of Contents

Events Processed

Events Processed

---

Table D-1 lists all possible events you might see in an Alerts and Activities Detail page, along with the following:

•Description: A summary of the event, including typical causes (if known).

•Trigger: How IP Telephony Monitor (ITM) learns of the event — either from normal polling, a threshold that was exceeded, or a trap that was received.

•Severity: The severity that ITM assigns to the event—critical, warning, or informational.

•Device Type: The devices, as classified in ITM, on which the event can occur.

•Event Code: The code used by Notification Services to track changes to default ITM event names using the Notification Customization feature. (For more information, see the "Customizing the Names of ITM Events" section.) This feature is available only if you have downloaded and installed Incremental Device Update (IDU) 4 or later from the ITM download site: http://www.cisco.com/pcgi-bin/tablebuild.pl/item-3des.

Event names correspond to what is displayed in the Description column of the Alerts and Activities Detail page. The only exception is the SuspectPhoneDetected event, which is shown only in Fault History displays. (A suspect phone is a phone that cannot register to a Cisco CallManager.)

The events a device can report are determined by the device function. The Function field in Polling and Thresholds corresponds to the Device column of the Alerts and Activities Detail page. For information on which threshold categories apply to which device function (or device type), see Table 17-7. To determine which threshold triggers which event, see Table 17-8.

Table D-1 Events that ITM Supports 

Event	Description, Cause, Severity and Event Code1
ApplicationDown	Description: Application can run but is not, due to some problem in the application or device. Trigger: Polling. Severity: Critical. Device Type: Media Server or Integrated Communication System (ICS). Event Code: 2001.
ApplicationPartiallyRunning	Description: The application can run but is waiting, due to some problem in the application or device (for example, lack of CPU resources). Trigger: Polling. Severity: Warning. Device Type: Media Server or ICS. Event Code: 2002.
BackupActivated	Description: Backup port or interface has come online, indicating that the port or interface it backs up has gone down. Trigger: Polling. Severity: Warning. Device Type: Host, Hub, Router, Optical Switch, or Switch. Event Code: 1000.
BatteryDisconnected	Description: Remote Insight Board (RIB) battery is disconnected. Trigger: Polling. Severity: Warning. Device Type: Media Server. Event Code: 2003.
BatteryFailed	Description: RIB battery failed. Trigger: Polling. Severity: Critical. Device Type: Media Server. Event Code: 2004.
BatteryLow	Description: RIB battery is low. Trigger: Exceeded Battery percent charged threshold. Severity: Critical. Device Type: Media Server. Event Code: 2005.
CallManagerDown	Description: Cisco CallManager application is not running due to some problem in the application or device. Trigger: Polling. Severity: Critical. Device Type: Media Server or ICS. Event Code: 2006.
CallManagerPartiallyRunning	Description: Cisco CallManager can run but is waiting due to some problem in the application or device (for example, lack of CPU resources). Trigger: Polling. Severity: Warning. Device Type: Media Server or ICS. Event Code: 2007.
CardDown	Description: Voice card is down. Trigger: Processed trap (See the "Processed SNMP Traps" section). Severity: Critical. Device Type: Voice Gateway. Event Code: 2008. Also see OperationallyDown.
CCMHttpServiceDown	Description: HTTP service cannot be used to communicate to all Cisco CallManagers in the cluster. Might be due to the following: •The web service of all of the CCMs in the cluster is down. •The credentials (username, password) for at least one of the running web services were not found or are incorrect. Trigger: Polling. Severity: Critical. Device Type: Cisco CallManager or Cluster. Event Code: 2009.
CCMHttpServiceInaccessible2	Description: Several successive attempts to contact a Cisco CallManager cluster have been unsuccessful. Might be due to the following: •Excessive number of requests on the Cisco CallManager. •Heavy load on the CPU or Cisco CallManager. Trigger: Polling. (See the "Determining when to Issue a CCMHttpServiceInaccessible Event" section.) Severity: Critical. Device Type: Cisco CallManager or Cluster. Event Code: 2010.
ConfidenceTestFailed	Description: Individual confidence test failed on an application. Trigger: Polling. Severity: Critical. Device Type: Media Server. Event Code: 2011.
ConfidenceTestsNotRun	Description: Confidence test has not been run for over 10 minutes. Might be due to low CPU resources on server. Trigger: Event sent by STServer. (Appears in the Unidentified Trap bucket, as described in the "Other Unidentified Traps and Events" section.) Severity: Informational. Event Code: 2012.
DPAPortCallManager LinkDown	Description: No connectivity between the DPA port and the Cisco CallManager. Trigger: Polling. Severity: Critical. Device Type: Voice Mail Gateway. Event Code: 2013.
DPAPortTelephonyLinkDown	Description: No connectivity between the DPA port and the Octel voice mail. Trigger: Polling. Severity: Critical. Device Type: Voice Mail Gateway. Event Code: 2014.
Duplicate	Description: Same IP address is configured on multiple managed systems. Trigger: Polling (often during rediscovery). Severity: Critical. Device Type: Host, Hub, Router, Optical Switch, or Switch. Event Code: 1001.
ExceededMaximumUptime	Description: A backup or dial-on-demand port or interface has been in the Up state for too long. Trigger: Exceeded Maximum uptime threshold. Severity: Warning. Device Type: Router, Optical Switch, or Switch. Event Code: 1002.
ExcessiveFragmentation	Description: System memory is highly fragmented. Trigger: Exceeded Memory fragmentation threshold. Severity: Critical. Device Type: Host, Router, Switch, or Optical Switch. Event Code: 1003.
ExtensionNumberRemoved3	Description: Phone extension number was removed from Cisco CallManager configuration. Trigger: Polling. Severity: Warning. Event Code: Not Applicable.
FanDegraded	Description: Fan condition is Degraded. Trigger: Polling, or processed trap (see the "Processed SNMP Traps" section). Severity: Warning. Device Type: Media Server or Voice Gateway. Event Code: 2015.
FanDown	Description: Fan condition is Down. Trigger: Processed trap (see the "Processed SNMP Traps" section). Severity: Critical. Device Type: Media Server, ICS, or Voice Gateway. Event Code: 2016.
Flapping	Description: Port or interface is repeatedly alternating between Up and Down states over a short period of time. ITM issues this event by monitoring the number of link downs received within the link window for a particular network adapter (using the Link threshold and Link Window parameters). Trigger: Exceeded Link trap threshold for Link trap window; or processed trap (see the "Processed SNMP Traps" section). Severity: Critical. Device Type: Host, Hub, Router, Optical Switch, or Switch. Event Code: 1004.
GatekeeperLostContact WithCluster	Description: Voice gatekeeper lost registration with a Cisco CallManager cluster. Trigger: Polling. Severity: Critical. Device Type: Gatekeeper. Event Code: 2017.
GatewayLostContact WithCluster	Description: Voice gateway lost registration with a Cisco CallManager cluster. Trigger: Polling. Severity: Critical. Device Type: Digital Voice Gateway or Voice Gateway. Event Code: 2018.
HighBackplaneUtilization	Description: Utilization of the backplane's bandwidth exceeds the Backplane utilization threshold. Trigger: Exceeded Backplane utilization threshold. Severity: Critical. Device Type: Host, Router, Switch, or Optical Switch. Event Code: 1005.
HighBroadcastRate	Description: Input packet broadcast percentage exceeds the Broadcast threshold. The input packet broadcast percentage calculates the percentage of total capacity that was used to receive broadcast packets. Trigger: Exceeded Broadcast threshold. Severity: Critical. Device Type: Host, Router, Switch, or Optical Switch. Event Code: 1006.
HighBufferMissRate	Description: Rate of buffer misses exceeds the Memory buffer miss threshold. Trigger: Exceeded Memory buffer miss threshold. Severity: Critical. Device Type: Host, Router, Switch or Optical Switch. Event Code: 1007.
HighBufferUtilization	Description: Number of buffers used exceeds the Memory buffer utilization threshold. Trigger: Exceeded Memory buffer utilization threshold. Severity: Critical. Device Type: Host, Router, Switch, or Optical Switch. Event Code: 1008.
HighCollisionRate	Description: Rate of collisions exceeds the Collision threshold. Trigger: Exceeded Collision threshold. Severity: Critical. Device Type: Host, Hub, Router, Switch, or Optical Switch. Event Code: 1009.
HighDiscardRate	Description: A HighDiscardRate event occurs when: •The input packet queued rate is greater than the minimum packet rate, and the input packet discard percentage is greater than the Discard threshold. The input packet queued rate is the rate of packets received without error. The input packet discard percentage is calculated by dividing the rate of input packets discarded by the rate of packets received. •The output packet queued rate is greater than the minimum packet rate, and the output packet discard percentage is greater than the Discard threshold. The output packet queued rate is the rate of packets sent without error. The output packet discard percentage is calculated by dividing the rate of output packets discarded by the rate of packets sent. Trigger: Exceeded Discard threshold. Severity: Critical. Device Type: Host, Hub, Router, Switch, or Optical Switch. Event Code: 1010.
HighErrorRate	Description: A HighErrorRate event occurs for input or output packets when both of the following thresholds are exceeded: •Error threshold—Percentage of packets in error •Error traffic threshold4 —Percentage of bandwidth in use Trigger: Exceeded Error threshold and equaled or exceeded Error traffic threshold Severity: Critical. Device Type: Host, Hub, Router, Switch, or Optical Switch. Event Code: 1011.
HighProcessorUtilization	Description: Processor utilization exceeds a processor utilization threshold. (Processor utilization threshold defines the upper limit for CPU utilization and is expressed as a percentage of total CPU capacity.) Trigger: Exceeded one of these thresholds: •VG248 processor utilization (Voice Gateway) •Processor utilization (Media Server, Voice Mail Gateway) Severity: Critical. Device Type: Media Server, Voice Gateway, or Voice Mail Gateway. Event Code: 2019. Also see HighUtilization.
HighQueueDropRate	Description: Number of packets discarded due to input or output queue overflow exceeded the Queue drop threshold. The input (or output) queue overflow is derived by dividing the number of packets designated to be sent (or received) that were discarded due to queue overflow, by the total number of packets in the queue. Trigger: Exceeded Queue drop threshold. Severity: Critical. Device Type: Host, Hub, Router, Switch, or Optical Switch. Event Code: 1012.
HighUtilization	Description: Current utilization exceeds the utilization threshold configured for this network adapter. (Processor utilization threshold defines the upper limit for CPU utilization and is expressed as a percentage of total CPU capacity.) Trigger: Exceeded one of these thresholds: •Processor utilization •Utilization (interface settings) Severity: Critical. Device Type: Host, Router, Switch, Optical Switch, ICS, or Voice Gateway. Event Code: 1013. Also see HighProcessorUtilization.
InformAlarm	Description: An information pass-through trap was generated. Trigger: Pass-through trap. See the "Pass-Through SNMP Unidentified Traps" section. Severity: Informational. Event Code: 1014.
InsufficientFreeHardDisk	Description: Free disk space is low. Trigger: Exceeded Free hard disk threshold. Severity: Critical. Event Code: 2020. Device Type: ICS or Media Server. Also see InsufficientFreeMemory, InsufficientFreePhysicalMemory, InsufficientFreeVirtualMemory.
InsufficientFreeMemory	Description: System is running out of memory resources. Also reported if there has been a failure to allocate a buffer due to lack of memory. Trigger: Exceeded Free memory threshold. Severity: Critical. Device Type: Host, Router, Switch, or Optical Switch. Event Code: 1015. Also see InsufficientFreeHardDisk, InsufficientFreePhysicalMemory, InsufficientFreeVirtualMemory.
InsufficientFree PhysicalMemory	Description: System is running out of physical memory resources. Trigger: Exceeded one of these thresholds: •VG248 free physical memory •Free physical memory Severity: Critical. Device Type: ICS, Media Server, or Voice Gateway. Event Code: 2021. Also see InsufficientFreeHardDisk, InsufficientFreeMemory, InsufficientFreeVirtualMemory.
InsufficientFree VirtualMemory	Description: System is running out of virtual memory resources. Trigger: Exceeded Free virtual memory threshold. Severity: Critical. Event Code: 2022. Device Type: ICS or Media Server. Also see InsufficientFreeHardDisk, InsufficientFreeMemory, InsufficientFreePhysicalMemory.
InterfaceOperationallyDown	Description: Interface is nonoperational. Trigger: Polling. Severity: Critical. Device Type: Digital Voice Gateway, Media Server, or Voice Gateway. Event Code: 2023. Also see OperationallyDown.
MajorAlarm	Description: Critical pass-through trap was generated. Trigger: Pass-through trap. See the "Pass-Through SNMP Unidentified Traps" section. Severity: Informational. Event Code: 1016.
MinorAlarm	Description: Significant pass-through trap was generated. Trigger: Pass-through trap. See the "Pass-Through SNMP Unidentified Traps" section. Severity: Informational. Event Code: 1017.
MonitoredPhoneLostContactWithCluster3	Description: Monitored phone lost contact with all Cisco CallManagers in the cluster. Trigger: Polling. Severity: Critical. Event Code: Not Applicable.
MWIOnTimeExceeded	Description: MWIOnTime value exceeded the threshold. Trigger: Exceeded MWI on time threshold. Severity: Warning. Device Type: ICS or Media Server. Event Code: 2024.
OperationallyDown	Description: Interface—Card or network adapter's operational state is not normal. System Hardware—Disk's operational state is not normal. Trigger: Polling, or processed trap (see the "Processed SNMP Traps" section). Note For interfaces, ITM will only generate an OperationallyDown clear event if the card is reinserted into the same slot, and if the module index is the same before and after the card is reinserted. Severity: Critical. Device Type: Host, Hub, Router, Switch, or Optical Switch. Event Code: 1018. Also see CardDown, InterfaceOperationallyDown.
OutofRange	Description: Device temperature or voltage is outside the normal operating range. When an OutofRange event is generated, you will normally also see fan, power supply, or temperature events. Trigger: Exceeded one of these thresholds: •Relative temperature threshold •Relative voltage threshold Severity: Critical. Device Type: Host, Router, Switch, or Optical Switch. Event Code: 1019.
PhoneDiscoveryError3	Description: ITM cannot probe the IP phone. Possible causes are: •Request to the SNMP agent timed out. This can happen for any of the following reasons: –IP phone is busy –Link to the system is too slow –Read community string for the agent is incorrect –IP phone does not support SNMP. •ITM received an initial SNMP response, but the probe did not successfully complete. •SNMP agent has an improper MIB implementation, which triggers SNMP requests to loop over a table. Trigger: Polling (normally during rediscovery). Severity: Critical. Event Code: Not Applicable.
PhoneReachabilityTestFailed5	Description: ITM cannot reach an IP phone. The IP phone has not responded to three or more successive pings from ITM or the IP SLA device. Trigger: Polling. Severity: Critical. Device Type: IP Phone. Event Code: 9002
PhoneRemoved	Description: IP phone lost network connection to the switch. Trigger: Polling (normally during rediscovery). Severity: Warning. Device Type: Phone Access Switch or Voice Gateway. Event Code: 2025.
PowerSupplyDegraded	Description: Power supply state is Degraded. Trigger: Polling. Severity: Warning. Device Type: Media Server or Voice Gateway. Event Code: 2026.
PowerSupplyDown	Description: Power supply state is Down. Trigger: Trap. Severity: Critical. Device Type: ICS, Media Server, or Voice Gateway. Event Code: 2027.
RepeatedRestarts	Description: System repeatedly restarts over a short period of time. ITM issues this event by monitoring the number of system cold and warm starts received within the restart window (using the Restart threshold and the RestartWindow parameters). Trigger: Exceeded Restart trap threshold for Restart trap window; or processed trap (see the "Processed SNMP Traps" section). Severity: Critical. Device Type: Host, Hub, Router, Switch, or Optical Switch. Event Code: 1020.
StateNotNormal	Description: A fan, power supply, temperature sensor, or voltage sensor is not acting normally. When an OutofRange event is generated, you will also see a fan, power supply, or temperature event. Trigger: Polling. Severity: Critical. Device Type: Host, Hub, Router, Switch, or Optical Switch. Event Code: 1021.
SRSTEntered 5	Description: An IP telephony router is functioning in Survivable Remote Site Telephony (SRST) mode, performing call management for phones in place of the central Cisco CallManager. The event is generated when a WAN link is down, preventing IP phone TCP keepalive messages from reaching the Cisco CallManager. Trigger: Polling (see also Table 8-1). Severity: Critical. Device Type: Router, Switch, or Optical Switch. Event Code: 9000
SRSTSuspected5	Description: IP Phone Information Facility reports that all phones associated with the SRST router are unregistered, but the WAN link between phones and the central Cisco CallManager is up. Trigger: Polling. Severity: Warning. Device Type: Router, Switch, or Optical Switch. Event Code: 9001
SuspectPhoneDetected	Description: Phone failed to register with the Cisco CallManager. Normally due to configuration error, exceeding the limit of maximum number of phones, or loss of contact. Note This event is displayed only when using Fault History. It is not displayed in the Alerts and Activities display. Trigger: Polling. Severity: Informational. Device Type: Media Server. Event Code: 2028.
TemperatureHigh	Description: Operating temperature exceeds the threshold. Trigger: Exceeded Temperature threshold. Severity: Critical. Device Type: Media Server. Event Code: 2029. Also see OutofRange.
TemperatureSensorDegraded	Description: Temperature sensor reports abnormal temperature measurements and reports its condition as Degraded. Trigger: Polling, or processed trap (see the "Processed SNMP Traps" section). Severity: Warning. Device Type: Media Server or Voice Gateway. Event Code: 2030.
TemperatureSensorDown	Description: Temperature sensor reports abnormal temperature measurements and reports its condition as Failed. Trigger: Processed trap (see the "Processed SNMP Traps" section). Severity: Critical. Device Type: Media Server or Voice Gateway. Event Code: 2031.
TooManyFailed ConfidenceTests	Description: Numerous confidence tests have failed. Trigger: Exceeded Confidence test tolerance threshold. Severity: Critical. Device Type: ICS or Media Server. Event Code: 2032.
TooManyInactivePhones	Description: Number of inactive phones exceeds the Inactive phone threshold. (Inactive phone threshold is expressed as a percentage of the total number of phones connected to a Cisco CallManager cluster.) Trigger: Exceeded Inactive phone threshold. Severity: Critical. Device Type: Voice Gateway. Event Code: 2033.
Unresponsive	Description: Device does not respond to ICMP or SNMP requests. Probable causes are: •On a system: ICMP Ping requests and SNMP queries to the device timeout received no response. •On an SNMP Agent: Device ICMP ping requests are successful, but SNMP requests time out with no response. Note A system might also be reported as Unresponsive if the only link (for example, an interface) to the system goes down. Trigger: Polling. Severity: Critical. Device Type: Host, Hub, Router, Switch, Optical Switch, ICS, Media Server, Phone Access Switch, Voice Mail Gateway, or Voice Gateway. Event Code: 1022.
VoiceCardLostContact WithCluster	Description: Voice card lost registration with a Cisco CallManager cluster. Trigger: Polling. Severity: Critical. Device Type: Voice Gateway. Event Code: 2034.
VoiceInterfaceLostContact WithCluster	Description: Voice interface lost registration with a Cisco CallManager cluster. Trigger: Polling. Severity: Critical. Device Type: Voice Gateway. Event Code: 2035.
VoicePortLostContact WithCluster	Description: Voice port lost registration with a Cisco CallManager cluster. Trigger: Polling. Severity: Critical. Device Type: Voice Gateway or Voice Mail Gateway. Event Code: 2036.
VoicePortOperationallyDown	Description: Voice port's operational state is not normal. Cause: Polling. Severity: Critical. Device Type: Voice Gateway. Event Code: 2037.

1 Event Codes are used by Notification Customization, which is available only if you have downloaded and installed Incremental Device Update (IDU) 4 or later from the ITM download site: http://www.cisco.com/pcgi-bin/tablebuild.pl/item-3des. 2 CCMHttpServiceInaccessible event occurs only if you have downloaded and installed Incremental Device Update (IDU) 2 or later from the ITM download site: http://www.cisco.com/pcgi-bin/tablebuild.pl/item-3des. 3 The following events occur if you have not installed IDU 2 or later: ExtensionNumberRemoved, MonitoredPhoneLostContactWithCluster, and PhoneDiscoveryError. 4 If you have not installed IDU 2 or later, HighErrorRate event occurs when Error traffic threshold alone is exceeded. 5 The following events occur if you have installed IDU 2 or later: CCMHttpServiceInaccessible, PhoneReachabilityTestFailed, SRSTEntered, SRSTSuspected.