Table Of Contents

Using Fault History

Getting Started with Fault History

Starting Fault History

Starting Fault History from the Alerts and Activities Display

Generating a 24-Hour Report on All Alerts in the Current View

Generating a 24-Hour Report on All Events on a Device Component

Starting Fault History from the CiscoWorks Navigation Tree

Getting All Stored Information on an Alert

Getting All Stored Fault History on an Event

Understanding the Fault History: Alerts and Activities Display

Understanding the Fault History: Events Display

Using Fault History

---

These topics explain how to use IP Telephony Monitor (ITM) Fault History:

•Getting Started with Fault History

•Starting Fault History

•Understanding the Fault History: Alerts and Activities Display

•Understanding the Fault History: Events Display

Getting Started with Fault History

Fault History allows you to store and view the history of ITM events and alerts from the past 31 days. The stored history includes alert information and annotations (informational text that you enter), and event information and properties (for example, the values of MIB attributes at the time of the event, polling and threshold information, and utilization information). For an example of what kind of information Fault History displays, see Figure 10-1 and Figure 10-3.

You can also customize the names of events displayed by Fault History (and the Alerts and Activities display) using the Notification Customization feature in Notification Services. (This feature is available if you have downloaded and installed Incremental Device Update (IDU) 4 from the ITM download site: http://www.cisco.com/pcgi-bin/tablebuild.pl/item-3des.) For more information, refer to the "Customizing the Names of ITM Events" section.

You can start Fault History in one of two ways:

•To generate contextual 24-hour reports, start Fault History from the Alerts and Activities display. See the "Starting Fault History from the Alerts and Activities Display" section.

•To generate reports on all saved information in the Fault History database, start Fault History by selecting IP Telephony Monitor > Fault History. See the "Starting Fault History from the CiscoWorks Navigation Tree" section.

If Fault History finds more than 2,000 records while generating a report, a popup window tells you the total number of records found. The Fault History displays can show up to 2,000 records as a table you can scroll or page through. If your report exceeds 2,000 records and you want to view all of them, you can use the Export tool button to save all of the information to a CSV or PDF file.

You can use Fault History to generate customized tabular displays of specific alerts, specific events, event dates, event severity, and so forth. You might want to generate a Fault History report when:

•A significant alert is shown in the Alerts and Activities display, and you want to see how often the alert has been generated in the last month.

•You receive an e-mail notification that an unusual event has occurred.

•You want to search for information on events and alerts other than those you are tracking in your customized Alerts and Activities display.

---

Note Although the SuspectPhoneDetected event (for IP phones) is not shown in the Alerts and Activities display, ITM preserves its alert information in the Fault History database, where you can view it. (A suspect phone is a phone that cannot register to a Cisco CallManager.)

---

The Fault History database is stored at NMSROOT\databases\itemFH\itemFH.db. The database stores a maximum of 31 days of data and is purged according to the ITM database purging schedule (see the "Configuring the Daily Purging Schedule" section.)

Starting Fault History

ITM provides two starting points from which you can generate Fault History reports:

•To create a context-sensitive 24-hour report, use Fault History from the Alerts and Activities display. See "Starting Fault History from the Alerts and Activities Display" section.

•To create filtered reports using all of the stored information in the Fault History database, use the CiscoWorks navigation tree. See "Starting Fault History from the CiscoWorks Navigation Tree" section.

Starting Fault History from the Alerts and Activities Display

Start Fault History from the Alerts and Activities display to create a 24-hour report on:

•All alerts in your current view, as described in the "Generating a 24-Hour Report on All Alerts in the Current View" section.

•All events on a specific device component, as described in the "Generating a 24-Hour Report on All Events on a Device Component" section.

Generating a 24-Hour Report on All Alerts in the Current View

To create a report on all the alerts that have occurred in your current view in the past 24 hours, start Fault History from the window tools area in the Alerts and Activities display. (See Figure 3-1.)

---

Step 1 Select IP Telephony Monitor > Alerts and Activities. The Alerts and Activities display appears.

Step 2 Select a view from the view object selector. (See Figure 3-1.)

Step 3 Launch Fault History from the window tools area to open a 24-hour Fault History tabular display of information about all alerts on all devices in the most recently accessed view.

Step 4 If Fault History finds more than 2,000 records, a pop-up window reports the total number of records found.

The Fault History: Alerts and Activities display appears. The "Understanding the Fault History: Alerts and Activities Display" section describes the report contents.

Step 5 To see if any user annotations are associated with a specific alert, click the appropriate alert ID. If a user has entered an annotation for this alert, the alert annotations page appears, as shown in Figure 10-2. (Annotations are entered from the Alerts and Activities Detail page. See the "Starting the Alerts and Activities Detail Page" section for more information on annotations.)

---

If Fault History finds more than 2,000 records based on your search criteria, you can view all of the reports by clicking the Export button (in the upper-right corner of the display) and saving your report to a PDF or CSV file.

Generating a 24-Hour Report on All Events on a Device Component

To create a report on all events that have occurred on a specific device component in the past 24 hours, use the Fault History tool in the Alerts and Activities Detail display.

---

Step 1 Select IP Telephony Monitor > Alerts and Activities. The Alerts and Activities display appears.

Step 2 Click an alert ID. The Alerts and Activities Detail display appears.

Locate the device component in which you are interested, and select Fault History from the list in the Tools column (see Figure 3-8 for an example). If Fault History finds more than 2,000 records, a pop-up window reports the total number of records found.

The Fault History: Events display appears. The "Understanding the Fault History: Events Display" section describes the display contents.

Step 3 If you want to view more details about the event, such as the value of MIB attributes at the time of the event, click the appropriate event ID. The event properties page appears (see Figure 10-4).

---

If Fault History found more than 2,000 records based on your search criteria, you can view all of the reports found by clicking the Export button (in the upper-right corner of the display) and saving your report to a PDF or CSV file.

Starting Fault History from the CiscoWorks Navigation Tree

To gather historical information on alerts and events in the past 31 days, start Fault History from the CiscoWorks navigation tree by selecting IP Telephony Monitor > Fault History. The following topics explain how you can apply filters and generate reports based on all of the saved information in the Fault History database:

•To search for alerts by alert ID, device, or group, see the "Getting All Stored Information on an Alert" section.

•To search for events by event ID, device, alert ID, or group, see the "Getting All Stored Fault History on an Event" section.

Getting All Stored Information on an Alert

Fault History provides the following methods for searching for alerts that are in the saved Fault History database:

•Searching for Alerts by Alert ID

•Searching for Alerts by Device

•Searching for Alerts by Group

Searching for Alerts by Alert ID

To determine how often a specific alert has occurred, search for the alert by its alert ID. The alert ID is displayed in the Alerts and Activities display.

---

Step 1 Select IP Telephony Monitor > Fault History > Alert Filtering > Search By Alert ID. The Alert Filtering: Search by Alert ID page appears.

Step 2 Set your filtering criteria:

a. Enter the alert ID.

b. Activate all alert severity levels for which you want to search.

c. Enter the date, selecting either Current Date, One Month, or Range. (The Current Date and One Month fields are read-only and cannot be changed.)

Step 3 Click View. If Fault History finds more than 2,000 records, a pop-up window reports the total number of records found.

The Fault History: Alerts and Activities display appears. (See "Understanding the Fault History: Alerts and Activities Display" section for an explanation of the display contents.)

Step 4 To see if any user annotations are associated with a specific alert, click the appropriate alert ID. If a user has entered an annotation for this alert, the alert annotations page appears, as shown in Figure 10-2. (Annotations are entered from the Alerts and Activities Detail page. See the "Starting the Alerts and Activities Detail Page" section for more information on annotations.)

---

If Fault History finds more than 2,000 records based on your search criteria, you can view them by clicking the Export button (in the upper-right corner of the display) and saving your report to a PDF or CSV file.

Searching for Alerts by Device

Use this procedure to determine what types of alerts are occurring on a specific device.

---

Step 1 Select IP Telephony Monitor > Fault History > Alert Filtering > Search By Device. The Alert Filtering: Search by Device page appears.

Step 2 Set your filtering criteria:

a. Enter a comma-separated list of devices (as they are listed by Device Management).

---

Note To search for a phone, enter the MAC address instead of the IP address.

---

b. Activate all alert severity levels for which you want to search.

c. Enter the date, selecting either Current Date, One Month, or Range. (The Current Date and One Month fields are read-only and cannot be changed.)

Step 3 Click View. If Fault History finds more than 2,000 records, a pop-up window reports the total records found.

The Fault History: Alerts and Activities display appears. (See "Understanding the Fault History: Alerts and Activities Display" section for an explanation of the display contents.)

Step 4 To see if any user annotations are associated with a specific alert, click the appropriate alert ID. If a user has entered an annotation for this alert, the alert annotations page appears, as shown in Figure 10-2. (Annotations are entered from the Alerts and Activities Detail page. See the "Starting the Alerts and Activities Detail Page" section for more information on annotations.)

---

If Fault History found more than 2,000 records based on your search criteria, you can view all of the reports found by clicking the Export button (in the upper-right corner of the display) and save your report to a PDF or CSV file.

Searching for Alerts by Group

To determine what kind of alerts are occurring in a specific group, use this procedure.

---

Step 1 Select IP Telephony Monitor > Fault History > Alert Filtering > Search By Group. The Alert Filtering: Search by Group page appears.

Step 2 Set your filtering criteria:

a. Sect the device group. You can select multiple devices from different groups.

b. Activate all alert severity levels for which you want to search.

c. Enter the date, selecting either Current Date, One Month, or Range. (The Current Date and One Month fields are read-only and cannot be changed.)

Step 3 Click View. If Fault History finds more than 2,000 records, a pop-up window reports the total records found.

The Fault History: Alerts and Activities display appears. (See "Understanding the Fault History: Alerts and Activities Display" section for an explanation of the display contents.)

Step 4 To see if any user annotations are associated with a specific alert, click the appropriate alert ID. If a user has entered an annotation for this alert, the alert annotations page appears, as shown in Figure 10-2. (Annotations are entered from the Alerts and Activities Detail page. See the "Starting the Alerts and Activities Detail Page" section for more information on annotations.)

---

If Fault History found more than 2,000 records based on your search criteria, you can view all of the reports found by clicking the Export button (in the upper-right corner of the display) and save your report to a PDF or CSV file.

Getting All Stored Fault History on an Event

Fault History provides the following methods for searching for alerts that are in the saved Fault History database:

•Searching for Events by Event ID

•Searching for Events by Device

•Searching for Events by Alert ID

•Searching for Events by Group

If you have downloaded and installed Incremental Device Update (IDU) 4, you can customize the event names used by ITM.

Searching for Events by Event ID

To determine how often a specific event has occurred, search for the event by its event ID. The event ID is displayed on the Alerts and Activities Detail display.

Remember that an event ID is not the same thing as the event codes provided by Notification Services in IDU 4. For more information, refer to the "Customizing the Names of ITM Events" section.

---

Step 1 Select IP Telephony Monitor > Fault History > Event Filtering > Search By Event ID. The Event Filtering: Search by Event ID page appears.

Step 2 Set your filtering criteria:

a. Enter the event ID.

b. Enter the date, selecting either Current Date, One Month, or Range. (The Current Date and One Month fields are read-only and cannot be changed.)

Step 3 Click View. If Fault History finds more than 2,000 records, a pop-up window reports the total records found.

The Fault History: Events display appears. (See "Understanding the Fault History: Events Display" section for an explanation of the display contents.)

Step 4 If you want to view more information about an event, such as the value of MIB attributes at the time of the event, click the appropriate event ID. The event properties page appears (see Figure 10-4).

---

If Fault History found more than 2,000 records based on your search criteria, you can view all of the reports found by clicking the Export button (in the upper-right corner of the display) and save your report to a PDF or CSV file.

Searching for Events by Device

Use this procedure to determine what types of events are occurring on a specific device.

---

Step 1 Select IP Telephony Monitor > Fault History > Event Filtering > Search By Device. The Event Filtering: Search by Device page appears.

Step 2 Set your filtering criteria:

a. Enter a comma-separated list of devices (as they are listed by Device Management). You can select multiple devices from different groups.

---

Note To search for a phone, enter the MAC address instead of the IP address.

---

b. Enter the event description by clicking the popup selector box and activating the events for which you want to search. By default, all events are selected.

c. Enter the date, selecting either Current Date, One Month, or Range. (The Current Date and One Month fields are read-only and cannot be changed.)

Step 3 Click View. If Fault History finds more than 2,000 records, a pop-up window reports the total records found.

The Fault History: Events display appears. (See "Understanding the Fault History: Events Display" section for an explanation of the display contents.)

Step 4 If you want to view more information about an event, such as the value of MIB attributes at the time of the event, click the appropriate event ID. The event properties page appears (see Figure 10-4).

---

If Fault History found more than 2,000 records based on your search criteria, you can view all of the reports found by clicking the Export button (in the upper-right corner of the display) and save your report to a PDF or CSV file.

Searching for Events by Alert ID

To view the events that correspond to a specific alert, use this procedure.

---

Step 1 Select IP Telephony Monitor > Fault History > Event Filtering > Search By Alert ID. The Event Filtering: Search by Alert ID page appears.

Step 2 Set your filtering criteria:

a. Enter the Alert ID.

b. (Optional) Enter the event description by clicking the popup selector box and activating the events for which you want to search.

c. Enter the date, selecting either Current Date, One Month, or Range. (The Current Date and One Month fields are read-only and cannot be changed.)

Step 3 Click View. If Fault History finds more than 2,000 records, a pop-up window reports the total records found.

The Fault History: Events display appears. (See "Understanding the Fault History: Events Display" section for an explanation of the display contents.)

Step 4 If you want to view more information about an event, such as the value of MIB attributes at the time of the event, click the appropriate event ID. The event properties page appears (see Figure 10-4).

---

If Fault History found more than 2,000 records based on your search criteria, you can view all of the reports found by clicking the Export button (in the upper-right corner of the display) and save your report to a PDF or CSV file.

Searching for Events by Group

To determine what types of events are occurring in a specific group, use this procedure.

---

Step 1 Select IP Telephony Monitor > Fault History > Alert Filtering > Search By Group. The Event Filtering: Search by Group page appears.

Step 2 Set your filtering criteria:

a. Enter the group.

b. Enter the event description by clicking the popup selector box and activating the events for which you want to search.

c. Enter the date, selecting either Current Date, One Month, or Range. (The Current Date and One Month fields are read-only and cannot be changed.)

Step 3 Click View. If Fault History finds more than 2,000 records, a pop-up window reports the total records found.

The Fault History: Events display appears. (See "Understanding the Fault History: Events Display" section for an explanation of the display contents.)

Step 4 If you want to view more information about an event, such as the value of MIB attributes at the time of the event, click the appropriate event ID. The event properties page appears (see Figure 10-4).

---

If Fault History found more than 2,000 records based on your search criteria, you can view all of the reports found by clicking the Export button (in the upper-right corner of the display) and save your report to a PDF or CSV file.

Understanding the Fault History: Alerts and Activities Display

The Fault History: Alerts and Activities display is shown in Figure 10-1. You can generate this display as described in these sections:

•Generating a 24-Hour Report on All Alerts in the Current View

•Getting All Stored Information on an Alert

The tabular display is a scrollable table that lists up to 2,000 records, based on your filtering criteria. If you want to view database contents beyond the 2,000 records, click the Export tool button in the upper-right corner.

Figure 10-1 Fault History: Alerts and Activities Display

The Fault History: Alerts and Activities display provides two tools, as shown in Table 10-1.

Table 10-1 Fault History: Alerts and Activities Display—Window Tools Buttons

Icon	Meaning	Described in...
	Exports all records found by Fault History to a PDF or CSV file.	Exporting Data from Tabular Displays
	Opens a printer-friendly version for printing (maximum of 2,000 records)	Printing Tabular Displays

Table 10-2 describes the contents of the Fault History: Alerts and Activities tabular display.

Table 10-2 Fault History: Alerts and Activities
Tabular Display—Contents 

Heading	Description
Alert ID	Alert identifier number. Clicking this link opens the Fault History: Events display (see Figure 10-3), which contains details about the events associated with the alert.
Device Name	Device name or IP address.
Device	Device type. Learning indicates that ITM was discovering the device at the time of the alert. The actual device type is reflected when new events occur. For more information, see "Using Device Management."
Description	Alert category, one of the following: Application, Connectivity, Environment, Interface, Other, Reachability, System Hardware, Utilization. For alerts containing multiple events, the tabular display shows the category of the event with the most recent change. For alerts containing multiple events, the display shows the category of the event with the most recent change.
Severity	Critical, Warning, or Informational.
Time	Date and time when the alert was generated.
Status	Alert status, based on last polling.
	Active	Alert is live.
	Cleared	Alert is no longer live. Also, when a device is suspended, all alerts are cleared. When ITM polling determines that the alarm has been in the Cleared state for 30 minutes or more (from the time of polling), the alarm expires and is removed from the Alerts and Activities display.
	Acknowledged	Alert was manually recognized by a user (from Alerts and Activities Detail display).

Figure 10-2 shows an alert annotation page, which lists any information users have entered using the Alerts and Activities Detail page. For more information, see the "Starting the Alerts and Activities Detail Page" section.

Figure 10-2 Alert Annotation Page

Understanding the Fault History: Events Display

The Fault History: Events display is shown in Figure 10-3. This display is generated as described in these sections:

•Generating a 24-Hour Report on All Events on a Device Component

•Getting All Stored Fault History on an Event

The tabular display is a scrollable table that lists up to 2,000 records, based on your filtering criteria. If you want to view database contents beyond the 2,000 records, click the Export tool button in the upper-right corner.

Figure 10-3 Fault History: Events Display

The Fault History: Events display provides two tools, described in Table 10-3.

Table 10-3 Fault History: Events Display—Window Tools Buttons

Icon	Meaning	Described in...
	Exports the current tabular display to a PDF file.	Exporting Data from Tabular Displays
	Opens a printer-friendly version for printing.	Printing Tabular Displays

Table 10-4 describes the contents of the Fault History: Events tabular display.

Table 10-4 Fault History: Events Tabular Display—Contents 

Heading	Description
Event ID	Event identifier number. Clicking this link opens the event properties page (see Figure 10-4), which describes the value of MIB attributes at the time of the event.
Device Name	Device name or IP address.
Component	Device element on which the event occurred.
Description	ITM event name (as described in "Events Processed"). You can also customize the names of events displayed by Fault History (and the Alerts and Activities display) using the Notification Customization feature in Notification Services (provided in IDU 4). For more information, refer to the "Customizing the Names of ITM Events" section.
Time	Date and time when the event was generated.
Status	Event status, based on last polling.
	Active	Event is live.
	Cleared	Event is no longer live. Also, when a device is suspended, all alerts are cleared. When ITM polling determines that an alarm has been in the Cleared state for 30 minutes or more (from the time of polling), the alarm expires and is removed from the Alerts and Activities display.
	Suspended	Device is suspended.
	Resumed	Device is being resumed.
	Deleted	Device has been deleted.
Alert ID	Alert identifier number associated with this event.

Figure 10-4 shows the event properties page, which lists more information about an event; for example, the value of MIB attributes at the time of the event, polling and threshold information, and utilization information.

Figure 10-4 Event Properties Page