Real-Time Monitoring Tool Administration Guide for Cisco Unity Connection Release 2.x
Alerts

Table Of Contents

Alerts

Understanding Alerts

Viewing Alerts

Alert Fields

Alert Action Configuration

Enabling Trace Download

Understanding Alert Logs

Log Partition Monitoring

Related Topics


Alerts


This chapter contains information on the following topics:

Understanding Alerts

Viewing Alerts

Alert Fields

Alert Action Configuration

Enabling Trace Download

Understanding Alert Logs

Log Partition Monitoring

Understanding Alerts

The system generate alert messages to notify administrator when a predefined condition is met, such as when an activated service goes from up to down. Alerts can be sent out as e-mail/epage.

RTMT, which supports alert defining, setting, and viewing, contains preconfigured and user-defined alerts. Although you can perform configuration tasks for both types, you cannot delete preconfigured alerts (whereas you can add and delete user-defined alerts). The Alert menu comprises the following menu options:

Alert Central—This option comprises the history and current status of every alert in the system.


Note You can also access Alert Central by clicking the Alert Central icon in the hierarchy tree in the system drawer.


Set Alert/Properties—This menu option allows you to set alerts and alert properties.

Remove Alert—This menu category allows you to remove an alert.

Enable Alert—With this menu category, you can enable alerts.

Disable Alert—You can disable an alert with this category.

Suspend cluster/node Alerts—This menu category allows you to temporarily suspend alerts.

Clear Alerts—This menu category allows you to reset an alert (change the color of an alert item from to black) to signal that an alert has been taken care of. After an alert has been raised, its color will automatically change to in RTMT and will stay that way until you manually clear the alert.

Clear All Alerts—This menu category allows you to clear all alerts.

Alert Detail—This menu category provides detailed information on alert events.

Config Email Server—In this category, you can configure your e-mail server to enable alerts.

Config Alert Action—This category allows you to set actions to take for specific alerts; you can configure the actions to send the alerts to desired e-mail recipients.

In RTMT, you configure alert notification for perfmon counter value thresholds and set alert properties for the alert, such as the threshold, duration, frequency, and so on.

You can locate Alert Central under the Tools hierarchy tree in the quick launch. Alert Central provides both the current status and the history of all the alerts in the system.

Additional Information

See the Related Topics.

Viewing Alerts

January 7, 2008

RTMT displays both preconfigured alerts and custom alerts in Alert Central. RTMT organizes the alerts under different tabs—System, Cisco Unity Connection, and Custom.

You can enable or disable preconfigured and custom alerts in Alert Central; however, you cannot delete preconfigured alerts.

The following list comprises the preconfigured alerts for the system:

AuthenticationFailed

CoreDumpFileFound

CpuPegging

CriticalServiceDown


Note The CriticalServiceDown alert is generated only when the service status equals down (not for other states).


(Cisco Unity Connection 6.1) HardwareFailure

LogFileSearchStringFound

LogPartitionHighWaterMarkExceeded

LogPartitionLowWaterMarkExceeded

LowActivePartitionAvailableDiskSpace

LowAvailableVirtualMemory

LowInactivePartitionAvailableDiskSpace

LowSwapPartitionAvailableDiskSpace

(Cisco Unity Connection 6.1) ServerDown

(Cisco Unity Connection 6.1) SDLLinkOutOfService

SyslogSeverityMatchFound

SyslogStringMatchFound

(Cisco Unity Connection 6.1) SystemVersionMismatched

ThreadCounterUpdateStopped

Additional Information

See the Related Topics.

Alert Fields

You can configure both preconfigured and user-defined alerts in RTMT. You can also disable both preconfigured and user-defined alerts in RTMT. You can add and delete user-defined alerts in the performance-monitoring window; however, you cannot delete preconfigured alerts.

Table 6-1 provides a list of fields that you may use to configure each alert; users can configure preconfigured fields, unless otherwise noted.

Table 6-1 Alert Customization 

Field
Description
Comment

Alert Name

High-level name of the monitoring item with which RTMT associates an alert

Descriptive name. For preconfigured alerts, you cannot change this field. For a list of preconfigured alerts, see the "Viewing Alerts" section.

Description

Description of the alert

You cannot edit this field for preconfigured alerts. For a list of preconfigured alerts, see the "Viewing Alerts" section.

Performance Counter(s)

Source of the performance counter

You cannot change this field.

Threshold

Condition to raise alert (value is...)

Specify up < - > down, less than #, %, rate greater than #, %, rate.

Value Calculated As

Method used to check the threshold condition

Specify value to be evaluated as absolute, delta (present - previous), or % delta.

Duration

Condition to raise alert (how long value threshold has to persist before raising alert)

Options include the system sending the alert immediately or after a specified time that the alert has persisted.

Number of Events Threshold

Raise alert only when a configurable number of events exceeds a configurable time interval (in minutes).

For ExcessiveVoiceQualityReports, the default thresholds equal 10 to 60 minutes. For RouteListExhausted and MediaListExhausted, the defaults equal 0 to 60 minutes.

Alert Action ID

ID of alert action to take (System always logs alerts no matter what the alert action.)

Alert action gets defined first (see the "Additional Information" section). If this field is blank, that indicates that e-mail is disabled.

Enable Alerts

Enable or disable alerts.

Options include enabled or disabled.

Clear Alert

Resets alert (change the color of an alert item from to black) to signal that the alert has been resolved

After an alert has been raised, its color will automatically change to and stay that way until you manually clear the alert. Use Clear All to clear all alerts.

Alert Details

Displays the detail of an alert (not configurable)

N/A

Alert Generation Rate

How often to generate alert when alert condition persists

Specify every X minutes. (Raise alert once every X minutes if condition persists.)

Specify every X minutes up to Y times. (Raise alert Y times every X minutes if condition persists.)

User Provide Text

Administrator to append text on top of predefined alert text

N/A

Severity

For viewing purposes (for example, show only Sev. 1 alerts)

Specify defaults that are provided for predefined (for example, Error, Warning, Information) alerts.


Additional Information

See the Related Topics.

Alert Action Configuration

In RTMT, you can configure alert actions for every alert that is generated and have the alert action sent to e-mail recipients that you specify in the alert action list.

Table 6-2 provides a list of fields that you will use to configure alert actions. Users can configure all fields, unless otherwise marked.

Table 6-2 Alert Action Configuration 

Field
Description
Comment

Alert Action ID

ID of alert action to take

Specify descriptive name.

Mail Recipients

List of e-mail addresses. You can selectively enable/disable an individual e-mail in the list.

N/A


Additional Information

See the Related Topics.

Enabling Trace Download

Some preconfigured alerts will allow you to initiate a trace download based on the occurrence of an event. You can automatically capture traces when a particular event occurs by checking the Enable Trace Download check box in Set Alert/Properties for the following alerts:

CriticalServiceDown

CodeYellow

CoreDumpFileFound


Caution Enabling Trace Download may affect services on the server. Configuring a high number of downloads will adversely impact the quality of services on the server.

Additional Information

See the Related Topics.

Understanding Alert Logs

The alert log stores the alert, which is also stored in memory. The memory gets cleared at a constant interval, leaving the last 30 minutes of data in the memory. When the service starts/restarts, the last 30 minutes of the alert data load into the memory by the system reading from the alert logs on the server. The alert data in the memory gets sent to the RTMT clients on request.

Upon RTMT startup, RTMT shows all logs that occurred in the last 30 minutes in the Alert Central log history. Alert log periodically gets updated, and new logs get inserted into the log history window. After the number of logs reaches 100, RTMT removes the oldest 40 logs.

The following file name format for the alert log applies: AlertLog_MM_DD_YYYY_hh_mm.csv.

The alert log includes the following attributes:

Time Stamp—Time when RTMT logs the data

Alert Name—Descriptive name of the alert

Node—Server where the alert occurred

Alert Message—Detailed description about the alert

Description—Description of the monitored object

Severity—Severity of the alert

PollValue—Value of the monitored object where the alert condition occurred

Action—Alert action taken

Group ID—Identifies the source of the alert

The first line of each log file comprises the header. Details of each alert get written in a single line, separated by a comma.

Additional Information

See the Related Topics.

Log Partition Monitoring

Log Partition Monitoring, which is installed automatically with the system, uses configurable thresholds to monitor the disk usage of the log partition on a server.The Cisco Log Partitioning Monitoring Tool service starts automatically after installation of Cisco Unity.

Every 5 minutes, Log Partition Monitoring uses the following configured thresholds to monitor the disk usage of the log partition on a server:

LogPartitionLowWaterMarkExceeded (% disk space)—When the disk usage is above the percentage that you specify, LPM sends out an alarm message to syslog and an alert to RTMT Alert central. To save the log files and regain disk space, you can use trace and log central option in RTMT.

LogPartitionHighWaterMarkExceeded (% disk space)—When the disk usage is above the percentage that you specify, LPM sends a n alarm message to syslog and an alert to RTMT Alert central.

In addition, Cisco Log Partitioning Monitoring Tool service checks the server every 5 seconds for newly created core dump files. If there are new core dump files, Cisco Log Partitioning Monitoring Tool service sends a CoreDumpFileFound alarm and an alert to Alert Central with information on each new core file.

To utilize log partition monitor, verify that the Cisco Log Partitioning Monitoring Tool service, a network service, is running on the server on Cisco Unified Serviceability. Stopping the service causes a loss of feature functionality.

When the log partition monitoring services starts at system startup, the service checks the current disk space utilization. If the percentage of disk usage is above the low water mark, but less than the high water mark, the service sends a alarm message to syslog and generates a corresponding alert in RTMT Alert central.

To configure Log Partitioning Monitoring, set the alert properties for the LogPartitionLowWaterMarkExceeded and LogPartitionHighWaterMarkExceeded alerts in Alert Central. For more information, see "Setting Alert Properties" section on page 7-2.

To offload the log files and regain disk space on the server, you should collect the traces that you are interested in saving by using the Real-Time Monitoring tool.

If the percentage of disk usage is above the high water mark that you configured, the system sends an alarm message to syslog, generates a corresponding alert in RTMT Alert Central, and automatically purges log files until the value reaches the low water mark.


Note Log Partition Monitoring automatically identifies the common partition that contains an active directory and inactive directory. The active directory contains the log files for the current version of Cisco Unity, and the inactive directory contains the log files for the previous installed version of Cisco Unity. If necessary, the service deletes log files in the inactive directory first. The service then deletes log files in the active directory, starting with the oldest log file for every application until the disk space percentage drops below the configured low water mark. The service does not send an e-mail when log partition monitoring purges the log files.


After the system determines the disk usage and performs the necessary tasks (sending alarms, generating alerts, or purging logs), log partition monitoring occurs at regular 5 minute intervals.

Related Topics

Understanding Alerts

Viewing Alerts

Alert Fields

Alert Action Configuration

Enabling Trace Download

Understanding Alert Logs

Working with Alerts, page 7-1

Setting Alert Properties, page 7-2

Suspending Alerts, page 7-4

Configuring E-mails for Alert Notification, page 7-5

Configuring Alert Actions, page 7-5