Feedback
Contents
- Cisco Unified CM Alarms
- Alarms
- Alarm overview
- Alarm configuration
- Alarm definitions
- Alarm information
- Set up alarms
- Alarm service setup
- Syslog agent enterprise parameters
- Set up alarm service
- Service groups
- Alarm configuration settings
- Alarm definitions
- View alarm definitions
- System alarm catalog descriptions
- CallManager alarm catalog descriptions
Cisco Unified CM Alarms
Alarms
Alarm overview
Cisco Unified Serviceability alarms provide information on runtime status and the state of the system, so you can troubleshoot problems that are associated with your system; for example, to identify issues with the Disaster Recovery System. Alarm information, which includes an explanation and recommended action, also includes the application name, machine name, and so on, to help you perform troubleshooting. If you have clusters, this is even true for problems that are not on your local Cisco Unified Communications Manager or Cisco Unity Connection server.
You configure the alarm interface to send alarm information to multiple locations, and each location can have its own alarm event level (from debug to emergency). You can direct alarms to the Syslog Viewer (local syslog), Syslog file (remote syslog), an SDI trace log file, an SDL trace log file (for Cisco CallManager and CTIManager services only), or to all destinations.
When a service issues an alarm, the alarm interface sends the alarm information to the locations that you configure (and that are specified in the routing list in the alarm definition) (for example, SDI trace). The system can either forward the alarm information, as is the case with SNMP traps, or the system can write the alarm information to its final destination (such as a log file).
TipFor the Remote Syslog Server, do not specify a Cisco Unified Communications Manager server, which cannot accept syslog messages from other servers.
You use the Trace and Log Central option in the Cisco Unified Real-Time Monitoring Tool (RTMT) to collect alarms that get sent to an SDI trace log file or SDL trace log file (for Cisco CallManager and CTIManager services only). You use the SysLog Viewer in RTMT to view alarm information that gets sent to the local syslog.
Alarm configuration
You can configure alarms for services, such as Cisco Database Layer Monitor, in Cisco Unified Serviceability. Then, you configure the location(s), such as Syslog Viewer (local syslog), where you want the system to send the alarm information. With this option, you can
- Configure alarms for services on a particular server or on all servers (Unified CM clusters only)
- Configure different remote syslog servers for the configured service(s) or server(s)
- Configure different alarm event level settings for different destinations
Cisco Syslog Agent enterprise parameters in Cisco Unified Communications Manager Administration allow you to forward all alarms that meet or exceed the configured threshold to a remote syslog server with these two settings: remote syslog server name and syslog severity. To access these Cisco Syslog Agent parameters, go to the applicable window for your configuration:
In Cisco Unified Communications Manager Administration, choose .
In Cisco Unified Communications Manager Administration, choose .
The alarms include system (OS/hardware platform), application (services), and security alarms. If you have a Cisco Unified Communications Manager Business Edition 5000 server, the system also forwards Cisco Unity Connection alarms.
The event level/severity settings provide a filtering mechanism for the alarms and messages that the system collects. This setting helps to prevent the Syslog and trace files from becoming overloaded. The system forwards only alarms and messages that exceed the configured threshold.
For more information about the severity levels attached to alarms and events, see the Alarm definitions.
Alarm definitions
Used for reference, alarm definitions describe alarm messages: what they mean and how to recover from them. You search the Alarm Definitions window for alarm information. When you click any service-specific alarm definition, a description of the alarm information (including any user-defined text that you have added) and a recommended action display.
You can search for definitions of all alarms that display in Cisco Unified Serviceability. To aid you with troubleshooting problems, the definitions, which exist in a corresponding catalog, include the alarm name, description, explanation, recommended action, severity, parameters, monitors, and so on.
When the system generates an alarm, it uses the alarm definition name in the alarm information, so you can identify the alarm. In the alarm definition, you can view the routing list, which specifies the locations where the system can send the alarm information. The routing list may include the following locations, which correlate to the locations that you can configure in the Alarm Configuration window:
- Unified CM and Unified CM BE only: SDL - The system sends the alarm information to the SDL trace if you enable the alarm for this option and specify an appropriate event level in the Alarm Configuration window.
- SDI - The system sends the alarm information to the SDI trace if you enable the alarm for this option and specify an appropriate event level in the Alarm Configuration window.
- Sys Log - The system sends the alarm information to the remote syslog server if you enable the alarm for this option, specify an appropriate event level in the Alarm Configuration window, and enter a server name or IP address for the remote syslog server.
- Event Log - The system sends the alarm information to the local syslog, which you can view in the SysLog Viewer in the Cisco Unified Real-Time Monitoring Tool (RTMT), if you enable the alarm for this option and specify an appropriate event level in the Alarm Configuration window.
- Data Collector - System sends the alarm information to the real-time information system (RIS data collector) (for alert purposes only). You cannot configure this option in the Alarm Configuration window.
- Unified CM and Unified CM BE only: SNMP Traps - System generates an SNMP trap. You cannot configure this option in the Alarm Configuration window.
Tip
If the SNMP Traps location displays in the routing list, the system forwards the alarm information to the CCM MIB SNMP agent, which generates the appropriate traps according to the definition in CISCO-CCM-MIB.
The system sends an alarm if the configured alarm event level for the specific location in the Alarm Configuration window is equal to or lower than the severity that is listed in the alarm definition. For example, if the severity in the alarm definition equals WARNING_ALARM, and, in the Alarm Configuration window, you configure the alarm event level for the specific destination as Warning, Notice, Informational, or Debug, which are lower event levels, the system sends the alarm to the corresponding destination. If you configure the alarm event level as Emergency, Alert, Critical, or Error, the system does not send the alarm to the corresponding location.
For each Cisco Unified Serviceability alarm definition, you can include an additional explanation or recommendation. All administrators have access to the added information. You directly enter information into the User Defined Text pane that displays in the Alarm Details window. Standard horizontal and vertical scroll bars support scrolling. Cisco Unified Serviceability adds the information to the database.
Alarm information
You view alarm information to determine whether problems exist. The method that you use to view the alarm information depends on the destination that you chose when you configured the alarm. You can view alarm information that is sent to the SDI trace log file, or SDL trace log file (Cisco Unified Communications Manager and Cisco Unified Communications Manager Business Edition 5000 only) by using the Trace and Log Central option in RTMT or by using a text editor. You can view alarm information that gets sent to local syslog by using the SysLog Viewer in RTMT.
TipUnified CM and Unified CM BE only: For Cisco Unified Communications Manager, you can also use CiscoWorks Lan Management Solution report viewer to view remote syslog messages.
Set up alarms
Procedure
Alarm service setup
Syslog agent enterprise parameters
You can configure the Cisco Syslog Agent enterprise parameters to send system, application, and security alarms/messages that exceed the configured threshold to a remote syslog server that you specify. To access the Cisco Syslog Agent parameters, go to the applicable window for your configuration:
In Cisco Unified Communications Manager Administration, choose .
In Cisco Unified Communications Manager Administration, choose .
Next, configure the remote syslog server names (Remote Syslog Server Name 1, Remote Syslog Server Name 2, Remote Syslog Server Name 3, Remote Syslog Server Name 4, and Remote Syslog Server Name 5)and syslog severity. Ensure that you specify valid IP addresses while configuring the server names. The syslog severity is applicable to all the remote syslog servers that you configure. Then click Save. For the valid values to enter, click the? button. If no server name is specified, Cisco Unified Serviceability does not send the Syslog messages.
CautionWhile configuring remote syslog servers in Cisco Unified Communications Manager, do not add duplicate entries for remote syslog server names. If you add duplicate entries, the Cisco Syslog Agent will ignore the duplicate entries while sending messages to the remote syslog servers.
Note
Do not configure a Cisco Unified Communications Manager as a remote syslog server. The Cisco Unified Communications Manager server does not accept Syslog messages from another server.
Set up alarm service
ProcedureThis section describes how to add or update an alarm for a feature or network service that you manage through Cisco Unified Serviceability.
Note
Cisco recommends that you do not change SNMP Trap and Catalog configurations.
Cisco Unity Connection also uses alarms, which are available in Cisco Unity Connection Serviceability. You cannot configure alarms in Cisco Unity Connection Serviceability. For details, see the Cisco Unity Connection Serviceability Administration Guide.
Refer to your online OS documentation for more information on how to use your standard registry editor.
Step 1 Choose . The Alarm Configuration window displays.
Step 2 From the Server drop-down list box, choose the server for which you want to configure the alarm; then, click Go. Step 3 From the Service Group drop-down list box, choose the category of service, for example, Database and Admin Services, for which you want to configure the alarm; then, click Go.
Tip For a list of services that correspond to the service groups, see Service groups.
Step 4 From the Service drop-down list box, choose the service for which you want to configure the alarm; then, click Go. Only services that support the service group and your configuration display.
Tip The drop-down list box displays active and inactive services.
In the Alarm Configuration window, a list of alarm monitors with the event levels displays for the chosen service.In addition, the Apply to All Nodes check box displays.
Step 5 Unified CM only: If you want to do so, you can apply the alarm configuration for the service to all servers in the cluster by checking the Apply to All Nodes check box, provided your configuration supports clusters. Step 6 Configure the settings, as described in Alarm configuration settings, which includes descriptions for monitors and event levels. Step 7 To save your configuration, click the Save button.
Note To set the default, click the Set Default button; then, click Save.
The following services use Cisco Tomcat for alarm generation:
- Cisco Extension Mobility Application
- Cisco IP Manager Assistant
- Cisco Extension Mobility
- Cisco Web Dialer Web
The system login alarm AuthenticationFailed also uses Cisco Tomcat. To generate alarms for these services, perform the following procedure.
Step 8 In Cisco Unified Serviceability, choose . Step 9 From the Server drop-down list box, choose the server for which you want to configure the alarm; then, click Go. Step 10 From the Services Group drop-down list box, choose Platform Services; then, click Go. Step 11 From the Services drop-down list box, choose Cisco Tomcat; then, click Go. Step 12 Unified CM only: If you want to do so, you can apply the alarm configuration for the service to all servers in the cluster by checking the Apply to All Nodes check box, if your configuration supports clusters. Step 13 Configure the settings, as described in Alarm configuration settings, which includes descriptions for monitors and event levels. Step 14 To save your configuration, click the Save button.
What to Do Next
Tip
The system sends the alarm if the configured alarm event level for the specific destination in the Alarm Configuration window is equal to or lower than the severity that is listed in the alarm definition. For example, if the severity in the alarm definition equals WARNING_ALARM, and, in the Alarm Configuration window, you configure the alarm event level for the specific destination as Warning, Notice, Informational, or Debug, which are lower event levels, the system sends the alarm to the corresponding destination. If you configure the alarm event level as Emergency, Alert, Critical, or Error, which are higher severity levels, the system does not send the alarm to the corresponding location.
To access the alarm definitions for the Cisco Extension Mobility Application service, Cisco IP Manager Assistant service, Cisco Extension Mobility service, and the Cisco Web Dialer Web Service, choose the JavaApplications catalog in the Alarm Messages Definitions window described in Alarm definitions.
Service groups
The following table lists the services that correspond to the options in the Service Group drop-down list box in the Alarm Configuration window.
Note Not all listed service groups and services apply to all system configurations.
Table 1 Service Groups in Alarm ConfigurationCisco CTIManager, Cisco CallManager, Cisco CallManager Cisco IP Phone Service, Cisco DHCP Monitor Service, Cisco Dialed Number Analyzer, Cisco Dialed Number Analyzer Server, Cisco Extended Functions, Cisco IP Voice Media Streaming App, Cisco Messaging Interface, and Cisco Tftp
Cisco Bulk Provisioning Service, Cisco Database Layer Monitor, and Cisco License Manager
Alarm configuration settings
The following table describes all alarm configuration settings, even though the service may not support the settings.
Table 2 Alarm Configuration SettingsName Description From the drop-down box, choose the server for which you want to configure the alarm; then, click Go.
Cisco Unity Connection supports only the following service groups: Database and Admin Services, Performance and Monitoring Services, Backup and Restore Services, System Services, and Platform Services.
From the drop-down box, choose the category of services, for example, Database and Admin Services, for which you want to configure the alarm; then, click Go.
From the Service drop-down box, choose the service for which you want to configure the alarm; then, click Go.
Only services that support the service group and your configuration display.
Tip The drop-down list box displays active and inactive services.
To apply the alarm settings for the service to all servers in a cluster, check the check box.
The SysLog viewer serves as the alarm destination. The program logs errors in the Application Logs within SysLog Viewer and provides a description of the alarm and a recommended action. You can access the SysLog Viewer from the Cisco Unified Real-Time Monitoring Tool.
For information on viewing logs with the SysLog Viewer, refer to the Cisco Unified Real-Time Monitoring Tool Administration Guide.
The Syslog file serves as the alarm destination. Check this check box to enable the Syslog messages to be stored on a Syslog server and to specify the Syslog server name. If this destination is enabled and no server name is specified, Cisco Unified Serviceability does not send the Syslog messages.
The configured AMC primary and failover collectors use the remote syslog settings. The remote syslog settings used by the collectors are those configured on the respective individual nodes.
If the remote syslog is only configured on AMC primary collector without configuring remote syslog on AMC failover collector and failover occurs in AMC primary collector, then no remote syslogs will be generated.
You must configure exactly the same settings on all nodes, to send the remote syslog alarms to the same remote syslog server.
When failover occurs in AMC controller or when the collector configuration changes to a different node, the remote syslog settings on backup or newly configured node is used.
To prevent too many alarms flooding the system, you can check the Exclude End Point Alarms checkbox. This ensures that the endpoint phone-related events get logged into a separate file.
Exclude End Point Alarms checkbox is displayed only for the Call Manager services, and is not selected by default. You need to select the Apply to All Nodes also, while selecting this checkbox. The configuration options for endpoint alarms are given in Alarm configuration settings.
Tip In the Server field, enter the name or IP address of the remote Syslog server that you want to use to accept Syslog messages. For example, if you want to send the alarms to CiscoWorks Lan Management Solution, specify the CiscoWorks Lan Management Solution server name.
Do not specify a Cisco Unified Communications Manager server as the destination because the Cisco Unified Communications Manager server does not accept syslog messages from another server.
Remote Syslog Servers
In each of the Server Name 1, Server Name 2, Server Name 3, Server Name 4, and Server Name 5 fields, enter the name or IP address of the remote syslog server that you want to use to accept syslog messages. For example, if you want to send the alarms to Cisco Unified Operations Manager, specify the Cisco Unified Operations Manager as the server name.
Tip Do not specify a Cisco Unified Communications Manager server as the destination because the Cisco Unified Communications Manager server does not accept syslog messages from another server.
The SDI trace library serves as the alarm destination.
To log alarms in the SDI trace log file, check this check box and check the Trace On check box in the Trace Configuration window for the chosen service. For information on configuring settings in the Trace Configuration window in Cisco Unified Serviceability, see the Set up trace parameters.
The SDL trace library serves as the alarm destination. This destination applies only to the Cisco CallManager service and the CTIManager service. Configure this alarm destination by using Trace SDL configuration. To log alarms in the SDL trace log file, check this check box and check the Trace On check box in the Trace Configuration window for the chosen service. For information on configuring settings in the Trace Configuration window in Cisco Unified Serviceability, see the Set up trace parameters.
- Emergency
This level designates system as unusable.
- Alert
This level indicates that immediate action is needed.
- Critical
The system detects a critical condition.
- Error
This level signifies an error condition exists.
- Warning
This level indicates that a warning condition is detected.
- Notice
This level designates a normal but significant condition.
- Informational
This level designates information messages only.
- Debug
This level designates detailed event information that Cisco TAC engineers use for debugging.
Alarm definitions
This section provides procedural information to search, view, and create user information for alarm definitions that display in Cisco Unified Serviceability.
View alarm definitions
ProcedureThis section describes how to search for and view an alarm definition in Cisco Unified Serviceability.
Tip
Unified CM BE and Connection only: You can view Cisco Unity Connection alarm definitions in Cisco Unity Connection Serviceability. You cannot add user-defined descriptions to alarm definitions in Cisco Unity Connection Serviceability.
Cisco Unity Connection also uses certain alarm definitions in Cisco Unified Serviceability, and they must be viewed in Cisco Unified Serviceability. Be aware that alarms that are associated with the catalogs in Table 1 are available for viewing.
Step 1 In Cisco Unified Serviceability, choose . The Alarm Message Definitions window displays.
Step 2 From the Find alarms where drop-down list box, choose the catalog for which you want to view the definitions. Step 3 From the Equals drop-down list box, choose a catalog of alarm definitions or enter the alarm name in the Enter Alarm Name field. For a list of System Alarm Catalog options, see Table 1. For a list of CallManager Alarm Catalog options (Unified CM and Unified CM BE only), see Table 1. Step 4 Click the Find button. The definitions list displays for the alarm catalog that you chose.
Tip Multiple pages of alarm definitions may exist. To choose another page, click the appropriate navigation button at the bottom of the Alarm Message Definitions window or enter a page number in the Page field. To change the number of alarms that display in the window, choose a different value from the Rows per Page drop-down list box.
Step 5 In the list, click the hyperlink alarm definition for which you want to view alarm details, such as a description, alarm severity, and so on. The Alarm Information window displays.
Step 6 If you want to add information to the alarm, enter text in the User Defined Text pane and click the Save button.
Tip To delete the description from the User Defined Text pane, click the Clear All button.
Step 7 To return to the Alarm Message Definitions window, choose Back to Find/List Alarms from the Related Links drop-down list box; then, click Go.
System alarm catalog descriptions
Table 1 contains the System Alarm Catalog alarm descriptions. The System Alarm Catalog supports Cisco Unified Communications Manager and Cisco Unity Connection.
Table 3 System Catalogs All cluster manager alarm definitions that are related to the establishment of security associations between servers in a cluster.
All Java Applications alarm definitions.
Tip Unified CM and Unified CM BE only: Cisco License Manager, which supports Cisco Unified Communications Manager, uses this catalog.
Tip You cannot configure JavaApplications alarms by using the alarm configuration GUI. For Cisco Unified Communications Manager and Cisco Unity Connection, you generally configure these alarms to go to the Event Logs; for Cisco Unified Communications Manager, you can configure these alarms to generate SNMP traps to integrate with CiscoWorks Lan Management Solution. Use the registry editor that is provided with your operating system to view or change alarm definitions and parameters. All log partition monitoring and trace collection alarm definitions
All Cisco Unified Real-Time Monitoring Tool alarm definitions
All alarm definitions that are used for tracking whether SystemAccess provides all thread statistic counters together with all the process statistic counters.
All service manager alarm definitions that are related to the activation, deactivation, starting, restarting, and stopping of services.
All alarm definitions that are used for sending test alarms through SNMP traps from the Command Line Interface (CLI). For information on the CLI, refer to the Command Line Interface Reference Guide for Cisco Unified Solutions.
Tip Cisco Unified Communications Manager supports SNMP traps in Unified CM and Unified CM BE systems. Cisco Unity Connection SNMP does not support traps in either Unified CM BE or Connection systems. CallManager alarm catalog descriptions
The information in this section does not apply to Cisco Unity Connection.
Table 1 contains the CallManager Alarm Catalog descriptions.
