Cisco Unified Serviceability alarms provide information on runtime status and the state of the system, so you can troubleshoot problems that are associated with your system; for example, to identify issues with the Disaster Recovery System. Alarm information, which includes an explanation and recommended action, also includes the application name, machine name, and so on, to help you perform troubleshooting. If you have clusters, this is even true for problems that are not on your local Cisco Unified CCX.
You configure the alarm interface to send alarm information to multiple locations, and each location can have its own alarm event level (from debug to emergency). You can direct alarms to the Syslog Viewer (local syslog), Syslog file (remote syslog), an SDI trace log file, or to all destinations.
When a service issues an alarm, the alarm interface sends the alarm information to the locations that you configure (and that are specified in the routing list in the alarm definition) (for example, SDI trace). The system can either forward the alarm information, as is the case with SNMP traps, or the system can write the alarm information to its final destination (such as a log file).
Cisco Unified CCX supports SNMP traps.
For the Remote Syslog Server, do not specify a Cisco Unified CCX server, which cannot accept syslog messages from other servers.
You use the Trace and Log Central option in the Cisco Unified Real-Time Monitoring Tool (RTMT) to collect alarms that get sent to an SDI trace log file. You use the SysLog Viewer in RTMT to view alarm information that gets sent to the local syslog.
You can configure alarms for services, such as Cisco Database
Layer Monitor, in
Cisco Unified Serviceability. Then, you configure the locations, such as Syslog
Viewer (local syslog), where you want the system to send the alarm information.
With this option, you can
Configure alarms for services on a particular server or on both
servers in a Unified CCX cluster
Configure different remote syslog servers for the configured
services or servers
Configure different alarm event level settings for different
The alarms include system (OS and hardware platform),
application (services), and security alarms.
Cisco Unified CCX Components
also uses alarms, which are available in
Cisco Unified CCX
Serviceability. For detailed information on how to configure alarms in Cisco
Unified CCX, see the
Cisco Unified CCX Serviceability Administration Guide.
If local syslog is enabled for an application alarm, the system
sends the alarm to the local syslog server when the alarm exceeds the local
syslog threshold . If remote syslog is also enabled in Cisco Unified
Serviceability, the system forwards the alarm to the remote syslog server by
using the application threshold that is configured in Cisco Unified
The event level and severity settings provide a filtering
mechanism for the alarms and messages that the system collects. This setting
helps to prevent the Syslog and trace files from becoming overloaded. The
system forwards only alarms and messages that exceed the configured threshold.
Used for reference, alarm definitions describe alarm messages: what they mean and how to recover from them. You search the Alarm Definitions window for alarm information of Unified CCX Administration and platform. When you click any service-specific alarm definition, a description of the alarm information (including any user-defined text that you have added) and a recommended action display.
You can search for definitions of all alarms that display in Cisco Unified Serviceability. To aid you with troubleshooting problems, the definitions, which exist in a corresponding catalog, include the alarm name, description, explanation, recommended action, severity, parameters, monitors, and so on.
When the system generates an alarm, it uses the alarm definition name in the alarm information, so you can identify the alarm. In the alarm definition, you can view the routing list, which specifies the locations where the system can send the alarm information. The routing list may include the following locations, which correlate to the locations that you can configure in the Alarm Configuration window:
SDI —The system sends the alarm information to the SDI trace if you enable the alarm for this option and specify an appropriate event level in the Alarm Configuration window.
Sys Log—The system sends the alarm information to the remote syslog server if you enable the alarm for this option, specify an appropriate event level in the Alarm Configuration window, and enter a server name or IP address for the remote syslog server.
Event Log—The system sends the alarm information to the local syslog, which you can view in the SysLog Viewer in the Cisco Unified Real-Time Monitoring Tool (RTMT), if you enable the alarm for this option and specify an appropriate event level in the Alarm Configuration window.
Data Collector—System sends the alarm information to the real-time information system (RIS data collector) (for alert purposes only). You cannot configure this option in the Alarm Configuration window.
If the SNMP Traps location displays in the routing list, the system forwards the alarm information to the appropriate SNMP agents, which generates the required traps according to the definition in the respective MIB.
The system sends an alarm if the configured alarm event level for the specific location in the Alarm Configuration window is equal to or lower than the severity that is listed in the alarm definition. For example, if the severity in the alarm definition equals WARNING_ALARM, and, in the Alarm Configuration window, you configure the alarm event level for the specific destination as Warning, Notice, Informational, or Debug, which are lower event levels, the system sends the alarm to the corresponding destination. If you configure the alarm event level as Emergency, Alert, Critical, or Error, the system does not send the alarm to the corresponding location.
For each Cisco Unified Serviceability alarm definition, you can include an additional explanation or recommendation. All administrators have access to the added information. You directly enter information into the User Defined Text pane that displays in the Alarm Details window. Standard horizontal and vertical scroll bars support scrolling. Cisco Unified Serviceability adds the information to the database.
View alarm definition
This section describes how to search and view an alarm
definition for Unified CCX and platform components through
Cisco Unified Serviceability.
Cisco Unified Serviceability, choose
Alarm > Definitions.
The Alarm Message Definitions window displays.
From the Find alarms where drop-down list box, choose the catalog
for which you want to view the definitions.
From the Equals drop-down list box, choose a catalog of alarm
definitions or enter the alarm name in the Enter Alarm Name field. For a list
of System Alarm Catalog options, see
System alarm catalog descriptions.
The definitions list displays for the alarm catalog that you
Multiple pages of alarm definitions may exist. To choose another
page, click the appropriate navigation button at the bottom of the Alarm
Message Definitions window or enter a page number in the Page field. To change
the number of alarms that display in the window, choose a different value from
the Rows per Page drop-down list box.
In the list, click the hyperlink alarm definition for which you
want to view alarm details, such as a description, alarm severity, and so on.
The Alarm Information window displays.
If you want to add information to the alarm, enter text in the
User Defined Text pane and click Save.
To delete the description from the User Defined Text pane, click
To return to the Alarm Message Definitions window, choose Back to
Find/List Alarms from the Related Links drop-down list box; then, click Go.
You view alarm information to determine whether problems exist. The method that you use to view the alarm information depends on the destination that you chose when you configured the alarm. You can view alarm information that is sent to the SDI trace log file by using the Trace and Log Central option in RTMT or by using a text editor. You can view alarm information that gets sent to local syslog by using the SysLog Viewer in RTMT.
Alarm configuration checklist
An overview of the steps for configuring alarms.
In Cisco Unified Serviceability, configure the servers, services,
destinations, and event levels for the alarm information you want to collect.
All services can go to the SDI log (but must be configured
in Trace also).
All services can go to the SysLog Viewer.
To send syslog messages to the Remote Syslog Server, check
the Remote Syslog destination and specify a host name. If you do not configure
the remote server name, Cisco Unified Serviceability does not send the Syslog
messages to the remote syslog server.
Do not configure a
Cisco Unified CCX server as a remote Syslog server.
(Optional) Add a definition to an alarm.
Select any of the following depending on your requirements:
If you chose an SDI trace file as the alarm destination,
collect traces and view the information with the Trace and Log Central option
If you chose local syslog as the alarm destination, view the
alarm information in the SysLog Viewer in RTMT
See the corresponding alarm definition for the description and
The table below contains the System Alarm Catalog alarm
Table 1 System Catalogs
All cluster manager alarm definitions that are related to the
establishment of security associations between servers in a cluster.
All Cisco database (aupair) alarm definitions
Disaster Recovery System alarm definitions
All generic alarm definitions that all applications share
All Java Applications alarm definitions.
Alarms for Extension Mobility
All login-related alarm definitions
All log partition monitoring and trace collection alarm
Cisco Unified Real-Time Monitoring Tool alarm definitions
All alarm definitions that are used for tracking whether
SystemAccess provides all thread statistic counters together with all the
process statistic counters.
All service manager alarm definitions that are related to the
activation, deactivation, starting, restarting, and stopping of services.
All Cisco TFTP alarm definitions
Alarms for Trust Verification Service
All alarm definitions that are used for sending test alarms
through SNMP traps from the Command Line Interface (CLI). For information on
the CLI, refer to the
Command Line Interface Reference Guide for Cisco Unified Solutions.
All certificate expiration definitions.
Alarms for Certificate Trust List (CTL) Provider service
Alarms for Cisco Discovery Protocol (CDP) service
All user authentication and credential definitions.