The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.
This chapter explains the concepts that are key to Cisco Prime Collaboration.
An event is a distinct incident that occurs at a specific point in time.
Possible symptom of a fault that is an error, failure, or exceptional condition in the network. For example, when a device becomes unreachable, an Unreachable event is triggered.
Possible symptom of a fault clearing. For example, when a device state changes from unreachable to reachable, an event is triggered.
Events are derived from incoming traps and notifications, detected status changes (by polling), and user actions.
It is important to understand that an event, once it occurs, does not change its status even when the conditions that triggered the event are no longer present.
Choose
to view the list of events.The life cycle of a fault scenario is called an alarm.
Is a Cisco Prime Collaboration Assurance response to events it receives.
Is a sequence of events, each representing a specific occurrence in the alarm life cycle (see below example). In a sequence of events, the event with the highest severity determines the severity of the alarm.
Represents a series of correlated events that describe a fault occurring in the network.
Describes the complete event life cycle, from the time that the alarm is raised (when the fault is first detected) until it is cleared and acknowledged.
In a sequence of events, the event with the highest severity determines the severity of the alarm.
Cisco Prime Collaboration Assurance constructs alarms from a sequence of correlated events. A complete event sequence for an alarm includes a minimum of two events:
Alarm active (for example, an interface down event raises an alarm).
Alarm clear (for example, an interface up event clears the alarm).
The lifecycle of an alarm can include any number of correlated events that are triggered by changes in severity, updates to services, and so on.
When a new related event occurs, Cisco Prime Collaboration Assurance correlates it to the alarm and updates the alarm severity and message text based on the new event. If you manually clear the alarm, the alarm severity changes to cleared.
You can view the events that form an alarm in the Alarms and Events browser.
Choose
to view the list of alarms.Cisco Prime Collaboration Assurance maintains an event catalog and decides how and when an event has to be created and whether to associate an event with an alarm. Multiple events can be associated to the same alarm.
Cisco Prime Collaboration Assurance discovers events in the following ways:
By receiving notification events and analyzing them; for example, syslog and traps.
By automatically polling devices and discovering changes; for example, device unreachable.
By receiving events when the status of the alarm is changed; for example, when the user clears an alarm.
Cisco Prime Collaboration Assurance allows you to disable monitoring of events that may not be of importance to you. The events that are disabled are not listed in the Alarms and Events browser. Also, Cisco Prime Collaboration Assurance does not trigger an alarm.
Incoming event notifications received as syslogs or traps are identified by matching the event data to predefined patterns. An event is considered supported by Cisco Prime Collaboration Assurance if it has matching patterns and can be properly identified. If the event data does not match with predefined patterns, the event is considered as unsupported and it is dropped.
The following table illustrates the Cisco Prime Collaboration Assurance behavior while it deals with event creation:
An alarm represents the life cycle of a fault in a network. Multiple events can be associated with a single alarm.
An alarm is created in the following sequence:
A notification is triggered when a fault occurs in the network.
An alarm is created after checking if there is no active alarm corresponding to this event.
An alarm is associated with two types of events:
Active events: Events that have not been cleared. An alarm remains in this state until the fault is resolved in a network.
Historical events: Events that have been cleared. An event changes its state to an historical event when the fault is cleared. See Alarm Status to know how an alarm is cleared.
The alarm life cycle ends after an alarm is cleared. A cleared alarm can be revived if the same fault recurs within a preset period of time.
For Cisco Prime Collaboration, the preset period is 60 minutes.
Cisco Prime Collaboration maintains a catalog of events and alarms. The catalog contains the list of events managed by Cisco Prime Collaboration, and the relationship among the events and alarms. Events of different types can be associated to the same alarm type.
When a notification is received:
Cisco Prime Collaboration compares an incoming notification against the event and alarm catalog.
Cisco Prime Collaboration decides whether an event has to be raised.
If an event is raised, Cisco Prime Collaboration decides whether the event should trigger a new alarm or associate it to an existing alarm.
A new event is associated with an existing alarm, if the new event triggered is of the same type and occurs on the same source.
An active interface error alarm is an example. All interface error events that occur on the same interface, are associated to the same alarm.
If any event is cleared, its severity changes to informational.
Event correlation is the process of relating one event to other events.
Cisco Prime Collaboration distinguishes two event relationship types:
An event sequence. Events that have the same type and the same source are considered part of an event sequence, or an alarm. An alarm represents the complete lifecycle of a fault.
An event sequence hierarchy (alarms), representing causality.
Cisco Prime Collaboration associates a new event to an existing alarm if the existing alarm has the same event type and source as the new event.
Cisco Prime Collaboration raises an alarm, if the number of related events received (by fault management system) from the device element exceeds a specified threshold in a specified unit of time, based on predefined correlation rules.
You can modify these rules and configure the number of event occurrences to set the trigger. This can vary from two to 100. You can also set the time interval. You can modify these rules at Administration > Alarm & Event Configuration > Rules Settings .
For Cisco Prime Collaboration Release 11.5 and later
Choose
.If an administrator does not specify a time interval, maximum time period, or a count for a specific alarm, the default values for the time interval, maximum time period, and count is attached on an alarm, device type, or device class basis.
If the number of same event received from a set of elements exceeds a specified threshold, Cisco Prime Collaboration creates an alarm.
Cisco Prime Collaboration automatically masks the hierarchy of events when the top-level component is the cause for the issue, and raises an alarm against the top level component while masking all the downstream events.
The following are the supported statuses for an alarm:
When an event triggers a new alarm or an event is associated with an existing alarm. |
|||
When you acknowledge an alarm, the status changes from Not Acknowledged to Acknowledged |
|||
If there are no updates to an active alarm for 24 hours, Cisco Prime Collaboration automatically clears the alarm.
|
Each event has an assigned severity, and can be identified by its color in Cisco Prime Collaboration.
Events fall broadly into the following severity categories:
Flagging—Indicates a fault: Critical (red), Major (orange), Minor (yellow), or Warning (sky blue).
Informational—Info (blue). Some of the Informational events clear the flagging events.
In a sequence of events, the event with the highest severity determines the severity of the alarm.
Cisco Prime Collaboration allows you to customize the settings and severity of an event. The events that are of importance to you can be given higher severity. For more information on how to customize the event settings, see Customize Alarms and Events section in the Cisco Prime Collaboration Assurance Guide - Standard.
The event settings and severity predefined in the Cisco Prime Collaboration application is used if you have not customized the event settings and severity.
All events and alarms, including active and cleared, are persisted in the Cisco Prime Collaboration database.
The relationships between the events are retained. The Alarm and Event Browser lets you review the content of the database. The purge interval for this data is four weeks.
Note | Events are stored in the form of the Cisco Prime Collaboration event object. The original notification structure of incoming event notifications (trap or syslog) is not maintained. |
Cisco Prime Collaboration allows you to subscribe to receive notifications for alarms. Cisco Prime Collaboration sends notifications based on user-configured alarm sets and notification criteria.
For more information on how to configure the notifications, see the Configure Alarm and Event Notification section in the Cisco Prime Collaboration Assurance- Standard.