What Is an Event?
- Recurring Alarms and Events
What Is an Alarm?
Defining Alarm Thresholds
Where to Find Alarms
Display Options
Changing Alarm Status
- When to Acknowledge Alarms
- Including Acknowledged and Cleared Alarms in Searches
Changing Alarm and Event Options
Configuring Alarm Severity Levels
Customizing Alarms and Events For Traps
- Modifying a Customized Trap Event
What is an Alarm Policy?
Getting Help for Alarms
Viewing Syslogs
- Supported Syslog Formats for Event Based Inventory
Customizing Alarms and Events For Syslogs
- Modifying a Customized Syslog Event

Monitoring Alarms

An alarm is a Cisco Prime Infrastructure response to one or more related events. If an event is considered of high enough severity (critical, major, minor, or warning), Prime Infrastructure raises an alarm until the condition no longer occurs.

What Is an Event?

An event is an occurrence or detection of some condition in or around the network. An event is a distinct incident that occurs at a specific point in time. Examples of events include:

Port status change
Device reset
Device becomes unreachable by the management station

An event can also result from:

A fault that is an error, failure, or exceptional condition in the network. For example, when a device becomes unreachable, an unreachable event is triggered.
A fault clearing. For example, when a device state changes from unreachable to reachable, a reachable event is triggered.

One or more events may generate an abnormal state or alarm. The alarm can be cleared, but the event remains. You can view the list of events using the Event Browser.

Choose Monitor > Monitoring Tools > Alarms & Events, then click Events to access the Events Browser page.

Event Creation

Prime Infrastructure maintains an event catalog and decides how and when an event is created and whether to associate an alarm with the event. Multiple events can be associated with the same alarm.

Prime Infrastructure discovers events in the following ways:

By receiving notification events and analyzing them; for example, syslog and traps.
By automatically polling devices and discovering changes; for example, device unreachable.
By receiving events when a significant change occurs on the Prime Infrastructure server; for example, rebooting the server.

Incoming event notifications (traps and syslogs) are identified by matching the event data to predefined patterns. A trap or syslog is considered supported by Prime Infrastructure if it has matching patterns and can be properly identified. If the event data does not match predefined patterns, the event is considered unsupported, and it is dropped.

Faults are discovered by Prime Infrastructure through polling, traps, or syslog messages. Prime Infrastructure maintains the context of all faults and ensures that duplicate events or alarms are not maintained in the Prime Infrastructure database.

The following table provides examples of when Prime Infrastructure creates an event.

Time	Event	Prime Infrastructure Behavior
10:00AM PDT December 1, 2014	Device A becomes unreachable.	Creates a new unreachable event on device A.
10:30AM PDT December 1, 2014	Device A continues to be unreachable.	No change in the event status.
10:45AM PDT December 1, 2014	Device A becomes reachable.	Creates a new reachable event on device A.
11:00AM PDT December 1, 2014	Device A stays reachable.	No change in the event status.
12:00AM PDT December 1, 2014	Device A becomes unreachable.	Creates a new unreachable event on device A.

Recurring Alarms and Events

To reduce the amount of unnecessary alarms and events, Prime Infrastructure detects the underlying causes of an event, and then modifies when it issues alarms and events if the devices have any of the problems. For example, for module or link faults, if a module is down, Prime Infrastructure creates one Module Down alarm only, and associates all of the interfaces’ link down events to the Module Down alarm. When the module state is restored, Prime Infrastructure clears the module alarm and all interface messages are associated to the cleared alarm.

When several link-up and link-down traps are received for the same interface, within a short time period, then Prime Infrastructure detects those traps and creates a Flapping event.

What Is an Alarm?

An alarm is a Prime Infrastructure response to one or more related events. If an event is considered of high enough severity (critical, major, minor, or warning), Prime Infrastructure raises an alarm until the resulting condition no longer occurs.

One or more events can result in a single alarm being raised. An alarm is created in the following sequence:

1. A notification is triggered when a fault occurs in the network.

2. An event is created, based on the notification.

3. An alarm is created after verifying that there is no active alarm corresponding to this event.

Event and Alarm Association

Prime Infrastructure maintains a catalog of events and alarms. This catalog contains a list of events and alarms managed by Prime Infrastructure, and the relationship among the events and alarms. Events of different types can be attached to the same alarm type.

When a notification is received:

1. Prime Infrastructure compares an incoming notification against the event and alarm catalog.

2. Prime Infrastructure decides whether to raise an event.

3. If an event is raised, Prime Infrastructure decides if the event triggers a new alarm or if it is associated with an existing alarm.

A new event is associated with an existing alarm if the new event is of the same type and occurs on the same source.

Alarm Status

Table 12-1 provides alarm status descriptions.

Table 12-1 Alarm Status Descriptions
Alarm Status	Description
Not acknowledged	When an event triggers a new alarm or a new event is associated with an existing alarm.
Acknowledged	When you acknowledge an alarm, the status changes from Not acknowledged to Acknowledged.
Cleared	A cleared alarm can involve any of the following: Auto-clear from the device—The fault is resolved on the device and an event is triggered for the device. For example, a device-reachable event clears a device-unreachable event. This, in turn, clears the device-unreachable alarm. Manual-clear from Prime Infrastructure users—You can manually clear an active alarm without resolving the fault in the network. A clearing event is triggered and the alarm is cleared. If a fault continues to exist in the network, a new event and alarm are created subsequently, based on event notification (traps/syslogs).

Event and Alarm Severity

Each event has an assigned severity. Events fall broadly into the following severity categories, each with an associated color in Prime Infrastructure:

Flagging (indicates a fault)—Critical (red), Major (orange), Minor (yellow), or Warning (sky blue).
Informational—Info (blue). Some informational events clear flagging events.

For example, a Link Down event might be assigned Critical severity, while its corresponding Link Up event will be Cleared severity.

In a sequence of events, the event with the highest severity determines the severity of the alarm.

Defining Alarm Thresholds

Use monitoring templates to define thresholds. When the thresholds that you specify are reached, Prime Infrastructure issues an alarm. See Creating Monitoring Policies and Thresholds for information about defining thresholds.

Where to Find Alarms

Table 12-2 lists where you can find alarms.

Table 12-2 Where to Find Alarms
Location in GUI	Description
Monitor > Monitoring Tools > Alarms & Events	Displays a new page listing all alarms with details such as severity, status, failure source, time stamp, Device Timestamp, owner, category, and condition. You can change the status of alarms and assign, annotate, delete, specify email notifications from this page and use the troubleshoot functionality to devices from Prime Infrastructure. If you enable Alarm Badging, Prime Infrastructure displays severity icons next to the device groups. See Displaying Alarm Icons.
Toolbar on top right of the Prime Infrastructure window	The red box on the top right of the Prime Infrastructure window displays the total number of critical alarms currently detected by Prime Infrastructure. You can click on the box to open the Alarm Summary. See Customizing the Alarm Summary.
From device 360° view	On the Alarms tab, when you hover the mouse over the Failure Source field, the crosshair icon appears. Click the icon to see the 360° view of the device. Or, on the Alarm browser, when you hover the mouse over the Failure Source field, the crosshair icon appears. Click the icon to see the 360° view of the device.
Dashboard > Overview > Incidents	Displays dashlets that contain alarm summary information, top n sites with the most alarms, top n alarm types, device reachability status, syslog watch, and syslog summary.
Dashboard > Network Summary > Incidents	Displays dashlets that contain Alarms, Top N Alarm Types, Syslog Summary and Top N Event Types.
Dashboard > Data Center > Compute	Displays Compute Resources Summary dashlet which shows alarms associated with each Compute Resource.
Inventory > Device Management > Compute Devices > Compute Resources > Clusters> Cluster Detail Page	Displays Severity, Status, Timestamp and Description of the Alarms in the Alarms area.
Inventory > Device Management > Compute Devices > Compute Resources > Host > Host Details Page	Displays Severity, Status, Timestamp and Description of the Alarms in the Alarms area.
Inventory > Device Management > Compute Devices > Compute Resources > Virtual Machines > Virtual Machine Details Page	Displays Severity, Status, Timestamp and Description of the Alarms in the Alarms area.

Display Options

The following sections explain the various ways you can modify how alarms, events, and syslogs are displayed:

Viewing Options for Alarms, Events, and Syslogs

When you choose Monitor > Monitoring Tools > Alarms & Events, then click any of the tabs at the top of the page (Alarms, Events, or Syslogs), you can click on either of the following viewing modes:

Show Latest 4000 Alarms —Prime Infrastructure displays the most recent alarms, events, or syslogs (depending on which tab you clicked), based on the timestamp when it was last modified. The Most Recent cache supports till 4000 alarms that can be displayed in the Show Latest 4000 Alarms. If a newer alarm, event, or syslog occurs, Prime Infrastructure removes an older item from the list and adds the most recent one.
Show All —Prime Infrastructure retrieves all alarms, events, or syslogs from the database and displays them.

You can use filters on either view.

By default, Prime Infrastructure deletes alarms older than 30 days and deletes events older than 7 days. Prime Infrastructure stores up to a maximum of 8,000,000 events. There is no limit on the number of alarms that Prime Infrastructure stores. You can change the number of days that events are stored by choosing Administration > Settings > System Settings > Alarms and Events.

Prime Infrastructure displays a maximum of 200,000 rows of events, alarms, and syslogs for any particular active filter. If there are more than 200,000 rows of data on the Alarms, Events, or Syslog page, the global toolbar displays 200000 of N where N is the total number of rows in the table. If you hover your cursor over 200000 of N, a message appears saying that “Only the first 200,000 rows are displayed. Use the table filter controls to display a smaller result set.” To see all records, use the time and date filters to view all records day-by-day.

Alarm Counts in Latest Alarms and All Alarms

The number of alarms displayed in the All Alarms view can be different from the number of alarms in the Latest 4000 Alarms view on the Monitor > Alarms and Events page.

The Latest 4000 Alarms view shows the most recently created and/or modified alarms of all severities and from all virtual domains. Depending on your user privileges and the display settings you configured, you might see fewer than 4000 alarms in this view, even if there are more than 4000 alarms, for the following reasons:

The Latest 4000 Alarms includes cleared alarms, which are hidden unless you disable the Hide Cleared Alarms option (Administration > Settings > System Settings > Alarms and Events). Some of the latest 4000 alarms are cleared alarms, which are not displayed.
The latest 4000 alarms might include alarms from virtual domains that are not visible to you.

You might also temporarily see more alarms in the Latest 4000 Alarms view than in the All Alarms view for the following reasons:

When a cleared alarm becomes active, and Hide Cleared Alarms is enabled, the alarm might appear in the Latest 4000 Alarms view before it appears in the All Alarms view. This is because the alarm is still cleared (and therefore hidden) in the All Alarms view. The two views should synchronize within two minutes.
When an alarm is created for the first time, it might appear in the Latest 4000 Alarms view before it appears in the All Alarms view. The alarm will be visible in the All Alarms view after it has been written to the database. The two views should synchronize within two minutes.
When data pruning is running, Prime Infrastructure might remove alarms from the database (and the All Alarms view) before it updates the Latest 4000 Alarms view. This means that pruned alarms might remain visible in the Latest 4000 Alarms view for a short time. When pruning is complete, Prime Infrastructure corrects the discrepancy.
When an alarm is updated, even if its severity has not changed, it appears in the Latest 4000 Alarms view before it appears in the All Alarms view.

Displaying Alarm Icons

To have Prime Infrastructure display alarm severity icons next to the device groups on the Monitor > Monitoring Tools > Alarms & Events page, you need to enable Alarm Badging. This feature is disabled by default because it could impact performance if Prime Infrastructure is monitoring more than 2,000 devices with more than 10,000 active alarms. If you notice performance degradation issues, we suggest you disable this feature.

Step 1 Click your login name at the top-right of the screen and choose My Preferences.

Step 2 Click the checkbox next to Enable Alarm Badging on Alarms & Events page.

Step 3 Click Save.

Changing Alarm Display Behavior

Prime Infrastructure provides user preference settings that let you control whether:

Automatically refreshes the Alarms and Events page.
Prime Infrastructure displays prompts and warning messages when you acknowledge an alarm or clear all alarms of a condition.
Cleared alarm conditions are always set to the “Information” severity level.

Step 1 Click the Settings icon and choose My Preferences.

Step 2 Click Alarms & Events tab.

Step 3 If you want Alarms/Events/Syslog page to automatically refresh at a periodic interval, select the Automatically refresh Alarms & Events page.

Step 4 If you do not want the warning message to appear whenever you acknowledge an alarm, select the Disable Alarm Acknowledge Warning Message check box. Note that the warning message displays as a reminder that a recurrence of the problem does not generate another alarm unless this functionality is disabled.

Step 5 If you do not want to be prompted to confirm each time you clear an alarm condition, select the Disable confirmation prompt for “Clear all of this condition” check box. Note that the warning displays as a reminder that you are clearing all occurrences of the specified condition.

Step 6 If you do not want to be prompted to confirm the severity change each time you clear an alarm condition, select the Disable “Set severity to Information?” prompt for “Clear all of this condition” check box.

Step 7 Click Save.

Related Topics

Modifying Alarm Failure Source Pattern

Select the category you need to customize and click Edit.
Select the failure source pattern from the options available and click OK.
Select the category for which you want to customize the separator and click Edit Separator. Select one of the options available, then click OK.

The alarms generated for the selected category will have the customized pattern that you set. For example, if you select the Clients category, and then edit the separator to be #, when any supported client alarm is generated, when you select Monitor > Monitoring Tools > Alarms and Events, the Failure Source column for that alarm will be MACaddress # Name.

Note ● Failure Source is not supported for Custom traps and Custom syslog translation.

Failure Source is not supported for Syslog generated events.

Customizing the Alarm Summary

Prime Infrastructure provides user settings that control the information shown in the Alarm Summary box (shown in the top right of the Toolbar at the top on the Prime Infrastructure window) and in the Alarm Summary pop-up page displayed when you click on the Alarm Summary box. These include:

How often the alarm count is refreshed in the Alarm Summary box and page.
Which category of alarm to track as the default alarm category shown in the Alarm Summary box.
Which categories of alarms to include in the Alarm Summary page, and in the total displayed in the Alarm Summary box.

Step 1 Click the Settings icon and choose My Preferences.

You can also access the User Preferences page by clicking the arrow next to your login name in the Global Toolbar at the top right.

Step 2 To change the Alarm Summary refresh frequency: In the Refresh Alarm count in the Alarm Summary every drop down list, choose a refresh frequency (every 1 minute, 2 minutes, or 5 minutes).

Step 3 To select the alarm categories to display in the Alarm Summary box and pop-up page:

a. Click Edit Alarm Categories. The Select Alarm Categories pop-up displays.

b. In the Default Category to display drop-down, choose the default category whose total alarm count you want to display in the Alarm Summary box. For example: Choose “AP Rogue” to have the Alarm Summary box display the count for AP Rogue alarms only. Choose “Alarm Summary” to have the box display a count of all alarms in all selected categories and subcategories.

c. In the pick list under the Show drop-down, choose the checkbox next to each category or sub-category of alarm that you want to include in the Alarm Summary popup page.

If Default Category to display is set to “Alarm Summary”, the alarm totals shown will be the total of all critical alarms for all the categories and sub-categories you select in the pick list. If any other category or sub-category is selected as the Default Category, the box displays totals only for that category.

d. When you are finished, click OK. Your selected alarm category and subcategories are listed on the User Preferences page.

Step 4 Click Save to save your changes.

Related Topics

Changing Alarm Status

You can remove an alarm from the list of alarms by changing its status to Acknowledged or Cleared. No e-mails will be generated for these alarms.

Step 1 Choose Monitor > Monitoring Tools > Alarms & Events. By default, the Alarms tab is selected.

Step 2 Select an alarm, then choose one of the following options under Change Status :

Acknowledge —Removes the alarm from the Alarms list and prevents the alarm from being counted as an active alarm on the Alarm Summary page or any alarms list.
Unacknowledge —Returns the alarm to its active alarm state on the Alarm Summary page and all alarms lists.
Clear —Sets the alarm state to Cleared. Cleared alarms remain in the Prime Infrastructure database, but in the Clear state. You clear an alarm when the condition that caused it no longer exists.
Clear all of this Condition —Sets the alarm state to Cleared for all alarms with the same Condition as the alarm you selected.

After you click Yes to confirm that you want to clear all alarms of the specified condition, a dialog appears asking if you want to change the severity for the selected alarm condition to Informational. This prevents Prime Infrastructure from issuing alarms for the specified condition. To later reset the condition’s severity, choose Administration > Settings > System Settings > Alarms and Events > Alarm Severity and Auto Clear > Severity Configuration and modify the severity.

Related Topics

When to Acknowledge Alarms

You may want certain alarms to be removed from the Alarms list. For example, if you are continuously receiving an interference alarm from a certain device, you may want to stop that alarm from being counted as an active alarm on the Alarm Summary page or any alarms list. In this scenario, you can find the alarm for the device in the Alarms list, select an alarm and choose Change Status > Acknowledge.

If the device generates a new violation on the same interface, Prime Infrastructure does not create a new alarm, and the Alarm Summary page shows no new alarms. However, if the interference violation is created on another interface, a new alarm is created.

By default, acknowledged alarms are not displayed on either the Alarm Summary page or in any alarm list. Also, no emails are generated for acknowledged alarms. By default, acknowledged alarms are not included for any search criteria. To change this default, go to the Administration > Settings > System Settings > Alarms and Events page and disable the Hide Acknowledged Alarms preference.

When you acknowledge an alarm, a warning message appears as a reminder that a recurrence of the problem does not generate another alarm unless this functionality is disabled. Click the Settings icon and choose My Preferences page to disable this warning message.

You can also search for all previously acknowledged alarms to reveal the alarms that were acknowledged during the last seven days. Prime Infrastructure automatically deletes cleared alerts that are more than seven days old, so your results can show activity for only the last seven days. Until an existing alarm is deleted, a new alarm cannot be generated for any managed entity for which Prime Infrastructure has already generated an alarm.

Including Acknowledged and Cleared Alarms in Searches

By default, acknowledged and cleared alarms are not included for any search criteria. To change this default, choose Administration > Settings > System Settings > Alarms and Events and disable the Hide Acknowledged Alarms or Hide Cleared Alarms preference.

Cleared alarms remain in the Prime Infrastructure database, but in the Clear state. You clear an alarm when the condition that caused it no longer exists.

Changing Alarm and Event Options

You might want to change the schedule for deleting alarms, the alarm severities that are displayed, or alarm email options.

To change alarm and event options, follow these steps:

Step 1 Choose Administration > Settings > System Settings.

Step 2 From the left sidebar menu, choose Alarms and Events.

Step 3 Change the alarm or event settings, then click Save.

Configuring Alarm Severity Levels

A newly generated alarm has a default severity level that you might want to change.

To configure an alarm’s severity level, follow these steps:

Step 1 Choose Administration > Settings > System Settings > Alarms and Events > Alarm Severity and Auto Clear.

Step 2 Choose Severity Configuration.

Step 3 Select the check box of the alarm condition whose severity level that you want to change.

Step 4 From the Configure Severity Level drop-down list, choose a severity level.

Step 5 Click OK to confirm the changes.

Customizing Alarms and Events For Traps

You can enable Prime Infrastructure to recognize additional traps and to customize how Prime Infrastructure creates events and alarms for these traps. You can specify a trap notification name or syslog message identifier, and specify the event severity, category, and message to use when the specified trap is received. Prime Infrastructure creates an event with the settings you specify.

Step 1 Choose Monitor > Monitoring Tools > Alarms & Events.

Step 2 Click the Events tab.

Step 3 Click Custom Trap Event. The Custom Trap Events window opens displaying any previously created custom tap events.

Step 4 Click Add.

Step 5 Select a MIB from the menu, which includes all MIBs that are not fully supported, or click Upload New MIB to upload a MIB file.

If you upload a new MIB file, wait approximately 15 seconds, then click Refresh MIBs to have the newly added MIB added to the MIB drop-down list.

Step 6 Select a Notification Name from the list of unsupported notification names included in the selected MIB.

Step 7 In the Event Description field, enter the text you want displayed in the Description column for the events that are generated from traps with the selected notification name.

Step 8 Select a Default Severity level, then click OK.

Prime Infrastructure creates a new event type and alarm condition for the specified trap.

Modifying a Customized Trap Event

You can modify a previously created customized trap event.

Step 1 Choose Monitor > Monitoring Tools > Alarms & Events.

Step 2 Click the Events tab.

Step 3 Click Custom Trap Event. The Custom Trap Events window opens displaying any previously created custom trap events.

Step 4 Select the custom trap event you want to modify, then click Edit.

Step 5 Modify the necessary fields, then click OK.

What is an Alarm Policy?

An Alarm Policy is a filtering method that allows you to control the alarms on network conditions, thereby reducing noise in the system.

If you choose to suppress alarms for a group that contains a port or device, the alarm types you specified are suppressed for that port or device even if that port or device is also in another group for which alarms are marked as active.

Prime Infrastructure supports the following Alarm Policies:

Interface Alarm Policy —Allows you to activate or suppress the interface alarms on interface-related events, device groups, and port groups.
Controller Alarm Policy —Allows you to activate or suppress the alarms on controller-related events for the selected device groups.
Access Points Alarm Policy —Allows you to activate or suppress the AP alarms on AP-related events, device groups, and alarm thresholds.
Layer2 Switch —Allows you to activate and suppress alarms on Layer 2 switch-related events for the selected device groups.
Wired Infrastructure —Allows you to activate and suppress alarms on Wired Infrastructure-related events for the selected device groups.

Note The new alarm policies will not be applicable for the alarms already generated by Prime Infrastructure. You must delete or clear the existing alarms for the alarm policy to be effective in Prime Infrastructure.

Related Topics

Customizing Interface Alarm Policy

You can activate or suppress the types of events, device groups and port groups on which you want the alarms to be generated or ignored.

To edit the Interface Alarm Policy, follow these steps:

Step 1 Choose Monitor > Monitoring Tools > Alarm Policies.

Step 2 Check the Interface check box and then click Edit.

The Edit Interface Alarm Policy page displays the default list of events that you want to modify.

Step 3 Click the Activated or Suppressed toggle button to activate or suppress the alarm for the required event.

To perform a bulk edit, select the required Events check boxes and select Activate or Suppress from the Activate drop-down list.

Step 4 Set the required severity for an alarm from the Severity drop-down list.

To perform a bulk edit, select the required Events check boxes and select a severity from the Change Severity drop-down list.

Step 5 In the Auto Clear Duration field, enter the value in hours for the alarm to clear automatically for an event.

To perform a bulk edit, select the required Events check boxes and edit the Alarm Auto Clear field.

Alternatively, you can choose Administration > Settings > System Settings > Alarms and Events > Alarm Severity and Auto Clear to set the severity and auto clear duration for an alarm.

Step 6 Click Save and Activate, or click Next to continue with the Device Groups page.

Step 7 Click the All devices are selected or No devices are selected toggle button to activate or suppress the events selected in ">Step 3 for the particular device groups. Some devices are selected is displayed only when a few devices in a device group are selected.

To perform a bulk edit, select the required device group check boxes and select Activate or Suppress from the Activate drop-down list.

Step 8 Click Save and Activate.

Related Topics

Customizing Access Point Alarm Policy

You can activate or suppress the types of events and device groups for which you want the alarms to be generated or ignored. Also, you can set the threshold value to control the alarms.

To edit the Access Point Alarm Policy, follow these steps:

Step 1 Choose Monitor > Monitoring Tools > Alarm Policies.

Step 2 Check the Access Point policy name, then click the Edit Policy link.

The Edit Access Point Alarm Policy page displays the default list of events that you want to modify.