The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.
An event is an occurrence or detection of some condition in and around the network. An event is a distinct incident that occurs at a specific point in time. Examples of events include:
•Port status change
•Device reset
•Device becomes unreachable by the management station
An event can also be a:
•Possible symptom of a fault that is an error, failure, or exceptional condition in the network. For example, when a device becomes unreachable, an unreachable event is triggered.
•Possible symptom of a fault clearing. For example, when a device state changes from unreachable to reachable, a reachable event is triggered.
One or more events may generate an abnormal state or alarm. The alarm can be cleared, but the event remains. You can view the list of events using the Event Browser.
Choose Operate > Alarms & Events, then click Events to access the Events Browser page.
Prime NCS (WAN) maintains an event catalog and decides how and when an event is created and whether to associate an alarm with the event. Multiple events can be associated to the same alarm.
Prime NCS (WAN) discovers events in the following ways:
•By receiving notification events and analyzing them; for example, syslog and traps.
•By automatically polling devices and discovering changes; for example, device unreachable.
•By receiving events when a significant change occurs in the Prime NCS (WAN) server; for example, rebooting the server.
•By receiving events when the status of the alarm is changed; for example when the user acknowledges or clears an alarm.
Incoming event notifications (traps and syslogs) are identified by matching the event data to predefined patterns. A trap or syslog is considered supported by Prime NCS (WAN) if it has matching patterns and can be properly identified. If the event data does not match with predefined patterns, the event is considered as unsupported and it is dropped.
Faults are discovered by Prime NCS (WAN) through polling, traps, or syslog messages. Prime NCS (WAN) maintains the context of all faults and ensures that duplicate events or alarms are not maintained in the Prime NCS (WAN) database.
The following table provides examples of when Prime NCS (WAN) creates an event.
An alarm is a Prime NCS (WAN) response to one or more related events. If an event is considered of high enough severity (critical, major, minor, or warning), Prime NCS (WAN) raises an alarm until the resulting condition no longer occurs.
One or more events can result in a single alarm being raised. An alarm is created in the following sequence:
1. A notification is triggered when a fault occurs in the network.
2. An event is created, based on the notification.
3. An alarm is created after checking if there is no active alarm corresponding to this event.
An alarm is associated with two types of events:
•Active events: Events that have not been cleared. An alarm remains in this state until the fault is resolved in a network.
•Historical events: Events that have been cleared. An event changes its state to an historical event when the fault is resolved in a network.
After an alarm is cleared, it indicates the end of an alarm life cycle. A cleared alarm can be revived if the same fault reoccurs within a preset period of time. The present period is set to 5 minutes in Prime NCS (WAN).
Prime NCS (WAN) maintains a catalog of events and alarms. The catalog contains the list of events managed by Prime NCS (WAN), and the relationship among the events and alarms. Events of different types can be attached to the same alarm type.
When a notification is received:
1. Prime NCS (WAN) compares an incoming notification against the event and alarm catalog.
2. Prime NCS (WAN) decides whether an event has to be raised.
3. If an event is raised, Prime NCS (WAN) decides whether the event triggers a new alarm or associates it to an existing alarm.
A new event is associated with an existing alarm, if the new event triggered is of the same type and occurs on the same source.
For example, an active interface error alarm. The interface error events that occur at the same interface, are all associated to the same alarm.
The following are the supported statuses for an alarm:
•New—When an event triggers a new alarm or an event is associated with an existing alarm.
•Acknowledged—When you acknowledge an alarm, the status changes from New to Acknowledged.
•Cleared—An alarm can be in these statuses:
–Auto-clear from the device—The fault is resolved on the device and an event is triggered for the same. For example, a device-reachable event clears the device-unreachable event. This in-turn, clears the device-unreachable alarm.
–Manual-clear from Prime NCS (WAN) users: You can manually clear an active alarm without resolving the fault in the network. A clearing event is triggered and this event clears the alarm.
If the fault continues to exist in the network, a new event and alarm are created subsequently based on the event notification (traps/syslogs).
Each event has an assigned severity. Events fall broadly into the following severity categories, each with their associated color in Prime NCS (WAN):
•Flagging—Indicates a fault: Critical (red), Major (orange), Minor (yellow), or Warning (sky blue).
•Informational—Info (blue). Some of the Informational events clear the flagging events.
For example, a Link Down event might be assigned a Critical severity, while its corresponding Link Up event will be an Informational severity.
In a sequence of events, the event with the highest severity determines the severity of the alarm.
Table 7-1lists the places where you can find alarms.
You use monitoring templates to define thresholds. When the thresholds you specify are reached, Prime NCS (WAN) issues an alarm.
To define thresholds:
Step 1 Choose Design > Monitoring Templates.
Step 2 Under Features, choose Threshold.
Step 3 Complete the basic template fields.
Step 4 Under Feature Category, choose one of the following metrics:
•Device Health—allows you to change threshold values for CPU utilization, memory pool utilization, and environment temperature
•Interface Health—allows you to change threshold values for the number of outbound packets which are discarded.
Step 5 Under Metric Parameters, choose the threshold setting you want to change, then click Edit Threshold Setting.
Step 6 Enter a new value and choose the alarm severity for the threshold.
Step 7 Click Done.
Step 8 Click Save as New Template.
Step 9 Under the My Templates folder, navigate to the template you created and select it.
Step 10 Click Go to Deployment.
Step 11 Choose the template you created, then click Deploy.
The view a single alarm, its associated events, and to change the alarm status:
Step 1 Choose Operate > Alarms & Events.
Step 2 Click the expand icon next to the alarm for which you want to view details.
Step 3 Choose Change Status > Acknowledge or Clear.
Acknowledged and Cleared alarms are removed from the list of alarms. No emails are generated for these alarms after you have marked them as acknowledged or cleared.
By default, acknowledged and cleared alarms are not included for any search criteria. To change this default, choose Administration > System > Alarms and Events and disable the Hide Acknowledged Alarms or Hide Cleared Alarms preference.
Cleared alarms remain in the Prime NCS (WAN) database, but in the Clear state. You clear an alarm when the condition that caused it no longer exists.
You may want certain alarms to be removed from the Alarms List. For example, if you are continuously receiving an interference alarm from a certain device, you may want to stop that device from being counted as an active alarm on the Alarm Summary page or any alarms list. In this scenario, you can find the alarm for the device in the Alarms list, select the check box, and choose Acknowledge from the Select a command drop-down list.
Now if the device generates a new violation on the same interface, Prime NCS (WAN) will not create a new alarm, and the Alarm Summary page shows no new alarms. However, if the interference violation is created on another interface, a new alarm is created.
By default, acknowledged alarms are not displayed in either the Alarm Summary page or any alarm list page. Also, no emails are generated for these alarms after you have marked them as acknowledged. By default, acknowledged alarms are not included for any search criteria. To change this default, go to the Administration > System > Alarms and Events page and disable the Hide Acknowledged Alarms preference.
When you acknowledge an alarm, the following warning appears as a reminder that a recurrence of the problem does not generate another alarm unless this functionality is disabled.
Note When you acknowledge an alarm, a warning displays as a reminder that a recurrence of the problem does not generate another alarm unless this functionality is disabled. Use the Administration > User Preferences page to disable this warning message.
You can also search for all previously acknowledged alarms to reveal the alarms that were acknowledged during the last seven days. Prime NCS (WAN) automatically deletes cleared alerts that are more than seven days old so your results can only show activity for the last seven days. Until an existing alarm is deleted, a new alarm cannot be generated for any managed entity for which Prime NCS (WAN) has already generated an alarm.
To change alarm and event options such as when alarms are deleted, which alarm severities are displayed, and alarm email options:
Step 1 Choose Administration > System > Alarms and Events.
Step 2 Change the necessary settings for the alarms.
Step 3 Click Save.
To configure the severity level for newly generated alarms:
Step 1 Choose Administration > System.
Step 2 From the left sidebar menu, choose Severity Configuration.
Step 3 Select the check box of the alarm condition whose severity level you want to change.
Step 4 From the Configure Security Level drop-down list, choose from the following severity levels:
•Critical
•Major
•Minor
•Warning
•Informational
•Reset to Default
Step 5 Click Go.
Step 6 Click OK to confirm the changes.