Alarms
When something of interest happens on an individual device in the overlay network, the device reports it by sending a notification to Cisco vManage. Cisco vManage then filters the event notifications and correlates related events, and it consolidates major and critical events into alarms.
For a list of alarms that Cisco vManage generates, see Permanent Alarms and Alarm Fields.
Use the Alarms screen to display detailed information about alarms generated by controllers and routers in the overlay network.
Alarm States
Cisco vManage alarms are assigned a state based on their severity:
-
Critical (red)—Serious events that impair or shut down the operation of an overlay network function.
-
Major (yellow)—Serious events that affect, but do not shut down, the operational of a network function.
-
Medium (blue)—Events that might impair the performance of a network function.
-
Minor (green)—Events that might diminish the performance of a network function.
The alarms listed as Active generally have a severity of either critical or major.
When the notification events that Cisco vManage receives indicate that the alarm condition has passed, most alarms clear themselves automatically. Cisco vManage then lists the alarm as Cleared, and the alarm state generally changes to medium or minor.
Changes to Alarms in Cisco vManage Release 20.5.1
Feature |
Release Information |
Description |
---|---|---|
Optimization of Alarms |
Cisco SD-WAN Release 20.5.1 Cisco vManage Release 20.5.1 |
This feature optimizes the alarms on Cisco vManage by automatically suppressing redundant alarms. This allows you to easily identify the component that is causing issues. You can view these alarms from the Cisco vManage menu, choose . |
When a site is down, Cisco vManage reports the following alarms:
-
Site down
-
Node down
-
TLOC down
Cisco vManage displays alarms for each component that is down. Depending on the size of your site, you may see several redundant alarms such as alarms for each TLOC in a node as well as the node alarm. In Cisco vManage Release 20.5.1, Cisco vManage intelligently suppresses redundant alarms. For example, if all the TLOCs in a node are down, Cisco vManage suppresses the alarms from each TLOC and displays only the alarm from the node. For multitenant configurations, each tenant displays alarms for the sites in its tenancy.
Scenario |
Alarms Displayed |
|
---|---|---|
Cisco vManage Release 20.5.1 |
Previous Releases |
|
Link 1 down Link 2 up. |
bfd-tloc-1_down |
bfd-tloc-1_down |
Link 1 down Link 2 down |
bfd-site-1_down bfd-node-1_down, bfd-tloc-1_down, and bfd-tloc-2_down are suppresed by the site alarm. |
bfd-site-1_down bfd-tloc-1_down |
Link 1 up Link 2 down |
bfd-site-1_up bfd-node-1_up bfd-tloc-1_up bfd-tloc-2_up |
bfd-site-1_up bfd-tloc-1_up |
View Alarms
You can view alarms from the Cisco vManage Dashboard by clicking the Alarm Bell icon in the top bar. In the Alarm Bell, the alarms are grouped into Active or Cleared.
Alternatively, follow these steps to view alarms from the Alarms screen in Cisco vManage.
-
From the Cisco vManage menu, choose .
From the Cisco vManage menu, choose .
The alarms are displayed in graphical and tabular formats.
-
To view more details for a specific alarm, click … for the desired alarm, and then click Alarm Details.
The Alarm Details window opens and displays the probable cause of the alarm, impacted entities, and other details.
Set Alarm Filters
-
From the Cisco vManage menu, choose .
From the Cisco vManage menu, choose .
-
Click Filter.
-
In the Severity field, choose an alarm severity level from the drop-down list. You can specify more than one severity level.
-
In the Active field, choose active, cleared, or both types of alarm from the drop-down list. Active alarms are alarms that are currently on the device but have not been acknowledged.
-
In the Alarm Name field, choose an alarm name from the drop-down list. You can specify more than one alarm name.
-
Click Search to look for alarms that match the filter criteria.
Cisco vManage displays the alarms in both table and graphical formats.
Export Alarm Data in CSV Format
To export data for all alarms to a file in CSV format, click the Download icon.
Cisco vManage downloads all data from the alarms table to an Excel file in CSV format. The file is downloaded to your browser's default download location and is named Alarms.csv.
Alarms data displayed on the graph can also be looked up in the Excel file.
For example, if the graph displays an alarm data (Critical 2, Major 274, Medium 4, Minor 405) with date and time as 15/Feb/2022 3:30 AM, the same alarm data is also available in the Excel file against a date and time range between 15/Feb/2022 3:00 AM and 15/Feb/2022 3:29 AM.
Enable Email Notifications
You can configure Cisco vManage to send email notifications when alarms occur on devices in the overlay network. This requires you to first configure SMTP and email recipient parameters. First configure the SMTP and email recipient parameters on this screen:
-
From the Cisco vManage menu, choose
. -
Click Edit next to the Alarm Notifications option.
-
For Enable Email Notifications , choose Enabled.
-
Check the Email Settings check box.
-
Choose the security level for sending the email notifications. The security level can be None, SSL, or TLS.
-
In the SMTP Server field, enter the name or the IP address of the SMTP server to receive the email notifications.
-
In the SMTP Port field, enter the SMTP port number. For no security, the default port is 25; for SSL it is 465; and for TLS it is 587.
-
In the From address field, enter the full email address to include as the sender in email notifications.
-
In the Reply to address field, enter the full email address to include in the Reply-To field of the email. This address can be a noreply address, such as noreply@cisco.com.
-
Check the Use SMTP Authentication check box to enable SMTP authentication to the SMTP server.
Enter the username and password to use for SMTP authentication. The default user email suffix is appended to the username. The password that you type is hidden.
-
Click Save.
Note |
The email is sent from vManage Public-IP of VPN0 (Transport Interface) as a source interface. |
Send Alarm Notifications
Before you begin: Ensure that Email Notifications are enabled under Edit next to Alarm Notifications to check whether Alarm Notifications are enabled and the Email Settings check box is checked.
. ClickTo send email notifications when alarms occur:
-
From the Cisco vManage menu, choose .
From the Cisco vManage menu, choose .
-
Click Alarm Notifications. A list of configured notifications is displayed in the table.
-
Click Add Alarm Notification.
-
In the Name field, enter a name for the email notification. The name can be up to 128 characters and can contain only alphanumeric characters.
-
In the Severity field, choose one or more alarm severity levels from the drop-down list.
-
In the Alarm Name field, choose one or more alarms.
-
In the Account Details are, enter the following:
-
In the Email field, enter one or more email addresses.
-
(Optional) Click Add New Email List and enter an email list, if desired.
-
In the Email Threshold field, set the maximum number of emails to be sent per minute. The number can be a value from 1 through 30. The default is 5.
-
Check the WebHook check box to trigger an HTTP callback when an alarm notification event occurs:
-
In the WebHook URL field, enter the URL of the webhook server.
-
Enter the Username and Password to authenticate the webhook server.
-
In the WebHook Threshold field, enter the threshold value.
Note
The value you enter indicates the number of notifications to be posted for that webhook URL per minute. For example, if WebHook Threshold equals 2, you receive two notifications for that webhook URL per minute. Notifications that are generated beyond the threshold get dropped.
-
-
-
Under Selected Devices, choose All Devices or Custom.
If you choose Custom, a device list is displayed:
-
In the Available Devices list on the left, choose one or more devices.
-
Click the right arrow to move the devices to the Selected Devices list on the right.
-
Click Add.
-
-
Click Add.
View and Edit Email Notification
-
From the Cisco vManage menu, choose .
From the Cisco vManage menu, choose .
-
Click Alarm Notifications. A list of configured notifications is displayed in the table.
-
For the desired notification, click the View icon to the right of the row.
-
When you are done viewing the notification, click OK.
Edit an Email Notification
-
From the Cisco vManage menu, choose .
From the Cisco vManage menu, choose .
-
Click Alarm Notifications. A list of configured notifications is displayed in the table.
-
For the desired email notification, click the Edit icon.
-
When you are done editing the notification, click Update.
Delete an Email Notification
-
From the Cisco vManage menu, choose .
From the Cisco vManage menu, choose .
-
Click Alarm Notifications. A list of configured notifications is displayed in the table.
-
For the desired email notification, click the Trash Bin icon.
-
In the confirmation dialog box, click OK.