Chapter 5: Fault and Events Reports · Chapter 5 Fault and Events Reports Generating Discrepancy Reports Step 2 Click Submit to generate the Discrepancy Report. The Discrepancy Report

Reports ManagemeOL-25942-01

C H A P T E R 5
Fault and Events Reports
This chapter explains:

• Generating Discrepancy Reports

• Generating Deviations Report

• Generic Online Diagnostics Syslogs

• Embedded Event Manager Syslogs Reports

• Starting Fault History

• Generating a PSIRT Summary Report

• Generating Syslog Reports

• IPSLA Summarized Reports - Violation

• Threshold Violations Report

• TrendWatch Report

• TrendWatch Summary Report

Generating Discrepancy ReportsThese reports display discrepancies or anomalies in the discovered network. You can generate a report on the discrepancies.

This section explain:

• Viewing Discrepancy Reports

• Understanding Discrepancy Reports

Viewing Discrepancy ReportsTo view discrepancy reports:

Step 1 Select Reports > Fault and Event > Best Practices > Discrepancies.

The Network Discrepancy page appears..

The Network Discrepancy page has options to configure the report you want to view. Table 5-1describes the options that you can configure to generate a Discrepancy Report.

5-1nt with Cisco Prime LAN Management Solution 4.2

Chapter 5 Fault and Events Reports Generating Discrepancy Reports

Table 5-1 Generating Discrepancy Reports

Option Usage Notes

Device Selector • Click Selection tab to choose the device groups for which you want discrepancies to be reported.

A list of all the available System Defined Groups and User Defined groups appears.

• Select the check box next to the device group for which you want discrepancies to be reported.

Report Options • Click Unacknowledged to view a report of the discrepancies that are not acknowledged.

• Click Acknowledged to view a report of only the acknowl-edged discrepancies.

• Click Both to view a report of both acknowledged and unac-knowledged discrepancies.

Severity Selector You can select the severity level of the discrepancies for which you want to generate a report. The severity levels are Medium and High.

Type Selector 1. Select the discrepancies from Available Types, for which you want the report to be displayed.

You can select multiple entries by pressing Ctrl or Shift while clicking.

2. Click Add.

The selected discrepancies are added to Selected Types. You can also double-click on a discrepancy from Available Types to add it to Selected Types.

To remove a discrepancy from Selected Types, select the dis-crepancy and click Remove.

5-2Reports Management with Cisco Prime LAN Management Solution 4.2

OL-25942-01


Step 2 Click Submit to generate the Discrepancy Report.

The Discrepancy Report appears if you had set the Run Type to Immediate.

For any Run Type other than Immediate, the report is created as a job.

A message is displayed:

The Report Job ID has been created.

The Job ID is listed in the Job Browser at the bottom of the page.

To clear the values you entered click Reset.

Understanding Discrepancy ReportsThis section explains:

• Viewing Details on Discrepancies

• Fixing Discrepancies

The Discrepancy Report is displayed in a tabular format. Table 5-2 describes the fields in a Discrepancy Report.

Scheduling 1. Select the Run Type for the job—Immediate, Once, Daily, Weekly, Monthly.

2. For jobs with Run Type anything other than Immediate, select the Date and Time for the job to run.

The Date and Job Info fields are disabled when you select Immediate as the Run Type for the job.

Job Info 1. Enter a description for the job in the Description field.

The text you enter is displayed in the Cisco Prime LMS 4.2 job browser. This is a mandatory field.

2. In the e-mail field, enter the e-mail ID to which you want the job completion status to be sent.

3. Enter the report Publish Path for any Run Type other than Immediate.

Note Cisco Prime LMS does not support Japanese characters and special characters such as, \ / : * ? “ < > . ! % in the file or folder name.

4. Select the Attachmment Option Report Type for the report to be sent as an attachment to the e-mail id enetered in the e-mail ID field on completeion of the job.

Table 5-1 Generating Discrepancy Reports (continued)

Option Usage Notes


OL-25942-01


Acknowledging Discrepancies

Discrepancies that do not have a serious impact on the network, can be acknowledged. You can also acknowledge a discrepancy that you no longer want to see in the Discrepancy Report. If you acknowledge it, it is removed from the report.

To acknowledge a discrepancy:

Step 1 In the Discrepancy Report, select the check box corresponding to the discrepancy.

Step 2 Click Acknowledge.

The acknowledged discrepancy does not appear in the report the next time you generate it.

Table 5-2 Discrepancy Reports

Field Description

Acknowledge If you have launched:

• Unacknowledged Discrepancy Report

You can acknowledge discrepancies from this report.

For details on acknowledging a discrepancy, see Acknowledg-ing Discrepancies.

• Acknowledged Discrepancy Report

You can unacknowledge discrepancies from this report.

For details on unacknowledging a discrepancy, see Unacknowl-edging Discrepancies.

• Acknowledged and Unacknowledged Discrepancy Report

The Acknowledge column displays Yes for Acknowledged dis-crepancies and No for Unacknowledged Discrepancies.

Type Brief description of the discrepancy.

Severity The severity level of the discrepancy. Discrepancies are categorized according to their severity as medium or high.

Summary The IP addresses of the devices that are affected by the discrepancy are displayed here. Click on the hyperlink to view more details on the discrepancy.

For more information, see Viewing Details on Discrepancies.

Fix States if the discrepancy can be fixed through Cisco Prime LMS 4.2.

A link is provided, click on it to go to the Fix Page.

For details on fixing discrepancies, see Fixing Discrepancies.

First Found The date and time when the discrepancy was first discovered by LMS 4.2.

Remarks If a fix has been attempted on the discrepancy, it is shown here. The Job ID for the fix operation is also shown here.


OL-25942-01


Unacknowledging Discrepancies

If you want the acknowledged discrepancy to reappear in the Discrepancy Report, you need to unacknowledge it.

To unacknowledge a discrepancy:

Step 1 In the Discrepancy Report, select the check box corresponding to the discrepancy.

Step 2 Click UnAcknowledge.

The unacknowledged discrepancy appears in the report the next time you generate it.

Viewing Details on Discrepancies

To get detailed information on a discrepancy, click on the hyperlink in the summary column of the Discrepancy Report. The Discrepancy Details dialog box appears.

Table 5-3 explains Discrepancy Details:

Fixing Discrepancies

This page displays information about the discrepancy detected in the network and helps you fix it through appropriate commands.

Note For fixing discrepancies, ensure that you have configured system identity user under Admin > Trust Management > Multi Server > System Identity Setup and the same username and password is configured under Admin > System > User Management > Local User Setup.

Table 5-4 describes the fields in the Discrepancy Details dialog box.

Table 5-3 Discrepancy Details

Field Description

Type Name of the discrepancy.

Severity Severity level of the discrepancy. Discrepancies are categorized according to their severity as low and high.

First Found Date and time when the discrepancy was first discovered by LMS 4.2.

Description IP addresses of the devices that cause this discrepancy are displayed here.

Detail Brief summary of the discrepancy.

Table 5-4 Discrepancy Details

Field Description

Type Name of the discrepancy.

Severity Severity level of the discrepancy. Discrepancies are categorized according to their severity as low and high.


OL-25942-01


Command Format

Commands should be entered in the following format in the Fix column:

[IP Address or Host Name]

command1

command2

If the commands have to be run for more than one device:

[IP Address1 or Host Name1]

command1

command2


command1

command2

For example:

[172.20.5.82]

interface Gi49

speed auto

First Found Date and time when the discrepancy was first discovered by LMS 4.2.

Description IP Addresses of the devices that cause this discrepancy are displayed here.

Detail Brief summary of the discrepancy.

Recommended Fix If the discrepancy can be fixed through LMS 4.2:

A set of commands is displayed that will be used to resolve the dis-crepancy. You can edit the commands provided by LMS 4.2, to suit your network requirements.

Caution Make sure that you do valid changes to the commands. LMS 4.2 does not check the correctness of the commands after you edit it. So, if the commands are in-correct, the results will be unpredictable.

If the discrepancy cannot be fixed through LMS 4.2:

This field will be blank. You can enter commands to fix the discrep-ancy.

LMS 4.2 uses the cwcli interface oto resolve discrepancies.

Table 5-4 Discrepancy Details (continued)

Field Description


OL-25942-01

Chapter 5 Fault and Events Reports Generating Deviations Report

[172.20.5.6]

interface Gi2/1

speed auto

Generating Deviations ReportThis section explains:

• Viewing Deviations Reports

• Understanding Deviations Reports

Viewing Deviations ReportsTo view Best Practices Deviations report:

Step 1 Select Reports > Fault and Event > Best Practices > Deviation.

The Report Generator page has options to configure the report you want to view. Table 5-5 describes the options that you can configure to generate a Best Practices Deviations Report.

Table 5-5 Generating Best Practices Deviations Report

Option Usage Notes

Device Selector • Click Selection to choose the device groups or devices for which you want Best Practices Deviations to be reported.

A list of all the available System Defined Groups, User Defined groups, and devices appears.

• Select the check box next to the device group or a particular device for which you want Best Practice Deviations to be reported.

Report Options • Click Unacknowledged to view a report of the best practices devia-tions that are not acknowledged.

• Click Acknowledged to view a report of only the acknowledged best practices deviations.

• Click Both to view a report of both acknowledged and unacknowl-edged best practices deviations.


OL-25942-01


Step 2 Click Submit to generate the Best Practices Deviations Report.

The Best Practices Deviations report appears if you had set the Run Type to Immediate.

For any other Run Type, the report is created as a job.

The Job ID is listed in the Job Browser at the bottom of the page.

You can click Reset to clear the values you entered.

Type Selector 1. Select the best practices deviations from Available Types, for which you want the report to be displayed.

You can select multiple entries by pressing Ctrl or Shift while clicking.

2. Click Add. The selected best practices deviations are added to Select-ed Types.

You can also double-click on a Best Practice Deviation from Available Types to add it to Selected Types.

To remove a Best Practice Deviation from Selected Types, select the Best Practice Deviation and click Remove.

Scheduling 1. Select the Run Type for the job—Immediate, Once, Daily, Weekly, Monthly.

For jobs with Run Type anything other than Immediate, select the Date and Time for the job to run.

The Job Info and Date fields are disabled when you select Immediate as the Run Type for the job.

Job Info 1. Enter a description for the job in the Description field.

The text you enter is displayed in the Cisco Prime LMS 4.2 job browser. This is a mandatory field.

2. In the e-mail field, enter the e-mail ID to which you want the job com-pletion status to be sent.

3. Enter the report Publish Path for any Run Type other than Immediate.


4. Select the Attachmment Option Report Type for the report to be sent as an attachment to the e-mail id enetered in the e-mail ID field on completeion of the job.

Table 5-5 Generating Best Practices Deviations Report (continued)

Option Usage Notes


OL-25942-01


Understanding Deviations ReportsThis section explains:

• Viewing Details on Best Practices Deviations

• Fixing Best Practices Deviations

The Deviations Report is displayed in a tabular format. Table 5-6 describes the fields in this report.

Acknowledging Best Practices Deviations

You can acknowledge a Best Practice Deviation that you no longer want to see in the Best Practices Deviations Report.

Table 5-6 Deviations Report

Field Description

Acknowledge If you have launched:

• Unacknowledged Best Practise Deviations Report

You can acknowledge Best Practise Deviations from this report.

For details, see Acknowledging Best Practices Deviations.

• Acknowledged Best Practise Deviations Report

You can unacknowledge Best Practise Deviations from this report.

For details, see Unacknowledging Best Practices Deviations.

• Acknowledged and Unacknowledged Best Practise Deviations Report

The Acknowledge column displays Yes for Acknowledged Best Practise Deviations and No for Unacknowledged Best Practise Deviations.

Type Brief description of the Best Practice Deviation.

Summary IP addresses of the devices that are affected by the Best Practice Deviation. Click on the hyperlink to view more details on the Best Practice Deviation.

For more information, see Viewing Details on Best Practices Devi-ations.

Fix States if the Best Practice Deviation can be fixed through LMS 4.2.

A link is provided, click on it to go to the Fix Page.

For details on fixing Best Practice Deviation, see Fixing Best Practices Deviations

First Found Date and Time when the Best Practice Deviation was first discov-ered by LMS 4.2.

Remarks If a fix has been attempted on the Best Practice Deviation, it is shown here.


OL-25942-01


If you acknowledge it, it will no longer be available in the report. If you want the acknowledged best practice deviation to reappear in the Best Practice Deviation Report, you need to unacknowledge it.

To acknowledge a Best Practice Deviation:

Step 1 Select the check box in the Acknowledge column corresponding to the Best Practice Deviation.

Step 2 Click Acknowledge.

The Best Practice Deviation is not shown in the report, the next time you generate it.

Unacknowledging Best Practices Deviations

If you want the acknowledged Best Practise Deviations to reappear in the Best Practise Deviations Report, you need to unacknowledge it.

To unacknowledge a Best Practise Deviation:

Step 1 In the report, select the check box corresponding to the Best Practise Deviation.

Step 2 Click UnAcknowledge.

The unacknowledged Best Practise Deviation appears in the report, the next time you generate it.

Viewing Details on Best Practices Deviations

To get detailed information on a Best Practice Deviation, click on the hyperlink in the summary column of the Best Practices Deviations Report. The Best Practices Deviations Details dialog box appears.

Table 5-7 displays the following details:

Table 5-7 Best Practices Deviations Details

Field Description

Type Name of the Best Practice Deviation.

First Found Date and time when the Best Practice Deviation was first discovered by LMS 4.2.

Description IP addresses of the devices that cause this Best Practice Deviation.

Detail Brief summary of the Best Practice Deviation.


OL-25942-01


Fixing Best Practices Deviations

This page displays information about the Best Practice Deviation detected in the network and helps you fix it through appropriate commands.

Note For fixing deviations, ensure that you have configured system identity user under Admin > Trust Management > Multi Server > System Identity Setup and the same username and password is configured under Admin > System > User Management > Local User Setup.

Table 5-8 explains the Best Practice Deviation Details:

Command Format

Commands should be entered in the following format in the Fix column:

[IP Address or Host Name]

command1

command2

If the commands have to be run for more than one device:


command1

command2

Table 5-8 Best Practices Deviations Details

Field Description

Type Name of the Best Practice Deviation.

First Found Date and time when the Best Practice Deviation was first discovered

Description IP addresses of the devices that cause this Best Practice Deviation.

Detail Brief summary of the Best Practice Deviation.

Recommended Fix If the Best Practice Deviation can be fixed, a set of commands is displayed that will be used to resolve the Best Practice Deviation. You can edit the commands provided by LMS 4.2, to suit your network requirements.

Caution Make sure that you do valid changes to the commands. LMS 4.2 does not check the correctness of the commands, after you edit it. So, if the commands are incorrect, the results will be unpredictable.

If the Best Practice Deviation cannot be fixed this field will be blank. You can enter commands to fix the Best Practice Deviation.

LMS 4.2 uses the cwcli interface to resolve Best Practice Deviations.


OL-25942-01

Chapter 5 Fault and Events Reports Generic Online Diagnostics Syslogs


command1

command2

Example:

[10.77.209.131]

interface Fa0/1

no cdp enable

interface Fa0/2

no cdp enable

[cfm-sw1]

interface Fa0/2

no cdp enable

interface Fa0/3

no cdp enable

Generic Online Diagnostics SyslogsYou can use Custom Reports along with Syslogs to generate GOLD test reports.

Before you generate reports, you need to configure those devices on which GOLD tests are configured, to send Syslog messages to the LMS server.

Each device sends out Syslog messages after running each diagnostic test. You can identify the GOLD Syslog messages, based on their facility names. The facility names for GOLD Syslog messages will consist of DIAG or CONST-DIAG.

You can use the Syslog GOLD Custom report to ascertain the results of the test run on each device.

The fields in the generated Syslog GOLD Custom Report are given below:

Field Description

Device Name Name of the device generating the Syslog message.

Interface Name or IP Address of the interface in the device generating the Syslog message.


OL-25942-01


Timestamp Time when the Syslog message was generated.

The format used by timestamp is:

mmm dd yyyy hh:mm:ss

where:

mmm represents month

dd represents date

yyyy represents year

hh represents hour

mm represents minute

ss represents second

Example:

Nov 18 2008 12:24:36

Facility/Sub Facility Displays the facility or sub-facility codes.

A facility is a hardware device, a protocol, or a module of the system software.

See System Error Messages in the Cisco IOS Reference manual, for a predefined list of system facility codes.

A sub-facility is the facility in the device that generates the Syslog message.

Severity Displays the message severity levels.

The severity codes are:

0—Emergencies

1—Alerts

2—Critical

3—Errors

4—Warnings

5—Notifications

6—Informational

Mnemonics Codes that uniquely identifies an error message.

Example:

TEST_RUNNING

TEST_OK

Description Description of each Syslog message.

Details Other details for each Syslog message.

Field Description


OL-25942-01


To generate this report:

Step 1 Select Reports > Fault and Event > Syslog > Generic Online Diagnostics Syslogs

or

Monitor > Diagnostic Tools > Generic Online Diagnostics > Syslogs.

Step 2 Select the required devices using the Device Selector or Group Selector.

For details about the Device Selector and Group Selector, see the topic Using Device Selector in the section Administration of Cisco Prime Lan Management Solution 4.2.

Step 3 Enter the information required to generate the required report:

Field Description

Date Range

Last X Select this option, if you want to generate a report for the last X days or weeks or months or years,

where X represents the number of days or weeks or months or years.

For example, if you want to generate a Syslog Standard report for the last 4 days, you can enter 4 in the textbox and select Days from the listbox.

The generated report will consist of Syslog data gathered for the last 4 days. This option applies only to Syslog Standard Reports.

24 Hours Select this option, only if you want to generate a 24-Hour Report. This report will contain all the syslog data gathered during the last 24 hours. For example, if you select this option and schedule the report to be generated at 6.p.m. the report will have the data of the past 24 hours, from 6 p.m.

From Click on the calendar icon and select the date. The date appears in the dd-mmm-yyyy format in the From field. For example, 02-May-2010.

The From field is enabled only if you have deselected the 24 Hours check box.

To Click on the calendar icon and select the date. The date appears in the dd-mmm-yyyy format in the To field. For example, 03-Dec-2004.

The To field is enabled only if you have de-selected the 24 Hours check box.


OL-25942-01


Scheduling

Run Type Select the frequency at which the job should be run:

• Immediate—Runs the report immediately.

• 6 - hourly—Runs the report every 6 hours, starting from the specified time.


• Once—Runs the report once at the specified date and time.

• Daily—Runs the report daily at the specified time.

• Weekly—Runs the report weekly on the specified day of the week and at the specified time.

• Monthly— Runs the report monthly on the specified day of the month and at the specified time.

In the case of periodic jobs, the subsequent instances of jobs will run only after the earlier instance of the job is complete.

For example: If you have scheduled a daily job at 10:00 a.m. on November 1, the next instance of this job will run at 10:00 a.m. on November 2 only if the earlier instance of the November 1 job has been completed. If the 10.00 a.m. November 1 job is not completed before 10:00 a.m. November 2, then the next job will start only at 10:00 a.m. on November 3.

If you select Run type Immediate, the Date, Job Description, and e-mail option will be disabled for you.

If you select any other run type, then you can specify the start date and time, the job description (man-datory), and the e-mail ID for notification after the report is generated.

Date Select the start date using the calendar icon, to enter date in the dd-mmm-yyyy format, for example, 02-Dec-2004. Date is a mandatory field.

If Run Type is Immediate, the system date is automatically selected.

at Select the hours and minutes from the drop-down list.

Field Description


OL-25942-01

Chapter 5 Fault and Events Reports Embedded Event Manager Syslogs Reports

Step 4 Click Finish.

Embedded Event Manager Syslogs ReportsYou can use Custom Reports along with Syslogs to generate Embedded Event Manager reports.

Before you generate reports, you need to configure those devices on which EEM is configured, to send Syslog messages to the LMS server.

Each device sends out Syslog messages after running each EEM policy. You can identify the EEM Syslog messages, based on their facility names. The facility names for EEM Syslog messages will consist of HA_EM.

You can use the Syslog Embedded Event Manager Custom report to ascertain the results of the scripts run on each device.

Job Info

Job Description Enter a description for the report that you are creating.

The Job Description field is enabled only if you have selected an option other than Immediate in the Run Type field. This field is mandatory and accepts alpanumeric characters.

E-mail Enter the e-mail ID of the user who should be notified when the report is generated. You can enter more than one e-mail ID, separated by commas.

The E-mail ID field is enabled only if you have selected an option other than Immediate, in the Run Type field.

Configure the SMTP server to send e-mails in the View / Edit System Preferences dialog box (Admin-istration > System Administration > Server Administration> System Preferences).

We recommend that you configure the Cisco Prime e-mail ID in the View / Edit System Preferences dialog box (Administration > System Administration > Server Administration > System Prefer-ences). When the job completes, an e-mail is sent with the Cisco Prime e-mail ID as the sender address

Attachment Select this option if you want to send attachments into send attachments in the job notification mail.

Either select:

• CSV if you want the attachment in CSV format.

Or

• PDF if you want the attachment in PDF format. PDF is the default format.

The CSV and PDF radio options will be enabled only if the Attachment check box is selected.

Field Description


OL-25942-01


The fields in the generated Syslog EEM Custom Report are given below:

Field Description


Interface Name or IP Address of the interface in that device generating the Syslog message.




where:


dd represents date


hh represents hour



Example:

Nov 18 2008 12:24:36







0—Emergencies

1—Alerts

2—Critical

3—Errors

4—Warnings

5—Notifications

6—Informational


Example:

LOG




OL-25942-01


To generate this report:

Step 1 Select Reports > Fault and Event > Syslog > Embedded Event Manager Syslogs

or

Monitor > Diagnostic Tools > Embedded Event Manager > Syslogs.




Field Description

Date Range






From Click on the calendar icon and select the date. The date appears in the dd-mmm-yyyy format in the From field. For example, 02-Dec-2004.

The From field is enabled only if you have de-selected the 24 Hours check box.

To Click on the calendar icon and select the date. The date appears in the dd-mmm-yyyy format in the To field. For example, 03-May-2010.

The To field is enabled only if you have de-selected the 24 Hours check box.


OL-25942-01


Scheduling












If you select any other run type, then you can specify the start date and time and also provide the job description (mandatory) and the e-mail ID for notification after the report is generated.



at Select the hours and minutes from the drop-down list.

Field Description


OL-25942-01

Chapter 5 Fault and Events Reports Starting Fault History


Starting Fault History To gather historical information on alerts and events in the past 31 days, start Fault History by selecting Reports > Fault and Events > Device Fault History. The following topics explain how you can apply filters and generate reports based on all of the saved information in the Fault History database:

• To search for alerts based on device groups or individual devices, see Searching for Faults on Devices or Device Groups.

• To search for information using alert or event criteria, see Searching for Faults Using Event or Alert Criteria.

This section also explains

• Understanding the Fault History: Alerts and Activities Display

• Understanding the Fault History: Events Display

Job Info


The Job Description field is enabled only if you have selected an option other than Immediate in the Run Type field. The field is mandatory and accepts alpanumeric characters.



Configure the SMTP server to send e-mails in the View / Edit System Preferences dialog box (Admin-istration > System > System Preferences).

We recommend that you configure the Cisco Prime e-mail ID in the View / Edit System Preferences dialog box (Administration > System > System Preferences). When the job completes, an e-mail is sent with the Cisco Prime e-mail ID as the sender's address


Either select:


Or



Field Description


OL-25942-01


Searching for Faults on Devices or Device GroupsTo get information about the alerts and events that occur on a specific device or device group, use the Group/Device Filtering option.

A link to Fault History is also provided in the Device Center, which provides a number of device-centric troubleshooting tools.

This Fault History link is useful when you are troubleshooting a specific device, allowing you to quickly search the Fault History database for problems on that device. For more information, select Device Diagnostic Tools > Device Center and click Help.

Step 1 Select Reports > Fault & Event > History > Device Fault.

The Fault Monitor History Report page appears.

Step 2 Select the devices in which you are interested from the device selector.

With many devices, it can sometimes be difficult to locate the devices you are interested in. To assist you in locating devices, use the search option in the device selector.

The device selector includes devices that were removed from the inventory; therefore you can still search for information on those devices.

Step 3 To search for events:

a. Select View Event in the View Option drop-down list.

b. Select the search date, event severities, and events. Use the Event Description popup to select multiple events. If you select any severity, the events list is filtered accordingly.

Step 4 Click View.

If Fault History finds more than 2,000 records, a popup window reports the total number of records found.

If Fault History finds more than 2,000 records based on your search criteria, you can view them by clicking the Export button (in the upper-right corner of the display) and saving your report to a PDF or CSV file.

Searching for Faults Using Event or Alert CriteriaTo get information about all instances of alerts and events that occur in your network, use the Alert/Event ID Filtering option.

Step 1 Select Reports > Fault & Event > History > Event Fault.

The Event Fault History page appears.

Step 2 Select the search date

Step 3 Enter the Event ID.

Step 4 Click View.

If Fault History finds more than 2,000 records, a popup window reports the total number of records found. You can view these records by clicking the Export button (in the upper-right corner of the display) and saving your report to a PDF or CSV file.


OL-25942-01


8 PM Active Faults Report

8 PM Active Faults Report is an autogenerated report which displays the active faults in the server. This report is generated everyday at 8 PM and is stored at CSCOpx\etc\tis\ReportRoot. The last two reports only are available in this location.

Understanding the Fault History: Alerts and Activities DisplayThe Fault History: Alerts and Activities display is shown in tabular form.

The tabular display is a scrollable table that lists up to 2,000 records, based on your filtering criteria. If you want to view database contents beyond the 2,000 records, click the Export tool button in the upper-right corner.

The Fault History: Alerts and Activities display provides Export and Printer-friendly tools.

Table 5-9 describes the contents of the Fault History: Alerts and Activities tabular display.

Heading Description

Event ID The unique event identifier number.

Device Name Device name or IP address.

State Severity classification. It could be:

• Critical

• Warning

• Informational

Description Event description (user-defined or default).

Component The component of the device where the fault was encountered. Refer to Understanding the Detailed Device View in Monitoring and Troubleshooting with Cisco Prime Lan Management Solution 4.2

Creation Time Date and time when the fault was generated.

Table 5-9 Fault History: Alerts and Activities Tabular Display—Contents

Heading Description

Alert ID Alert identifier number. Clicking this link opens the Fault History: Events display which provides details about the events associated with the alert.

Device Name Device name or IP address.

Device Device type. Learning indicates that LMS was discovering the device at the time of the alert. The actual device type is reflected when new events occur.

For more information, see Using Device Management in Inventory Management with Cisco Prime Lan Management Solution 4.2.


OL-25942-01


Understanding the Fault History: Events DisplayThe Fault History: Events display is shown in a table.

The tabular display is a scrollable table that lists up to 2,000 records, based on your filtering criteria. If you want to view database contents beyond the 2,000 records, click the Export tool button in the upper-right corner.

The Fault History: Events display provides Export and Printer-friendly tools.

Table 5-10 describes the contents of the Fault History: Events tabular display.

Description Alert category, which can be anyone of the following: Application, Connectivity, Environment, Interface, Other, Reachability, System Hardware, and Utilization.

For alerts containing multiple events, the tabular display shows the category of the event with the most recent change.

Severity Critical or Informational.

Time Date and time when the alert was generated.

Status Alert status, based on last polling. Clicking this link opens the Alert Annotation page, which contains user annotations associated with the alert.

Active Alert is live.

Cleared Alert is no longer live. Also, when a device is suspended, all alerts are cleared.

When LMS polling determines that the alarm has been in the Cleared state for 30 minutes or more (from the time of polling), the alarm expires and is removed from the Alerts and Activities display.

Acknowledged Alert was manually recognized by a user (from Alerts and Activities Detail display).

Table 5-9 Fault History: Alerts and Activities Tabular Display—Contents (continued)

Heading Description

Table 5-10 Fault History: Events Tabular Display—Contents

Heading Description

Event ID Event identifier number. Clicking this link opens the event properties page, which describes the value of MIB attributes at the time of the event.

Device Name Device name or IP address. If the LMS server is using Access Control Server (ACS) mode, ACS may limit the devices you are permitted to view and for which you can create Fault History displays.

For more information, see Device-Based Filtering.

Component Device element on which the event occurred.

Description Event name. You can also customize the names of events displayed by Fault History (and the Alerts and Activities display) using the Notification Customization feature in Notification Services.

Time Date and time when the event was generated.


OL-25942-01

Chapter 5 Fault and Events Reports Generating a PSIRT Summary Report

Generating a PSIRT Summary ReportYou can generate a PSIRT Summary Report based on the PSIRT information retrieved from Cisco.com at regular intervals. This report helps you to ascertain the security vulnerabilities that affect the devices in your network.

The PSIRT report provides a summary of the possible security alerts based on the selected devices.

The generated PSIRT Report shows:

• Count of the total number of devices selected for report generation.

• Count of devices with vulnerability

• Last Cisco.com Fetch Date

• Two tables categorized based on:

– PSIRT ID

– Device

Table 5-11 lists and describes the fields in the By PSIRT table. Click on a specific field ID to sort the information based on a this field.

Table 5-12 lists and describes the fields in the By Device table. Click on any field ID to sort the information based on a selected field.

For more information on the fields in the PSIRT Summary Report tables, see Fields in the PSIRT Summary Report tables.

You can also click on any of the PSIRT Document ID links to get more information about the devices affected by PSIRT ID. When you click the PSIRT Document ID, an external web page opens with more details of that particular PSIRT.

Note The PSIRT Summary report displays PSIRTs only for Cisco IOS device categories.

Status Event status, based on last polling.

Active Event is live.

Cleared Event is no longer live. Also, when a device is suspended, all alerts are cleared.

When LMS polling determines that an alarm has been in the Cleared state for 30 minutes or more (from the time of polling), the alarm expires and is removed from the Alerts and Activities display.

Suspended Device is suspended.

Resumed Device is being resumed.

Deleted Device has been deleted.

Alert ID Alert identifier number associated with this event.

Table 5-10 Fault History: Events Tabular Display—Contents (continued)

Heading Description


OL-25942-01


Fields in the PSIRT Summary Report Tables

Fields in the PSIRT Summary Report tables

Table 5-11 provides description for the fields in the By PSIRT table.

Table 5-11 By PSIRT Table

Table 5-12 provides description for the fields in the By Device table.

Table 5-12 By Device Table

To generate the report:

Step 1 Select Reports > Fault and Event > PSIRT Summary.

The PSIRT Summary Report page appears.

Step 2 Select the required devices using the Device Selector or groups from the Group Selector. (See the topic, Using Device Selector in the section Administration with Cisco Prime Lan Management Solution 4.2, for more details.)

Field Description

PSIRT Document ID Document ID of the PSIRT announcement.

Click on the PSIRT Document ID for more information on that PSIRT.

Announced Date Date on which the PSIRT announcement was released in Cisco.com.

Description Brief description of the security vulnerability.

Severity Severity classification for the PSIRT. It could be:

• High

• Medium

• Low

IOS Versions Impacted IOS software version that is impacted by the PSIRT.

Image File Names Name of the image file.

Number of devices affected Count of the number of devices affected by the PSIRT.

Fixed in IOS Versions IOS software version that has the fix to the security vulnerability.

You can upgrade to this fixed IOS version to overcome the security vulnerability.

Field Description

Device Name Name or IP address of the device.

Device Model Model of the device.

PSIRT Document Id Document ID of the PSIRT announcement.

Click on the PSIRT Document ID for more information on that PSIRT.

IOS Version IOS software version that is impacted by the PSIRT.

Location Physical location of the affected device in the network.


OL-25942-01


Step 3 Enter the information required to generate the report:

Table 5-13 Fields in 24-hour Inventory Change report

Field Description

Scheduling

Run Type Specifies the type of schedule for the job:







• Monthly—Runs the report monthly on the specified day of the month and at the specified time.

For periodic jobs, the subsequent instances of jobs will run only after the earlier instance of the job is complete.

For example, if you have scheduled a daily job at 10:00 a.m. on November 1, the next instance of this job will run at 10:00 a.m. on November 2, only if the earlier instance of the November 1 job has been completed. If the 10.00 a.m. November 1 job is not completed before 10:00 a.m. November 2, then the next job will start only at 10:00 a.m. on November 3.

If you select Immediate, all other options are disabled.

If you select any option other than Immediate, then you can specify the start date and time and also provide this information:

• Job Description—Enter the description of the job. A mandatory field. Enter up to 256 characters (alpha-numeric).

• E-mail ID—Enter e-mail addresses to which the job sends notification messages that have to be sent after the report is run. An optional field.

You can enter multiple e-mail addresses, separated by commas.

Configure the SMTP server to send e-mails in the View / Edit System Preferences dialog box (Admin > System > System Preferences).

We recommend that you configure the Cisco Prime E-mail ID in the View/Edit System Preferences dialog box (Admin > System > System Preferences). When the job starts or completes, an e-mail is sent with the Cisco Prime e-mail ID as the sender address.

Date Click on the calendar icon and select the date.


Select the hours and minutes from the drop-down lists. If the Run Type is Immediate, the system time is auto-matically selected.


OL-25942-01

Chapter 5 Fault and Events Reports Generating Syslog Reports


The specified report appears in a separate browser window.

You can click Reset All to reset your selections for all groups. This resets all previous values to blanks.

Generating Syslog ReportsThis section explains:

• Custom Reports

• Generating a 24-Hour Report

• Generating a Custom Summary Report

• Generating a Severity Level Summary Report

• Generating a Standard Report

• Devices with no Syslog

• Bottom N Device Report

Job Info

Job Descrip-tion

Enter a description for the report that you are scheduling.

The Job Description field is enabled only if you have selected an option other than Immediate in the Run Type field. This is a mandatory field. Accepts alphanumeric values. The field is restricted to 256 characters.

E-mail Enter a valid e-mail IDs of the users who should be notified when the report job has run. You can enter multiple e-mail addresses, separated by commas.

Configure the SMTP server to send e-mails in the View/Edit System Preferences dialog box (Admin > System > System Preferences).

We recommend that you configure the Cisco Prime e-mail ID in the View / Edit System Preferences dialog box (Admin > System > System Preferences). When the job starts or completes, an e-mail is sent with the Cisco Prime e-mail ID as the sender's address.

The e-mail field is enabled only if you have selected an option other than Immediate, in the Run Type field.


Either select:


Or



If the Attachment option is disabled, change the settings. For more information on configuring attachment settings, and the maximum size of attachments allowed in notification mails, see Administration of Cisco Prime Lan Management Solution 4.2

Table 5-13 Fields in 24-hour Inventory Change report

Field Description


OL-25942-01


• Top N Device Report

• Generating an Unexpected Device Report

Custom ReportsThe following custom reports can be generated using Fault and Event reports of the Report Center in LMS 4.2 :

• CPU Hog Report

• Catalyst Integrated Security Features Report

• Configuration Changes Report

• Duplicate IP Address Report

• Embedded Event Manager

• Environmental Monitor report

• Flash Memory Error Report

• Generic OnLine Diagnostics

• IOS Firewall Application level Intrusion

• IOS Firewall Denial of Service Report

• IPSLA Threshold Violations Reports

• Memory Allocation Failure Report

• PIX Incoming TCP or UDP Connections DoS Report

• PIX Outgoing TCP or UDP Connections DoS Report

• PoE Max Power Violation Report

• Reload Report

• Severity Levels 0 and 1 Report

• Severity Levels 2 Report

• uBR Severity Levels 0 and 1 Report

• uBR Severity Levels 2 Report

• Auto Smartport

• Smart Install

To generate these reports:

Step 1 Select Reports > Fault and Event > Syslog.

Step 2 Select the required report from the list of reports.





OL-25942-01


Field Description

Date Range









The To field is enabled only if you have deselected the 24 Hours check box.

Scheduling











If you select Run type Immediate, the Date, Job Description, e-mail attachment option, and Use Local Publish Path will be disabled for you.

If you select any other run type, then you can specify the start date and time and also provide the job description (mandatory) and the e-mail ID for notification after the report is generated. You can also download the generated report in your local folder using the Use Local Publish Path option.



at Select the hours and minutes from the drop-down lists.


OL-25942-01


Note In addition to the Date Range for Generating Syslog Report, an option to select Time is also available from Cisco Prime LAN Management Solution 4.2.1.


The fields in the generated custom report are given below:

Job Info






We recommend that you configure the Cisco Prime e-mail ID in the View / Edit System Preferences dialog box (Administration > System Administration > Server Administration > System Prefer-ences). When the job completes, an e-mail is sent with the Cisco Prime e-mail ID as the sender's address

Attachment Option Select the checkbox if you want to send attachments in the job notification mail.

Select either of the following Report Types:


Or


The CSV and PDF radio options will be enabled only if the Attachment Option check box is selected.

Use Local Publish Path

Select the checkbox to specify a folder in your local server for the generated report to be downloaded.


Field Description

Field Description


Interface Name or IP Address of the interface in that device generating the Syslog message.


OL-25942-01





where:


dd represents date


hh represents hour



Example:

Nov 18 2008 12:24:36





Field Description


OL-25942-01


Generating a 24-Hour ReportTo create a 24-Hour Report:

Step 1 Select Reports > Fault and Event > Syslog > 24-Hour.






0—Emergencies

1—Alerts

2—Critical

3—Errors

4—Warnings

5—Notifications

6—Informational


Example:

TEST_RUNNING

TEST_OK



Field Description

Field Description

Date Range







OL-25942-01






Scheduling
















Field Description


OL-25942-01




Fields in the 24-Hour Report are the same as in the Standard Report. See Generating a Standard Report.

Generating a Custom Summary ReportThe Custom Report Summary Reports option lets you display a list of all custom syslog reports. All syslog reports display message log information.

To create a Custom Summary Report:

Step 1 Select Reports > Fault and Event > Syslog > Custom Summary.


Job Info





Configure the SMTP server to send e-mails in the View / Edit System Preferences dialog box (Admin > System > SMTP Default Server).

We recommend that you configure the Cisco Prime e-mail ID in the View / Edit System Preferences dialog box (Admin > System > System Preferences). When the job completes, an e-mail is sent with the Cisco Prime e-mail ID as the sender's address

Attachment Select the checkbox if you want to send attachments in the job notification mail.



Or






Field Description


OL-25942-01


For details about the Device Selector or group Selector, see the topic Using Device Selector in the section Administration of Cisco Prime Lan Management Solution 4.2 .


Field Description

Date Range










Scheduling














OL-25942-01





Field Description


OL-25942-01




The fields in the Syslog Custom Summary Report are given below:

Job Info










Or






Field Description

Field Description

Custom Report Name Name of the Custom Report.

Total number of records Number of records that have been generated for each report.


OL-25942-01


Generating a Severity Level Summary ReportThe Severity Level Summary report shows the number of emergencies, alerts, critical, errors, warnings, notifications, and informational messages that each device has logged.

To create a Severity Level Summary Report:

Step 1 Select Reports > Fault and Event > Syslog > Severity Level Summary.




Field Description

Date Range











OL-25942-01


Scheduling
















Job Info







Field Description


OL-25942-01




The fields in the Severity Level Summary Report are given below:

You can click on any of the field titles to sort the report based on that field.

Generating a Standard ReportYou can generate a system message report for a device or set of devices. You can run a report for a date or range of dates and base the report on the message severity or alert types. All Syslog reports display message log information.




Or






Field Description

Field Description

Device Name Name of the device from which syslog messages are received.

Emergencies Number of emergency messages received from the device.

Alerts Number of alert messages received from the device.

Critical Number of critical messages received from the device.

Errors Number of error messages received from the device.

Warnings Number of warning messages received from the device.

Notifications Number of notification messages received from the device.

Informational Number of informational messages received from the device.

Debugging Number of debug messages received from the device.


OL-25942-01


Note When you are generating a Standard Report, you may get an out of memory exception. This may occur if the number of syslog messages that were generated in the date range that you specified in the report job, exceeded six hundred thousand. Decrease the period, that is, specify a shorter date range, and run the report job again.

To create a Standard Report:

Step 1 Select Reports > Fault and Event > Syslog > Standard.




Field Description

Date Range











OL-25942-01


Scheduling










For example: If you have scheduled a daily job at 10:00 a.m. on November 1, the next instance of this job will run at 10:00 a.m. on November 2 only if the earlier instance of the November 1 job has com-pleted. If the 10.00 a.m. November 1 job is not completed before 10:00 a.m. November 2, then the next job will start only at 10:00 a.m. on November 3.






Field Description


OL-25942-01




The fields in the Standard Report are given below:

Job Info









CSV if you want the attachment in CSV format.

Or

PDF if you want the attachment in PDF format. PDF is the default format.





Field Description

Field Description Link

Device Name Name of a device (switch or router) that caused the Syslog message. None.

Interface The IP address of the interface through which the syslog was sent out. None.

Timestamp Date and time at which the message was logged. This is the timestamp provided by the device. Syslog Analyzer provides a timestamp if the device does not send one.

None.


OL-25942-01


Devices with no SyslogDevices with no Syslog Report shows the devices generating nil syslogs.

To create a Devices with no Syslog Report:

Step 1 Select Reports > Fault and Event > Syslog > Devices with no Syslog.


Facility-SubFacility • Facility is a hardware device, a protocol, or a module of the system software; for example, SYS. Refer to the Cisco IOS reference manual System Error Messages for a predefined list of facility codes.

• SubFacility is the facility in the device that generated the Syslog message. In most cases, subfacility is blank. An example of an entry in this field is SYS-5-CONFIG I.

None.

Severity Message severity level, which can vary from informational (6) to emergency (0).

None.

Mnemonic Code that uniquely identifies the error message. Note that older Catalyst messages do not display a mnemonic. An example of a mnemonic for an IOS message is CONFIG I.

None.

Description Syslog message description. None.

Details Name of the Syslog message.

Displays a new window containing the Syslog message description. The User_URL icon is a link to a customized web page, if you have defined one; otherwise, it defaults to a sample Perl script for creating a user URL.

This column contains a hy-perlinked asterix ('*'). When you click the '*', the description of the Syslog message is displayed.


Field Description

Date Range









OL-25942-01




Scheduling
















Field Description


OL-25942-01




Bottom N Device ReportBottom N Device Report shows all the devices generating the least number of syslogs.

To create a Bottom N Device Report:

Step 1 Select Reports > Fault and Event > Syslog > Bottom N Device.


Job Info








Either select:


Or



Field Description


OL-25942-01


Field Description

Bottom N Devices

Number of Devices The total number of devices to be shown in the report.


Representations for the severity codes are:

0—Emergencies

1—Alerts

2—Critical

3—Errors

4—Warnings

5—Notifications

6—Informational

Date Range











OL-25942-01


Scheduling
















Field Description


OL-25942-01




Top N Device ReportTop N Device Report shows the devices generating maximum number of syslogs.

To create a Top N Device Report:

Step 1 Select Reports > Fault and Event > Syslog > Top N Device.


Job Info








Either select:


Or


Field Description

Field Description

Top N Devices

Number of Devices The total number of devices to be shown in the report.


OL-25942-01



Representations for the severity codes are:

0—Emergencies

1—Alerts

2—Critical

3—Errors

4—Warnings

5—Notifications

6—Informational

Date Range










Field Description


OL-25942-01


Scheduling
















Field Description


OL-25942-01




Generating an Unexpected Device ReportYou can generate a report of syslog information for all unmanaged devices in your network. All syslog reports display message log information.

Before you can manage a device, you must add a device to the DCR (see the topic Adding Devices in Inventory Management with Cisco Prime Lan Management Solution 4.2 . After the device is added, however, Syslog messages received before adding the device, remain in this report because the Syslog Analyzer does not modify message status.

To create a Unexpected Device Report:

Step 1 Select Reports > Fault and Event > Syslog > Unexpected Device.


Job Info








Either select:


Or



Field Description


OL-25942-01


Field Description

Date Range










Scheduling

















OL-25942-01




The fields in the Unexpected Device Report are:

Job Info








Either select:


Or



Field Description


Device Name Name or IP of the device (switch or router) that caused the Syslog message.

None.

Time Date and time the message was logged. This is the timestamp provided by the device. Syslog Analyzer provides a timestamp if the device does not send one.

None.


OL-25942-01

Chapter 5 Fault and Events Reports IPSLA Summarized Reports - Violation

IPSLA Summarized Reports - ViolationTo create IPSLA Summarized Reports:

Step 1 Select Reports > Fault and Event > Threshold Violation > IPSLA.

Step 2 Specify the details as required.

For more information on specifying the details, see Table 5-14.

Facility-SubFacility • Facility is a hardware device, a protocol, or a module of the system software; for example, SYS. Refer to the Cisco IOS reference manual System Error Messages for a predefined list of facility codes.

• Subfacility is the facility in the device that generated the Syslog message. In most cases, subfacility is blank.

An example of an entry in this field is:

SYS-5-CONFIG I.

None.



0—Emergencies

1—Alerts

2—Critical

3—Errors

4—Warnings

5—Notifications

6—Informational

None.

Mnemonic Code that uniquely identifies the error message. Note that older Catalyst messages do not display a mnemonic. An example of a mnemonic for an IOS message is CONFIG I.

None.

Description Syslog message description. None.

Details Name of the Syslog message.

Displays a new window containing the Syslog message description. When you click on the User_URL icon, you link to a customized web page, if you have defined one; otherwise, it defaults to a sample Perl script for creating a user URL.

This column contains a hy-perlinked asterix ('*'). When you click the '*', the description of the Syslog message is displayed.


Table 5-14 Generating Summarized Reports

Field Name Description

Report Details

Name Enter the name of the report you want to customize.

Description Enter the description of the report.


OL-25942-01


Schedule

Schedule Type Select the schedule type from the drop-down list. There are five schedule types:

• Immediate— Schedules the report immediately. The report will contain data based on the selected Report period such as Instance Type or Custom.

• Once—Schedules the report only once. This report will contain the data based on the selected Report period such as Instance Type or Custom.

• Daily—The report is generated everyday at the time specified. The report will contain the data for the last 24 hours. If you select Daily, the Report period details are disabled.

• Weekly—The report is generated once a week on the date and time specified. This report will contain the data of the last seven days. If you select Weekly, the Report period details are disabled.

• Monthly—The report is generated once a month on the day and time specified. This report will contain the data of the last 30 days. If you select Monthly, the Report period details are disabled.

Job Scheduled Date Specify the date and time at which the job is scheduled at. The Job Schedule Date should be greater than the To date that you have specified in the Report Period section.

This field is disabled if you have selected Immediate as the Schedule Type

Table 5-14 Generating Summarized Reports (continued)



OL-25942-01


Report Period

Instance Type Select the Instance Type from the drop-down list. There are five instance types.

Latest Polled — Polls the job report immediately. This instance will contain the latest polled data.

Last One Hour — Polls the job report for the last one hour. This instance will contain the polled data of the last one hour.

Last One Day— Polls the job report for the last one day. This instance will contain the polled data for the last 24 hours.

Last One Week — Polls the job report for the last one week.This instance will contain the polled data for the last seven days.

Last One Month — Polls the job report for the last month.This instance will contain the polled data for the last four weeks.

Custom If you select Custom:

Specify the From and To time period of the Report.

The Custom details are disabled if you have selected the Instance Type.

Report Range

Select Report Range If you select Availability as the Report:

Then enter the Report Range percentage in the From and To column.

If you select Jitter or Latency, as the Report then the following Report range types are displayed:

All— If you have selected All, then a report will be generated for all collectors and sorted based on Latency or Jitter from highest to Lowest

TOP- 10— If you have selected TOP-10, then the top 10 collectors with the highest value will be listed in the report and sorted based on Latency or Jitter from highest to lowest.

TOP-20— If you have select TOP-20, then the top 20 collectors with the highest value will be listed in the report and sorted based on Latency or Jitter from highest to lowest.

If you select Violation as the Report, then the Report Range field does not appear.




OL-25942-01


Report Publish Location

Report Publish Path Use the Browse button to locate the directory in which you want to save the report.

The reports are saved in PDF format or CSV format.

However by default the reports are saved in PDF format.


The stored report is in a tabular format.

This field is disabled if you have selected Immediate as the Schedule Type.

• If the report publish location is specified, without e-mail notification option, then the reports will be published in PDF format in the specified path.

• If the report publish location is specified, with attachment option as PDF, then the reports will be published in PDF format and an e-mail notification will be sent with attachment as PDF.

• If the reports publish location is specified, with attachment option as CSV, then the reports will be published in CSV format and email notification will be sent with attachment as CSV.

Outage Option

Exclude Planned Outage Periods

The Outage check box will be enabled only for IPSLA Reports (Availability Hourly) and not for IPSLA Summarized Reports.




OL-25942-01

Chapter 5 Fault and Events Reports Threshold Violations Report

Step 3 Click Generate Report.

The report is generated.

To view the graph, click the Graph hyperlink in the table.

Threshold Violations ReportThis report displays the Threshold Violations details for each device based on the polled data. The information is presented using tables.

You can export the report only to CSV format. This report displays only the latest 1000 Threshold violations. Generate the PDF report to view all violations.

Email Notification

Email Address This field is disabled if you have selected Immediate as the Schedule Type.

This e-mail notification includes the following details:

• Job ID

• Main Report Name

• Report Type

• Job Name

• Schedule Type

• Schedule Date and Time

• Report Period

• Attachment option (If the attachment option is enabled)

Enter e-mail addresses to which the job sends messages at the beginning and at the end of the job. You can enter multiple e-mail addresses, separated by commas.

Configure the SMTP server to send e-mails in the View / Edit System Preferences

dialog box (Admin > System > System Preferences).

We recommend that you configure the Cisco Prime e-mail ID in the View / Edit System Preferences dialog box (Admin > System > System Preferences).

When the job starts or completes, an e-mail is sent with the Cisco Prime e-mail ID as the sender's address.

Email attachment You can now send an e-mail notification that include graphs and reports as attachments. You can send these attachments as either a PDF or a CSV file. The default is a PDF file.

If the attachment size exceeds the configured limit, a mail will be sent to the user with the message:

Attachment size exceeded.




OL-25942-01


Table 5-15 describes the fields in the Threshold Violations report.

Table 5-15 Threshold Violations Report Fields

Field Description

Threshold Violation Report Details

Report Name Name of the report. For example, Threshold Violations.

Generation Time Date and time at which the report was generated. For example, Mon, Apr 21 2009, 12:44:08

Start Date Start date and time of the report data. For example, Sun, Apr 20 2009, 12:44:03

End Date End date and time of the report data. For example, Mon, Apr 21 2009, 12:44:03

Threshold Violation Summary

No. of Devices Number of devices that participated in generating the report.

No. of Thresholds Number of thresholds configured for the device.

No. of Alarms Total number of alarms generated for the device.

Severity Severity level of the violation (such as Critical, Medium or Low).

Count Total number of violations in each severity level. For example,

• Critical: 50

• Low: 12

• Medium: 12

Low Violation Details

Threshold Name Name of the threshold. For example, CPU Threshold.

Rule Condition applied for monitoring threshold violation. For example, cpmCPUTotal5minRev >= 60%.

Device Name Displays the device name monitored for threshold violation. For example, 3500XL.

Instance Name Instance selected for monitoring threshold violation. For example, CPU of supervisor.

Time Stamp Time when the threshold violation occurred. For example, Mon, Apr 21 2008, 10:30:10


OL-25942-01


LMS 4.2 allows you to create reports based on the threshold configured for the MIB variable. You can create, edit, copy, and view reports for specific threshold MIB variables.

You can perform the following operations in Threshold Violation Report panel:

• Creating Threshold Violation Report

• Understanding Threshold Violation Report

Creating Threshold Violation ReportYou can create a Threshold Violation Report by selecting the Threshold Violations Report category and clicking the Create option.

To create a Threshold Violation Report:

Step 1 Select Reports > Fault and Event > Threshold Violation > Thresholds.

The Create Threshhold Violation Report dialog box appears

Step 2 Select one of the following from the drop-down list:

• Device Selector—All the devices, device type groups, user defined groups, and subnet groups that are being polled currently, in a tree format.

• Device Groups—All device groups being polled currently, in a tree structure.

• Port Groups—All port groups being polled currently, in a tree structure.

• Threshold Selector—All thresholds being polled currently, in a tree structure.

Medium Violation Details

Threshold Name Name of the threshold. For example, Memory Threshold.

Rule Condition applied for monitoring threshold violation. For example, ciscoEnvMonTemperatureStatusValue >= 5 Degree Celsius.

Device Name Device monitored for threshold violation. For example, 3500XL.

Instance Name Instance selected for monitoring threshold violation. For example, VTT 1 outlet temperature.

Time Stamp Time when the threshold violation occurred. For example, Mon, Apr 21 2008, 10:30:10

Critical Violation Details

Threshold Name Name of the threshold. For example, Processor Threshold.

Rule Condition applied for monitoring threshold violation. For example, cpmCPUTotal5minRev <= 30%.


Instance Name Instance selected for monitoring threshold violation. For example, Intel.

Time Stamp Time when the threshold violation occurred.

For example, Mon, Apr 21 2008, 10:30:10

Table 5-15 Threshold Violations Report Fields (continued)

Field Description


OL-25942-01


Enter the necessary information in the respective fields.

Table 5-16 describes the fields in the Create Threshold Violation Report dialog box.

Table 5-16 Create Threshold Violation Report Fields

Field/Button Description

Search Input Enter your search expression in this field.

You can enter the device name. For example, 3500XL.

Search Use the search icon to perform a simple search of devices, after you have entered your search input.

For more information on how to use Device Selector, see Inventory Management Guide for LMS 4.2.

Advanced Search Search for devices by specifying a set of rules.

For more information on Advanced Search, see Inventory Management Guide for LMS 4.2.

All Click All to view all the devices that are being polled currently.

Select the check boxes to select the devices.

Search Results Results from Search or Advanced Search.

Selection Devices that you have selected using the All tab and Search Results tab.

Threshold Selector All configured Thresholds, in a tree format.

Threshold Selector shows only the thresholds that are being polled currently.

You can use the search icon to perform a simple search of Thresholds, after you have entered your search input. Advanced Search is not available for Threshold Selector.

Date Range

Last Enter a value in the text field and select a time frame for your report.

You can only enter full days.

Select the time frame as Days, Weeks, Months or Years from the drop-down list.

For example, 5 Days, 2 Weeks, 3 Months, 2 Years.

From Specify the start date and time of your report.

Select the date by clicking the calendar icon and time from the drop-down list.

This field is disabled if you have selected Last as the Date Range.

To Specify the end date and time of your report.




OL-25942-01

http://www.cisco.com/en/US/products/sw/cscowork/ps3996/products_user_guide_list.html








Schedule

Run Type Select one of the following Run Types from the drop-down list:

• Immediate—Report is generated immediately.

• Once—Report is generated only once for set date and time.

• Daily—Report is generated daily at the scheduled time.

• Weekly—Report is generated weekly for the set date and time.

• Monthly—Report is generated monthly for the set date and time.

If From and To fields are selected in the Date Range field, only Immediate and Once are displayed in the Run Types drop-down list.

Date Specify the date and time of the job schedule.

The date should be later than the To date specified in the Date Range pane. The time should be later than the current time.

This field is disabled if you have selected Immediate as the Run Type.

Report Information

Report Name Enter a name for your report. The report name should be unique.

The name can contain a mix of alphabets, numerals, and some special characters (such as - _ .).

E-Mail ID Enter e-mail address to which the job sends messages regarding job status.

The e-mail address must be in the format: [email protected].

You can enter multiple e-mail addresses, separated by comma or semicolon.

Configure the SMTP server to send e-mails in the System Preferences dialog box (Admin > System > SMTP Default Server).

We recommend that you configure the Cisco Prime e-mail ID in the System Preferences dialog box (Admin > System > System Preferences).


Attach Report Select this check box to attach the report as a CSV file. By default a CSV file is sent to the e-mail address specified in the E-Mail ID field. If you select Add Full Report check box, instead of CSV a PDF format of the report will be sent as an attachment to the specified e-mail id.

You need to enable the e-mail Attachment check box and specify the Maximum Attachment size in the System Preferences dialog box (Admin > System > System Preferences) to send the report as an e-mail.

If the file size exceeds the Maximum Attachment size, the URL link of the report is sent as an e-mail. You can click the URL link to view the report.

Table 5-16 Create Threshold Violation Report Fields (continued)



OL-25942-01


Step 3 Select either Device Selector, Device Groups, Port Groups or Threshold Selector in the Create Threshold Violation Report dialog box.

Based on your selection either a list of devices or thresholds is listed, in a tree format.

Step 4 Select devices or thresholds from the relevant tree list.

Step 5 Update the necessary fields in the following panes:

• Date Range

• Schedule

• Report Information

See Table 5-16 for the description of the fields that appear in the Create Threshold Violation Report dialog box.

Step 6 Click Create to create the report or Reset to clear all the fields.

If you click Create a message appears confirming that the job is created successfully and the Job ID is displayed. You can see the created report in the Threshold Violations Report category tree list.

Report Publish Path Select the Default Path check box to publish the report at a specific location.

If you select the Default Path check box, it publishes the report in the default directory path.If you de-select the Default Path check box, it allows you to specify a directory path to which the report is published. If the directory path is not specified, then the report will be published to:

– For Windows: $NMSROOT\MDC\tomcat\webapps\upm\reports

– For Solaris / Soft Appliance: $NMSROOT/MDC/tomcat/webapps/upm/reports

A PDF format of the report (along with HTML and CSV formats) is published to the specified location.


Add Full Report Use the Add Full Report check box to create a PDF format of the report.

If you select this check box along with Attach Report check box, a PDF format of the report will be sent as an attachment to the specified e-mail id. If the file size exceeds the Maximum Attachment size, then a CSV file will only be sent as an attachment along with the URL link of the HTML report. You can download the PDF format of the report using the export option provided in the HTML report.

The PDF format of the report takes longer time to generate as it includes the report for all the polled devices.

Scheduling large PDF reports daily, results high CPU and memory usage. We recommend that you schedule small PDF reports at optimal time intervals.

Table 5-16 Create Threshold Violation Report Fields (continued)



OL-25942-01


You can go to the Report Job Browser page to check the status of the Report job.

Note If you select Immediate as the Run Type, in the Schedule pane, you can click Create and the report is generated immediately.

Understanding Threshold Violation ReportThis section describes the fields available in a Threshold Violation Report. The information in the Threshold Violation Report is presented using tables.

The Threshold Violation Report displays data only for the latest 1000 Threshold violations. Export the report to PDF to view all violations.

You can export the report to PDF or CSV file.

Table 5-17 describes the fields in a Threshold Violation Report.

Table 5-17 Threshold Violation Report Fields

Field Description

Threshold Violation Report Details

Report Name Name of the report.




Threshold Violation Summary

No. of Devices Number of devices included in generating the report.

No. of Thresholds Number of thresholds configured for the device.


Violation Severity level of the violation (such as Critical, Medium or Low).

Count Total number of violations that occurred in each severity level.

Violation Details

Threshold Name Name of the threshold configured.

Rule Condition applied for monitoring threshold violation. For example, cpmCPUTotal5minRev >= 5.0%


Instance Name Instances selected for monitoring threshold violation.

Time Stamp Time at which the threshold violation occurred.


OL-25942-01

Chapter 5 Fault and Events Reports TrendWatch Report

TrendWatch ReportCisco Prime LMS 4.2 allows you to create reports based on each TrendWatch configured for the MIB variables. You can create, edit, copy, and view reports for specific TrendWatch MIB variables.

This section contains:

• Creating a TrendWatch Report

• Editing a TrendWatch Report

• Copying a TrendWatch Report

• Viewing a TrendWatch Report

• Understanding TrendWatch Report

• Deleting a TrendWatch Report

Creating a TrendWatch ReportYou can create a TrendWatch Report by selecting the TrendWatch Report category and clicking the Create option.

To create a TrendWatch Report:

Step 1 Select Reports > Fault and Event > Threshold Violation > Trendwatch Details.

Step 2 Select Create from the context menu.

The TrendWatch Configuration dialog box appears.

See Creating a TrendWatch under Monitoring and Troubleshooting with Cisco Prime Lan Management Solution 4.2 for more information on creating a TrendWatch.

Editing a TrendWatch ReportYou can edit an existing TrendWatch Configuration Report by selecting a report name and clicking the Edit option.

You can edit Report Jobs only when the Run Status is in scheduled state. You cannot edit the Report Name field.

To edit a TrendWatch Configuration Report:


Step 2 Select Edit from the context menu.

The Edit TrendWatch Report dialog box appears, displaying the earlier settings.


OL-25942-01


Copying a TrendWatch ReportCisco Prime LMS 4.2 allows you to create a TrendWatch Configuration report from an existing report by clicking the Copy option.

You can modify the existing details available in the copied TrendWatch Configuration report.

To copy a TrendWatch Configuration Report:


The Reports page appears.

Step 2 Click to expand the TrendWatch Configuration Report category node.

The list of TrendWatch Configuration Reports appear in a tree view.

Step 3 Click the report name from the tree list.

Step 4 Select Copy from the context menu.

The Copy TrendWatch Configuration Report dialog box appears, displaying the earlier settings.

See Copying a TrendWatch for more information on copying a TrendWatch.

Viewing a TrendWatch ReportYou can view a TrendWatch Configuration Report by either clicking the report name or by clicking the Launch option.

If data for a report is not available, a message appears, Report Not Available. This message appears because information is not available for the specified duration or the report job has failed.

Note If the number of violations are more than 100, then the graphs will not be displayed in the HTML report. However, the graphs will be displayed in the PDF report.

To view a TrendWatch Configuration Report:


The Reports page appears.

Step 2 Click to expand the TrendWatch Configuration Report category node. The list of TrendWatch Configuration Reports appear in a tree view.

Step 3 Click the report name from the tree list.

Step 4 Select Launch from the context menu.

The corresponding report page appears, displaying the report details. For more information, see Understanding TrendWatch Report.

Click to collapse the TrendWatch Configuration Report category node..

You can also copy the URL of a report to clipboard..


OL-25942-01


Understanding TrendWatch ReportThis section describes the fields available in a TrendWatch Configuration Report. The information in the TrendWatch Configuration is presented using tables.

The TrendWatch Configuration Report displays data only for the latest 1000 TrendWatch violations. Export the report to PDF to view all violations.

You can export the report to a CSV file..

Table 5-18 describes the fields in a TrendWatch Violation Report.

Deleting a TrendWatch ReportTo delete a TrendWatch Report, delete the TrendWatch from the List of TrendWatches page. You cannot delete a TrendWatch Report from the Reports Management page.

Table 5-18 TrendWatch Violation Reports Fields

Field Description

TrendWatch Violation Report Details


Generation Time Date and time at which the report was generated. For example, Wed, Nov 21 2009, 12:44:08

Start Date Start date and time of the report data. For example, Wed, Nov 20 2009, 12:44:03

End Date End date and time of the report data. For example, Wed, Nov 21 2009, 12:44:03

TrendWatch Violation Summary


No. of TrendWatches Number of TrendWatches configured for the device.


Severity Severity level of the violation (such as Critical, Medium or Low).


TrendWatch Detailed Report

TrendWatch Name Name of the TrendWatch configured.

No. of Devices Number of devices on which the TrendWatch is configured.

TrendWatch Condition Condition applied for monitoring TrendWatch violation. For example, The Hourly Minimum of CPU Utilization template for the MIB variable,cpmCPUTotal5minRev is not equal to 1 and occurs atleast 1 time.

Device Name Displays the device name monitored for TrendWatch violation. For example, DeviceForCDA2.

Instance Name Instances selected for monitoring TrendWatch violation.

Time Stamp Time at which the TrendWatch violation occurred.


OL-25942-01

Chapter 5 Fault and Events Reports TrendWatch Summary Report

TrendWatch Summary ReportLMS 4.2 allows you to create consolidated reports based on the TrendWatches configured for the MIB variable. You can create, edit, copy, and view summary reports of TrendWatch MIB variables.

This section explains:

• Creating a TrendWatch Summary Report.

• Understanding TrendWatch Summary Reports

Creating a TrendWatch Summary ReportYou can create a TrendWatch Summary Report by selecting the TrendWatch Summary Report category and clicking the Create option.

To create a TrendWatch Summary Report:

Step 1 Select Reports > Fault and Event > Threshold Violation > Trendwatch Summary.

The Create TrendWatch Summary Report dialog box appears.

Step 2 Select one of the following from the drop-down list:

• Device Selector—All the devices, device type groups, user defined groups, and subnet groups that are being polled currently, in a tree format.

• Device Groups—All device groups being polled currently, in a tree structure.

• Port Groups—All port groups being polled currently, in a tree structure.

• Threshold Selector—All thresholds being polled currently, in a tree structure.

Step 3 Enter the required information in the fields.

Table 5-19 describes the fields in the Create TrendWatch Summary Report dialog box.

Table 5-19 Create TrendWatch Summary Report Fields


Device Selector All the devices and device type groups that are being polled currently, in a tree format.

Search Input Enter your search expression in this field.

You can enter the device name. For example, 3500XL.

Search Use the search icon to perform a simple search of devices, after you have entered your search input.

For more information on how to use Device Selector, see Inventory Management Guide for LMS 4.2.

Advanced Search Search for devices by specifying a set of rules.

For more information on Advanced Search, see Inventory Management Guide for LMS 4.2.

All Click All to view all the devices that are being polled currently.

Select the check boxes to select the devices or TrendWatches.

Search Results Results from Search or Advanced Search.


OL-25942-01








Selection Devices or TrendWatches that you have selected using the All tab and Search Results tab.

TrendWatch Selector All configured TrendWatches, in a tree format.

TrendWatch Selector shows only the TrendWatches that are being polled currently.

You can use the search icon to perform a simple search of TrendWatches, after you have entered your search input. Advanced Search is not available for TrendWatch Selector.

Date Range

Last Enter a value in the text field and select a time frame for your report.

You can only enter complete days. You cannot enter partial days.

Select the time frame as Days, Weeks, Months or Years from the drop-down list.

For example, 5 Days, 2 Weeks, 3 Months, 1Year.

From Specify the start date and time of your report.



To Specify the end date and time of your report.



Schedule

Run Type Select one of the following Run Types from the drop-down list:

• Immediate—Report is generated immediately.

• Once—Report is generated only once for set date and time.

• Daily—Report is generated daily at the scheduled time.

• Weekly—Report is generated weekly for the set date and time.

• Monthly—Report is generated monthly for the set date and time.

If From and To fields are selected in the Date Range field, only Immediate and Once are displayed in the Run Types drop-down list.

Date Specify the date and time of the job schedule.

The date should be later than the To date specified in the Date Range pane. The time should be later than the current time.

This field is disabled if you have selected Immediate as the Run Type.

Table 5-19 Create TrendWatch Summary Report Fields (continued)



OL-25942-01


Report Information

Report Name Enter a name for your report. The report name should be unique.

The name can contain a mix of alphabets, numerals,and some special characters (such as - _ .).

E-Mail ID Enter e-mail address to which the job sends messages regarding job status.

The e-mail address must be in the format: [email protected].

You can enter multiple e-mail addresses, separated by comma or semicolon.

Configure the SMTP server to send e-mails in the System Preferences dialog box (Admin > System > SMTP Default Server).

We recommend that you configure the Cisco Prime e-mail ID in the System Preferences dialog box (Admin > System > System Preferences).


Attach Report Select this check box to attach the report as a CSV file. By default a CSV file is sent to the e-mail address specified in the E-Mail ID field. If you select Add Full Report check box, instead of CSV a PDF format of the report will be sent as an attachment to the specified e-mail id.

You need to enable the e-mail Attachment check box and specify the Maximum Attachment size in the System Preferences dialog box (Administration > System Administration > Server Administration > System Preferences) to send the report as an e-mail.

If the file size exceeds the Maximum Attachment size, the URL link of the report is sent as an e-mail. You can click the URL link to view the report.




OL-25942-01


Step 4 Select either Device Selector, Device Groups, Port Groups, or TrendWatch Selector in the Create TrendWatch Summary Report dialog box.

Based on your selection, either a list of devices or TrendWatches is listed, in a tree format.

Step 5 Select devices or TrendWatches from the relevant tree list.

Step 6 Update the necessary fields in the following panes:

Report Publish Path Select the Default Path check box to publish the report at a specific location.

• If you select the Default Path check box, it publishes the report in the default directory path.

• If you de-select the Default Path check box, it allows you to specify a directory path to which the report is published. If the directory path is not specified, then the report will be published to:

– For Windows: $NMSROOT\MDC\tomcat\webapps\upm\reports

– For Solaris / Soft Appliance: $NMSROOT/MDC/tomcat/webapps/upm/reports

A PDF format of the report (along with HTML and CSV formats) is published to the specified location.


Add Full Report Use the Add Full Report check box to create a PDF format of the report.

If you select this check box along with Attach Report check box, a PDF format of the report will be sent as an attachment to the specified e-mail id. If the file size exceeds the Maximum Attachment size, then a CSV file will only be sent as an attachment along with the URL link of the HTML report. You can download the PDF format of the report using the export option provided in the HTML report.

The PDF format of the report takes longer time to generate as it includes the report for all the polled devices.

For the following reports, if you have selected more than the optimal limit of 3000 interfaces, the PDF format of these reports might not generate:

• Interface Utilization

• Interface Availability

• Interface Error Rate

Note Scheduling PDF reports with large number of data on a daily basis results in high CPU and memory usage. We recommend you to schedule PDF reports with less number of data at optimal time intervals.




OL-25942-01


• Date Range

• Schedule

• Report Information

See Table 5-19 for the description of the fields that appear in the Create TrendWatch Summary Report dialog box.

Step 7 Click Create to create the report or Reset to clear all the fields.

If you click Create a message appears confirming that the job is created successfully and the Job ID is displayed. You can see the created report in the TrendWatch Summary Report category tree list.

You can go to the Report Job Browser page to check the status of the Report job. .

Note If you select Immediate as the Run Type, in the Schedule pane, you can click Create and the report is generated immediately.

Understanding TrendWatch Summary ReportsThis section describes the fields available in a TrendWatch SummaryReport. The information in the TrendWatch Summary Report is presented using tables.

The TrendWatch SummaryReport displays data only for the latest 1000 TrendWatch violations. Export the report to PDF to view all violations.

You can export the report to a file of PDF or CSV.

Table 5-20 describes the fields in a TrendWatch SummaryReport.

Table 5-20 TrendWatch Summary Reports Fields

Field Description

TrendWatch Violation Report Details





TrendWatch Violation Summary


No. of TrendWatches Number of TrendWatches configured for the device.


Violation Severity level of the violation (such as Critical, Medium or Low).


Violation Details


OL-25942-01


TrendWatch Name Name of the TrendWatch configured.

Rule Condition applied for monitoring threshold violation. For example, cpmCPUTotal5minRev >= 5.0%

Device Name Displays the device name monitored for TrendWatch violation. For example, 3500XL.

Instance Name Instances selected for monitoring TrendWatch violation.

Time Stamp Time at which the TrendWatch violation occurred.

Table 5-20 TrendWatch Summary Reports Fields

Field Description


OL-25942-01



OL-25942-01



OL-25942-01



OL-25942-01



OL-25942-01



OL-25942-01



OL-25942-01



OL-25942-01



OL-25942-01



OL-25942-01



OL-25942-01

Documents

Chapter 5: Fault and Events Reports · Chapter 5 Fault and Events Reports Generating Discrepancy Reports Step 2 Click Submit to generate the Discrepancy Report. The Discrepancy Report