Event Analytics, Release 12.1.3

The following table provides an overview of the significant changes up to this current release. The table does not provide an exhaustive list of all changes or of the new features up to this release.

To navigate to the Alarms page in Cisco {product-name-long}, choose Operations > Event Analytics. The Alarms tab on the Event Analytics page contains tabs for Alarms Raised, Alarms Cleared and Alarm Policies displaying the alarms generated in the system, the list of alarms cleared and the different alarm policies that are configured for monitoring the devices.

The following sections describe each of these tabs and how to manage the alarms and alarm policies.

Alarms Raised

The Alarms Raised tab displays the alarms that are generated for various categories. This tab displays information such as alarm ID, Severity, failure Source, Name, Message, Category, Creation Time, Updated Time, Policy, and the user who acknowledged the alarm. Using the Actions menu, you can acknowledge, unacknowledge, delete or clear one or more of the alarms. It also allows you to cleanup alarms that are invalid.

To get more details for a specific alarm and the policy which triggered this alarm, click on the link in the ID field for the respective alarm. The details about the selected alarm appear on the slide-out pane.

The following table describes the fields that appear on Operations > Event Analytics > Alarms > Alarms Raised page.

Field	Description
ID	Specifies the ID of an alarm.
Severity	Specifies the severity of the alarm.
Source	Specifies the name of the source.
Name	Specifies the name of the alarm.
Message	Displays the message.
Category	Specifies the category of the alarm.
Creation Time	Specifies the time at which the alarm was created.
Updated Time	Specifies the date and time at which the alarm was updated.
Policy	Specifies the policy of the alarm.
Ack User	Displays the user who acknowledged the alarm.

The following table describes the action items, in the Actions menu drop-down list on the Alarms Raised tab.

Action Item	Description
Acknowledge	Choose one or multiple alarms and choose Acknowledge. Allows you to bookmark the alarms and adds ack user name to Acknowledged column.
Unacknowledge	Choose one or multiple alarms and choose Unacknowledge to remove the bookmarked alarms.NOTE: Only acknowledged alarms can be unacknowledged.
Clear	Clear the alarm policy manually. The cleared alarms will be moved to Alarm Cleared tab.
Delete Alarm	Choose an alarm and choose Delete to delete the alarm.
Invalid Alarms Clean-up	Removes all the discovery related invalid alarms in the system. The cleared alarms will be moved to the Alarms Cleared tab.

---

For link-down events, you must configure the switches to send SNMP traps to NDFC. Otherwise, the port state change can only be done through polling, which is every 5 minutes.

---

Alarm Policies

In Cisco Nexus Dashboard Fabric Controller to enable alarms, navigate to Operations > Event Analytics > Alarms, click Alarm Policies on vertical tab. Ensure that the Enable external alarms check box is selected. You must restart Cisco Nexus Dashboard Fabric Controller server to bring this into effect.

You can forward alarms to registered SNMP Listeners in Cisco Nexus Dashboard Fabric Controller. From Cisco Nexus Dashboard Fabric Controller web UI, choose Settings > Server Settings > Alarms, ensure that the Enable external alarms check box is selected. You must restart Cisco Nexus Dashboard Fabric Controller server to bring this into effect.

---

Ensure that you select Forwarding check box in Alarm Policy creation dialog box to enable forwarding alarms to an external SNMP Listener.

---

The following table describes the fields that appear on Operations > Event Analytics > Alarms > Alarms Policies page.

Field	Description
Name	Specifies the name of the alarm policy.
Description	Specifies the description of the alarm policy.
Status	Specifies the status of the alarm policy: Activated Deactivated
Policy type	Specifies the type of the policy: Device Health Policy Interface Health Policy Syslog Alarm Policy Hardware Health Policy
Devices	Specifies the devices to which the alarm policy is applied.
Details	Specifies the details of the policy.

The following table describes the action items, in the Actions menu drop-down list that appear on the Alarms Policies page.

Action Item	Description
Create new alarm policy	Choose to create a new alarm policy. See Create new alarm policy section.
Edit	Select a policy and choose Edit to edit the alarm policy.
Delete	Select a policy and choose Delete to delete the alarm policy.
Activate	Select a policy and choose Activate to activate and apply the alarm policy.
Deactivate	Select a policy and choose Deactivate to disable and deactivate the alarm policy.
Import	Select to import alarm policies from a .txt file.
Export	Click the box next to a specific alarm policy, then click Export to export that alarm policy as a .txt file. Select or deselect all the boxes next to the alarm policies, then click Export to export all the alarm policies as a .txt file.

You can create alarm policies for the following policy types:

• Device Health Policy: Device health policies enable you to create alarms when device SNMP, SSH or ICMP is unreachable. It also raises alarms when the device peripherals become unavailable . Also, these policies enable you to monitor chassis temperature, CPU, memory usage and the status of routing protocols in the device.

• Interface Health Policy: Interface health policies enable you to monitor Up or Down, Packet Discard, Error, Bandwidth details of the interfaces. By default, all interfaces are selected for monitoring. is

• Syslog Alarm Policy: Syslog Alarm Policy defines a pair of syslog message formats; one which raises the alarm, and one which clears the alarm.

• Hardware Health Policy: Hardware health policies enable you to monitor fans, power supplies, modules and also interface status.

Create new alarm policy

You can add alarm policies for the following:

• Device Health Policy

• Interface Health Policy

• Syslog Alarm Policy

• Hardware Health Policy

After you create a new alarm policy, in the Alarm Policies tab, click Refresh to view the newly-created alarm policy.

Device Health Policy

Device health policies enable you to create alarms when certain conditions are met. By default, all devices are selected for monitoring.

• Policy Name: Specify a name for the policy. It must be unique.

• Description: Specify a brief description for the policy.

• Forwarding: You can forward alarms to registered SNMP listeners in Cisco Nexus Dashboard Fabric Controller . From the Web UI, choose Settings > Server Settings > Events.

---

Ensure that you select Forwarding check box while configuring alarm policies to forward alarms to an external SNMP listener.

---

• Email: You can forward alarm event emails to recipients when an alarm is created, cleared or when the severity is changed. From Cisco Nexus Dashboard Fabric Controller Web UI, choose Settings > Server Settings > Events. Configure the SMTP parameters, click Save, and restart Cisco Nexus Dashboard Fabric Controller services.

• Specify the CPU utilization parameters, memory utilization parameters, and environmental temperature parameters.

• Device Availability: Device health policies enable you to create alarms in the following situations:

  • Device Access: When device ICMP, device SNMP, or device SSH is unnreachable.

  • Peripherals: When fan, power supply, or module is unnreachable.

• Device Feature: You can select the BFD, BGP, and HSRP protocols. When these check boxes are selected, alarms are triggered for the following traps:

  • BFD: ciscoBfdSessDown, ciscoBfdSessUp

  • BGP: bgpEstablishedNotification, bgpBackwardTransNotification, cbgpPeer2BackwardTransition (), c*bgpPeer2EstablishedNotification

• HSRP: cHsrpStateChange

  For detailed trap OID definitions, refer to https://snmp.cloudapps.cisco.com/Support/SNMP/do/BrowseOID.do.

Also, these policies enable you to monitor chassis temperature, CPU, and memory usage.

Select the devices for which you want to create policies. Specify the policy name, description, CPU Utilization parameters, Memory Utilization parameters, Environment Temperature parameters, device availability, and device features.

Interface Health Policy

Interface health policies enable you to monitor the interface status, packet discards, errors and bandwidth details of the interfaces. By default, all interfaces are selected for monitoring.

Select the devices for which you want to create policies and then specify the following parameters:

• Policy Name: Specify a name for the policy. It must be unique.

• Description: Specify a brief description for the policy.

• Forwarding: You can forward alarms to registered SNMP listeners in Cisco Nexus Dashboard Fabric Controller by configuring sender and recepient email addresses in Settings > Server Settings > Alarms tab.

  

  ---

  Ensure that you select Forwarding check box while configuring alarm policies to forward alarms to an external SNMP listener.

  ---

• Email: You can forward alarm event emails to recipients when an alarm is created, cleared or when the severity is changed. From Cisco Nexus Dashboard Fabric Controller Web UI, navigate to Settings > Server Settings > SMTP, configure the SMTP parameters and restart Cisco Nexus Dashboard Fabric Controller services.

• Linkstate: Choose linkstate option to check for the interface link status. You can generate an alarm whenever a link is down and clear the alarms when the link is up.

• Bandwidth (In/Out): Allows you to set the maximum bandwidth allowed in inbound and outbound directions. The system generates alarms when the bandwidth exceeds the specified values.

• Inbound Errors: Allows you to set thresholds for the number of inbound errors that are discarded after which it generates an alarm.

• Outbound Errors: Allows you to set thresholds for the number of outbound errors that are discarded after which it generates an alarm.

• Inbound Discards: Allows you to set thresholds for the number of inbound packets that are discarded after which it generates an alarm.

• Outbound Discards: Allows you to set thresholds for the number of outbound packets that are discarded after which it generates an alarm.

Syslog Alarm

Syslog Alarm Policy defines a pair of Syslog messages formats; one which raises the alarm, and one which clears the alarm.

Select the devices for which you want to create policies and then specify the following parameters:

• Devices: Define the scope of this policy. Select individual devices or all devices to apply this policy.

• Policy Name: Specify the name for this policy. It must be unique.

• Description: Specify a brief description for this policy.

• Forwarding: You can forward alarms to registered SNMP listeners in Cisco Nexus Dashboard Fabric Controller . From Web UI, choose Settings > Server Settings > Events.

  

  ---

  Ensure that you select Forwarding check box in Alarm Policy creation dialog window to enable forwarding alarms to external SNMP listener.

  ---

• Email: You can forward alarm event emails to recipient when alarm is created, cleared or severity changed. From Cisco Nexus Dashboard Fabric Controller Web UI, choose Settings > Server Settings > Events. Configure the SMTP parameters, click Save, and restart Cisco Nexus Dashboard Fabric Controller services.

• Severity: Define the severity level for this syslog alarm policy. Choices are: Critical, Major, Minor, and Warning.

• Identifier: Specify the identifier portions of the raise & clear messages.

• syslogRaise: Define the format of a syslog raise message. The syntax is as follows: Facility-Severity-Type: Message

• syslogClear: Define the format of a syslog clear message. The syntax is as follows: Facility-Severity-Type: Message

The Regex definitions are simple expressions but not a complete regex. Variable regions of text are noted using $(LABEL) syntax. Each label represents a regex capture group (.+), which corresponds to one or more characters. The variable texts found in both raise and clear messages are used to associate the two messages. An Identifier is a sequence of one or more labels that appear in both messages. An Identifier is used to match a clear syslog message to the syslog message that raised the alarm. If the text appears only in one of the messages, it can be noted with a label and exclude it from the identifier.

Example: A policy with "Value": "ID1-ID2",

"syslogRaise": "SVC-5-DOWN: $(ID1) module $(ID2) is down $(REASON)"
"syslogClear": "SVC-5-UP: $(ID1) module $(ID2) is up."

In the example, ID1 and ID2 labels can be marked as an identifier to find the alarm. This identifier will be found in corresponding syslog messages. Label "REASON" is in the raise but not in the clear message. This label can be excluded from the identifier, as it has no impact on the syslog message to clear the alarm.

Table 1. Example 1

Identifier	ID1-ID2
Raise Regex	ETHPORT-5-IF_ADMIN_UP: Interface Ethernet15/1 is admin up .
Clear Regex	ETHPORT-5-IF_DOWN_NONE: Interface Ethernet15/1 is down (Transceiver Absent)

In the above example, the regex expressions are part of the syslog messages that appear in the terminal monitor.

Table 2. Example 2

Identifier	ID1-ID2
Raise Regex	ETH_PORT_CHANNEL-5-PORT_DOWN: $(ID1): $(ID2) is down
Clear Regex	ETH_PORT_CHANNEL-5-PORT_UP: $(ID1): $(ID2) is up

Table 3. Example 3:

Identifier	ID1-ID2
Raise Regex	ETHPORT-5-IF_SFP_WARNING: Interface $(ID1), High Rx Power Warning
Clear Regex	ETHPORT-5-IF_SFP_WARNING: Interface $(ID1), High Rx Power Warning cleared

Hardware Health Policy

The hardware health policy is used to raise hardware-related alarms for different parameters, such as fan status, power supply, modular status and all interface-related alarms.

By default, there is a hardware policy called as discovery that is standard with the NDFC installation. This hardware policy defines various conditions for different parameters. You can also create custom hardware policies for the parameters listed above and define regex expressions based on which alarms are raised.

By default, the All Devices option is selected automatically.

• Policy Name: Specify a name for the policy. It must be unique.

• Description: Specify a brief description for the policy.

• Forwarding: You can forward alarms to registered SNMP listeners in Cisco Nexus Dashboard Fabric Controller. From the Web UI, choose Settings > Server Settings > Events.

---

Ensure that you select Forwarding check box while configuring alarm policies to forward alarms to an external SNMP listener.

---

• Email: You can forward alarm event emails to recipients when an alarm is created, cleared or when the severity is changed. From Cisco Nexus Dashboard Fabric Controller Web UI, choose SettingsServer SettingsEvents. Configure the SMTP parameters, click Save, and restart Cisco Nexus Dashboard Fabric Controller services.

Hardware alarms are raised based on regex expressions that you enter when you are creating the policy.

In the Alarms area, create a hardware health policy to raise alarms for the following parameters:

• Fan: Define the severity for fan-related alarms and determine the condition for the alarms.

  1. Click the toggle switch next to Fan to enable the fan-related alarms.

  2. Select the severity of the alarm:

     • Critical

     • Major

     • Minor

     • Warning

     • Cleared

  3. Click Edit Regex, then enter the value that will trigger the alarm when the status is not that value.

     For example, if you enter ok in the Trigger alarm when status is not field, NDFC will raise an alarm for any status other than ok, such as N/A.

  4. Click Save.

• Power Supply: Define the severity for power supply-related alarms and determine the condition for the alarms.

  1. Click the toggle switch next to Power Supply to enable the power supply-related alarms.

  2. Select the severity of the alarm:

     • Critical

     • Major

     • Minor

     • Warning

     • Cleared

  3. Click Edit Regex, then enter the value that will trigger the alarm when the status is not that value.

     For example, if you enter ok in the Trigger alarm when status is not field, NDFC will raise an alarm for any status other than ok, such as failed, OffEnvpower, OffDenied, and so on.

  4. Click Save.

• Module: Define the severity for module-related alarms and determine the condition for the alarms.

  1. Click the toggle switch next to Module to enable the module-related alarms.

  2. Select the severity of the alarm:

     • Critical

     • Major

     • Minor

     • Warning

     • Cleared

  3. Click Edit Regex, then enter the value that will trigger the alarm when the status matches that value.

     For example, if you were to enter the following value in the Trigger alarm when status matches regex field, as shown in the information (i) button:

     ^(?!ok|poweredDown|okButDiagFailed).*$

     NDFC will raise an alarm when modules are in states other than ok, poweredDown, and OkButDiag failed.

  4. Click Save.

• Interface Status: Define the severity for interface-related alarms and determine the condition for the alarms.

  1. Click the toggle switch next to Interface Status to enable the interface-related alarms.

  2. Click one or more toggle switches next to the appropriate severity to select the severity of the alarm:

     • Critical

     • Major

     • Minor

     • Warning

     • Cleared

  3. Click Edit Regex, then enter the value that will trigger the alarm when the status matches that value. The provided regex expression is matched against the combined field of admin_status:oper_status:status_reason.

     For example, if you were to enter the following value in the Trigger alarm when status matches regex field:

     ^up:down:(?!Link not connected|XCVR not inserted|sfpNotPresent|Channel admin down).*$

     NDFC will raise an alarm when interfaces are in states that match these values.

  4. Click Save.

Endpoint Locator Alarms

Alarms are registered and created under the External alarm category by the Endpoint Locator (EPL).

Endpoint Locator: Alarm Policies

The EPL external alarm category policy is activated when EPL is enabled on a fabric. Alarms are raised for issues such as Duplicate IP addresses, Duplicate MAC addresses, Endpoints appearing on a VRF and Endpoints disappearing from a VRF, Endpoints moving within a fabric, loss of Route Reflector connectivity, and restoration of Route Reflector connectivity. Depending on the issue, the severity level of the alarm policy can be CRITICAL or MINOR.

Alarms are raised and categorized as CRITICAL for the following events:

• Route Reflector disconnection

• Detection of a duplicate IP address

• Detection of a duplicate MAC address

Alarms are raised and categorized as MINOR for the following events:

• Movement of an endpoint

• Appearance of a new VRF in a fabric

• Number of endpoints in a fabric goes down to 0

• Number of endpoints in a VRF goes down to 0

• Disappearance of all endpoints from a switch

• Connection of a Route Reflector (RR)

CRITICAL alarms are cleared automatically when the condition is corrected. For example, when the connectivity between NDFC and RR is lost, a CRITICAL alarm is generated. This alarm is automatically cleared when the connectivity between NDFC and RR is restored. Other MINOR alarms are automatically cleared after 30 minutes have passed since the alarm was generated.

---

You must clear the duplicate MAC and duplicate IP alarms after the condition is resolved.

---

Choose Event Analytics > Alarms > Alarm Policies to display the EPL alarm policies. You cannot edit the alarm policies on the web UI.

Choose Actions > Activate or Deactivate to activate or deactivate the selected policy.

In case an alarm policy is deleted using the NDFC Web UI, any alarms created or cleared for that policy will not be displayed in the Event Analytics > Alarms > Alarm Policies tab. To delete a policy, select the checkbox next to the policy and click Delete. However, we recommend not deleting a policy from the NDFC Web UI. When a fabric is deleted, the alarm policy along with all the active alarms for the devices in that fabric are deleted.

Endpoint Locator: Active Alarms

Choose Event Analytics > Alarms > Alarms Raised to display the active alarms.

To clear an active alarm, select the checkbox next to the alarm and choose Actions > Clear.

To delete an active alarm, select the checkbox next to the alarm and choose Actions > Delete.

Endpoint Locator: Cleared Alarms

To view cleared alarms, choose Event Analytics > Alarms > Alarms Cleared.

Click on the Cleared status column for any particular alarm to display detailed information about the selected alarm.

To delete a cleared alarm from the list of cleared alarms, select the checkbox next to the alarm and choose Actions > Delete.

For more information on Alarms and Policies, refer to Alarms.

This tab displays the events that are generated for the switches. This tab displays information such as Ack, Acknowledged user, Group, Switch, Severity, Facility, Type, Count, Last Seen, and Description. You can select one or more events and then acknowledge or unacknowledge their status using the Change Status drop-down list. In addition, you can select one or more alarms and then click the Delete button to delete them. If you want to delete all events, click the Delete All button.

The following table describes the fields that appear on Operations > Event Analytics > Events.

The following table describes the action items, in the Actions menu drop-down list, that appear on Operations > Event Analytics > Events.

You can view the accounting information on Cisco Nexus Dashboard Fabric Controller Web UI.

The following table describes the fields that appear on Operations > Event Analytics > Accounting.

The following table describes the action items, in the Actions menu drop-down list, that appear on Operations > Event Analytics > Accounting.

This tab displays the clusters and the number of Fabrics in each cluster in your setup.

Click on the Cluster Name to see the summary information. You can click on the launch icon to view the detailed summary of the Cluster.

THE SPECIFICATIONS AND INFORMATION REGARDING THE PRODUCTS IN THIS MANUAL ARE SUBJECT TO CHANGE WITHOUT NOTICE. ALL STATEMENTS, INFORMATION, AND RECOMMENDATIONS IN THIS MANUAL ARE BELIEVED TO BE ACCURATE BUT ARE PRESENTED WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED. USERS MUST TAKE FULL RESPONSIBILITY FOR THEIR APPLICATION OF ANY PRODUCTS.

THE SOFTWARE LICENSE AND LIMITED WARRANTY FOR THE ACCOMPANYING PRODUCT ARE SET FORTH IN THE INFORMATION PACKET THAT SHIPPED WITH THE PRODUCT AND ARE INCORPORATED HEREIN BY THIS REFERENCE. IF YOU ARE UNABLE TO LOCATE THE SOFTWARE LICENSE OR LIMITED WARRANTY, CONTACT YOUR CISCO REPRESENTATIVE FOR A COPY.

The Cisco implementation of TCP header compression is an adaptation of a program developed by the University of California, Berkeley (UCB) as part of UCB’s public domain version of the UNIX operating system. All rights reserved. Copyright © 1981, Regents of the University of California.

NOTWITHSTANDING ANY OTHER WARRANTY HEREIN, ALL DOCUMENT FILES AND SOFTWARE OF THESE SUPPLIERS ARE PROVIDED “AS IS" WITH ALL FAULTS. CISCO AND THE ABOVE-NAMED SUPPLIERS DISCLAIM ALL WARRANTIES, EXPRESSED OR IMPLIED, INCLUDING, WITHOUT LIMITATION, THOSE OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OR ARISING FROM A COURSE OF DEALING, USAGE, OR TRADE PRACTICE.

IN NO EVENT SHALL CISCO OR ITS SUPPLIERS BE LIABLE FOR ANY INDIRECT, SPECIAL, CONSEQUENTIAL, OR INCIDENTAL DAMAGES, INCLUDING, WITHOUT LIMITATION, LOST PROFITS OR LOSS OR DAMAGE TO DATA ARISING OUT OF THE USE OR INABILITY TO USE THIS MANUAL, EVEN IF CISCO OR ITS SUPPLIERS HAVE BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.

Any Internet Protocol (IP) addresses and phone numbers used in this document are not intended to be actual addresses and phone numbers. Any examples, command display output, network topology diagrams, and other figures included in the document are shown for illustrative purposes only. Any use of actual IP addresses or phone numbers in illustrative content is unintentional and coincidental.

The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product.

Cisco and the Cisco logo are trademarks or registered trademarks of Cisco and/or its affiliates in the U.S. and other countries. To view a list of Cisco trademarks, go to this URL: http://www.cisco.com/go/trademarks. Third-party trademarks mentioned are the property of their respective owners. The use of the word partner does not imply a partnership relationship between Cisco and any other company. (1110R)

© 2017-2024 Cisco Systems, Inc. All rights reserved.