Event Analytics, Release 12.2.2

The following table provides an overview of the significant changes up to this current release. The table does not provide an exhaustive list of all changes or of the new features up to this release.

This tab displays the alarms that are generated for various categories. This tab displays information such as ID (optional), Severity, Failure Source, Name, Category, Acknowledged, Creation Time, Last Updated (optional), Policy, and Message. You can specify the Refresh Interval in this tab. You can select one or more alarms and then acknowledge or unacknowledge their status using the Change Status drop-down list. In addition, you can select one or more alarms and then click the Delete button to delete the alarms.

Beginning with NDFC 12.2.2, NDFC added the default alarm policy, pm_optics_predict, so that when optics values exceed the default threshold as defined on the switch, alert notifications are sent out automatically. The pm_optics_predict raised alarms are listed on the Analyze > Event Analytics > Alarms > Alarms Raised page.

For more information, see the section "Viewing Performance Information for Optics" in Add Interfaces for SAN Operational Mode.

Alarm Policies

To enable alarms in the NDFC SAN controller, perform the following steps:

1. Navigate to Analyze > Event Analytics > Alarms > Alarm Policies.

2. Ensure that you check the Enable external alarms check box in Admin > System Settings > Server Settings > Alarm.

   You must restart the SAN controller server for this change to take effect.

Forwarding Alarms to Registered SNMP Listeners

1. Choose Admin > System Settings > Server Settings > Alarms, and ensure that you check the Enable external alarms check box. You must restart the NDFC SAN controller server for this change to take effect.

2. Choose Admin > System Settings > Server Settings > Alarms, and enter an external port address in the alarm.trap.listener.address field.

3. Click Apply Changes and restart the NDFC SAN controller.

   

   ---

   Ensure that you select the Forwarding check box in the Alarm Policy creation dialog box to enable forwarding alarms to external SNMP listeners.

   ---

The following table describes the fields that appear on the Analyze > Event Analytics > Alarms > Alarms Policies page.

Field	Description
Name	Specifies the name of the alarm policy Beginning with NDFC 12.2.2, NDFC added the following default policies for triggering an alarm when zone, FCNS, and FLOGI scale percentages on a switch exceed the defined threshold of 80%: Zone_alarm Fcns_alarm Flogi_alarm NDFC runs a nightly scan at midnight for determining if a zone, FCNS, and FLOGI scale limitation is triggered for raising an alarm. You can export or import a Zone_alarm, Fcns_alarm, and a Flogi_alarm policy as a .txt file, update the scale percentage values, and wait for the nightly scan to see the raised alarms on the Analyze > Event Analytics > Alarms > Alarms Raised page.
Description	Specifies the description of the alarm policy
Status	Specifies the status of the alarm policy: Activated Deactivated
Policy type	Specifies the type of the policy: Device Health Policy Interface Health Policy Syslog Alarm Policy SAN Insights Anomaly External
Devices	Specifies the devices to which the alarm policy is applied.
Interfaces	Specifies the interfaces.
Details	Specifies the details of the policy.
External	Specifies if the policy type is a default policy or if it is auto-generated by NDFC.

The following table describes the action items, in the Actions drop-down list that appear on the Analyze > Event Analytics > Alarms > Alarms Policies page.

Action Item	Description
Create new alarm policy	Choose to create a new alarm policy. For more information, see Create new alarm policy.
Edit	Select a policy and choose Edit to edit the alarm policy.
Delete	Select a policy and choose Delete to delete the alarm policy.
Activate	Select a policy and choose Activate to activate and apply the alarm policy.
Deactivate	Select a policy and choose Deactivate to disable and deactivate the alarm policy.
Import	Select to import alarm policies from a .txt file.
Export	Click the box next to a specific alarm policy, then click Export to export that alarm policy as a .txt file. Select or deselect all the boxes next to the alarm policies, then click Export to export all the alarm policies as a .txt file.

You can add alarm policies for the following:

Policy	Description
Device Health Policy	Device health policies enable you to create alarms when Device SNMP Unreachable, or Device SSH Unreachable or when the device peripherals are unavailable. Also, these policies enable you to monitor chassis temperature, CPU, and memory usage.
Interface Health Policy	Interface health policies enable you to monitor Up or Down, Packet Discard, Error, Bandwidth details of the interfaces. By default, all interfaces are selected for monitoring.
Syslog Alarm Policy	A syslog alarm policy defines a pair of syslog messages formats; one which raises the alarm, and one which clears the alarm.
SAN Insights Anomaly Policy	A SAN Insights anomaly policy enables you to create customized alarms to identify issues in the fabric using SAN Insight data.
pm_optics_predict	Beginning with NDFC 12.2.2, NDFC added an external pm_optics_predict alarm policy, so that when optics values exceed the default threshold as defined on the switch, alert notifications are sent out automatically. You cannot modify the pm_optics_predict alarm policy. For more information, see the section "Viewing Performance Information for Optics" in Add Interfaces for SAN Operational Mode.

From Cisco Nexus Dashboard SAN Controller Release 12.1.2e, you can modify or activate or use data of pre-provisioned SAN Insights anomaly policies that are in Not Active state by default.

Create new alarm policy

You can add alarm policies for the following:

• Device Health Policy

• Interface Health Policy

• Syslog Alarm Policy

• SAN Insights Anomaly Policy

After you create a new alarm policy, in the Alarm Policies tab, click Refresh to view the newly-created alarm policy.

Device Health Policy

Device health policies enable you to create alarms when certain conditions are met. By default, all devices are selected for monitoring.

• Policy Name: Specify a name for the policy. It must be unique.

• Description: Specify a brief description for the policy.

• Forwarding: You can forward alarms to registered SNMP listeners in Cisco Nexus Dashboard Fabric Controller . From the Web UI, choose Admin > System Settings > Server Settings > Events.

---

Ensure that you select Forwarding check box while configuring alarm policies to forward alarms to an external SNMP listener.

---

• Email: You can forward alarm event emails to recipients when an alarm is created, cleared or when the severity is changed. From Cisco Nexus Dashboard Fabric Controller Web UI, choose Admin > System Settings > Server Settings > Events. Configure the SMTP parameters, click Save, and restart Cisco Nexus Dashboard Fabric Controller services.

• Specify the CPU utilization parameters, memory utilization parameters, and environmental temperature parameters.

• Device Availability: Device health policies enable you to create alarms in the following situations:

  • Device Access: When device SNMP or device SSH is unnreachable.

  • Peripherals: When fan, power supply, or module is unnreachable.

    For detailed trap OID definitions, refer to https://snmp.cloudapps.cisco.com/Support/SNMP/do/BrowseOID.do.

Also, these policies enable you to monitor chassis temperature, CPU, and memory usage.

Select the devices for which you want to create policies. Specify the policy name, description, CPU Utilization parameters, Memory Utilization parameters, Environment Temperature parameters, device availability, and device features.

Interface Health Policy

Interface health policies enable you to monitor the interface status, packet discards, errors and utilization details of the interfaces. By default, all interfaces are selected for monitoring.

Select the devices for which you want to create policies and then specify the following parameters:

• Policy Name: Specify a name for the policy. It must be unique.

• Description: Specify a brief description for the policy.

• Forwarding: You can forward alarms to registered SNMP listeners in Cisco Nexus Dashboard Fabric Controller by configuring sender and recepient email addresses in Admin > System Settings > Server Settings > Alarms tab.

  

  ---

  Ensure that you select Forwarding check box while configuring alarm policies to forward alarms to an external SNMP listener.

  ---

• Email: You can forward alarm event emails to recipients when an alarm is created, cleared or when the severity is changed. From Cisco Nexus Dashboard Fabric Controller Web UI, navigate to Admin > System Settings > Server Settings > SMTP, configure the SMTP parameters and restart Cisco Nexus Dashboard Fabric Controller services.

• Linkstate: Choose linkstate option to check for the interface link status. You can generate an alarm whenever a link is down and clear the alarms when the link is up.

• Bandwidth (In/Out): Allows you to set the maximum bandwidth allowed in inbound and outbound directions. The system generates alarms when the bandwidth exceeds the specified values.

• Interface Power (Rx/Tx): Allows you to configure low warning thresholds for Tx Power and Rx Power. The system generates alarms when the threshold values drop below the configured values. The interfaces are monitored every 15 minutes.

• Interface Current: Allows you to configure low warning thresholds for current. The system generates alarms when the threshold values drop below the configured values. The interfaces are monitored every 15 minutes.

• Interface Voltage: Allows you to configure low warning thresholds for voltage. The system generates alarms when the threshold values drop below the configured values. The interfaces are monitored every 15 minutes.

• Inbound Errors: Allows you to set thresholds for the number of inbound errors that are discarded after which it generates an alarm.

• Outbound Errors: Allows you to set thresholds for the number of outbound errors that are discarded after which it generates an alarm.

• Inbound Discards: Allows you to set thresholds for the number of inbound packets that are discarded after which it generates an alarm.

• Outbound Discards: Allows you to set thresholds for the number of outbound packets that are discarded after which it generates an alarm.

Syslog Alarm

Syslog Alarm Policy defines a pair of Syslog messages formats; one which raises the alarm, and one which clears the alarm.

Select the devices for which you want to create policies and then specify the following parameters:

• Devices: Define the scope of this policy. Select individual devices or all devices to apply this policy.

• Policy Name: Specify the name for this policy. It must be unique.

• Description: Specify a brief description for this policy.

• Forwarding: You can forward alarms to registered SNMP listeners in SAN Controller. From Web UI, choose Admin > System Settings > Server Settings > Events.

  

  ---

  Ensure that you select Forwarding check box in Alarm Policy creation dialog window to enable forwarding alarms to external SNMP listener.

  ---

• Email: You can forward alarm event emails to recipient when alarm is created, cleared or severity changed. From SAN Controller Web UI, choose Admin > System Settings > Server Settings > Events. Configure the SMTP parameters, click Save, and restart SAN Controller services.

• Severity: Define the severity level for this syslog alarm policy. Choices are: Critical, Major, Minor, and Warning.

• Identifier: Specify the identifier portions of the raise & clear messages.

• Raise Regex: Define the format of a syslog raise message. The syntax is as follows: Facility-Severity-Type: Message

• Clear Regex: Define the format of a syslog clear message. The syntax is as follows: Facility-Severity-Type: Message

The Regex definitions are simple expressions but not a complete regex. Variable regions of text are noted using $(LABEL) syntax. Each label represents a regex capture group (.+), which corresponds to one or more characters. The variable texts found in both raise and clear messages are used to associate the two messages. An Identifier is a sequence of one or more labels that appear in both messages. An Identifier is used to match a clear syslog message to the syslog message that raised the alarm. If the text appears only in one of the messages, it can be noted with a label and exclude it from the identifier.

Example: A policy with "Value": "ID1-ID2",

"syslogRaise": "SVC-5-DOWN: $(ID1) module $(ID2) is down $(REASON)"
"syslogClear": "SVC-5-UP: $(ID1) module $(ID2) is up."

In the example, ID1 and ID2 labels can be marked as an identifier to find the alarm. This identifier will be found in corresponding syslog messages. Label "REASON" is in the raise but not in the clear message. This label can be excluded from the identifier, as it has no impact on the syslog message to clear the alarm.

Example 1

Identifier	ID1-ID2
Raise Regex	ETHPORT-5-IF_ADMIN_UP: Interface Ethernet15/1 is admin up.
Clear Regex	ETHPORT-5-IF_DOWN_NONE: Interface Ethernet15/1 is down (Transceiver Absent)

In the above example, the regex expressions are part of the syslog messages that appear in the terminal monitor.

Example 2

Identifier	ID1-ID2
Raise Regex	ETH_PORT_CHANNEL-5-PORT_DOWN: $(ID1): $(ID2) is down
Clear Regex	ETH_PORT_CHANNEL-5-PORT_UP: $(ID1): $(ID2) is up

Example 3:

Identifier	ID1-ID2
Raise Regex	ETHPORT-5-IF_SFP_WARNING: Interface $(ID1), High Rx Power Warning
Clear Regex	ETHPORT-5-IF_SFP_WARNING: Interface $(ID1), High Rx Power Warning cleared

SAN Insights Anomaly Policy

From Cisco Nexus Dashboard SAN Controller Release 12.0(1), a new policy type SAN Insights anomaly policy is added. You can customize this policy type to identify issues. You can also create an alarm policy based on the specific flows to retain per interval data for analysis. If the selected flow matches an alarm policy, maintain the flow based on the parameters defined by the policy.

1. Choose Analyze > Event Analytics > Alarms.

2. Choose Alarm Policies in the Alarms tab.

3. Choose Actions > Create new alarm policy.

4. Click the SAN Insights Anomaly Policy radio button.

5. Enter the necessary field values as described in the following table.

   Field	Description
   Policy Name	Specify the name for the alarm policy. It must be unique.
   Description	Specify a brief description of the alarm policy.
   Forwarding	Check this checkbox to enable forwarding of alarms to an external Simple Network Management Protocol (SNMP) listener.
   Email	Check this checkbox to send email updates on this alarm policy to an email id.
   Capture Time	Click the time in hours from the drop-down list to define Capture Time. Specifies the length of time to capture per-interval data for each flow matching the given alarm policy.
   Retention Time	Choose the time from the drop-down list to define the Retention Time. Specifies the length of time to keep the data before it is deleted.
   Analysis Level	Click the interval from the drop-down list to define the Analysis Level. Specifies which aggregation of flow data must be checked for the given policy. Policy types such as abort or failures should have logic to catch these failures instantly, so you can select the analysis level as an interval. Some data policy types can be considered as anomaly only when the anomaly is sustained above the threshold value for a specific amount of time. For example, a momentary Exchange Completion Time (ECT) or Data Access Latency (DAL) spike in level is not alarming, but if that same spike level is continued for a period (five minutes or one hour), then it must be investigated.
   Severity	Click the severity level from the drop-down list to define the Severity of the alarm policy.
   Match Rules	Click Add new rule to define a new match rule. You need one or more match rules to describe the matching traffic. You can compare any of the telemetry data fields to another field or to a value that you define. Each flow matching all of the match rules generates an alarm (up to the limit defined in Admin > System Settings > Server Settings). You can define one or more new rules and match criteria to identify a flow and create a new policy. All policies are matched against each ITL/ITN flow record streamed to the receiver from the switches.
   Compare Source	Click a type of telemetry data for comparison from the drop-down list for matching rules. For example, if you want to check for a read ECT value of a particular host enclosure in a switch, if the ECT value is more than a particular value, create a SAN Insights alarm to monitor the value. You can monitor one particular parameter, and you can create a corresponding alarm if the traffic matches the rule you created.
   Operator	Click an operator from the drop-down list for comparing the telemetry data.
   Compare To	Click Custom Value if you want to compare telemetry data to a custom value that you define.
   Compare Value	Enter a comparison value if you clicked Custom Value.

6. You can view the created alarms in the Alarms tab.

7. Click Create SAN Insights Anomaly Policy to create the alarm policy.

This tab displays the events that are generated for the switches. This tab displays information such as Ack, Acknowledged user, Group, Switch, Severity, Facility, Type, Count, Last Seen, and Description. You can select one or more events and then acknowledge or unacknowledge their status using the Change Status drop-down list. In addition, you can select one or more alarms and then click the Delete button to delete them. If you want to delete all events, click the Delete All button.

The following table describes the fields that appear on Analyze > Event Analytics > Events.

The following table describes the action items, in the Actions menu drop-down list, that appear on Analyze > Event Analytics > Events.

You can view the accounting information on Cisco Nexus Dashboard Fabric Controller Web UI.

The following table describes the fields that appear on Analyze > Event Analytics > Accounting.

The following table describes the action items, in the Actions menu drop-down list, that appear on Analyze > Event Analytics > Accounting.

This tab displays the clusters and the number of Fabrics in each cluster in your setup.

Click on the Cluster Name to see the summary information. You can click on the launch icon to view the detailed summary of the Cluster.

THE SPECIFICATIONS AND INFORMATION REGARDING THE PRODUCTS IN THIS MANUAL ARE SUBJECT TO CHANGE WITHOUT NOTICE. ALL STATEMENTS, INFORMATION, AND RECOMMENDATIONS IN THIS MANUAL ARE BELIEVED TO BE ACCURATE BUT ARE PRESENTED WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED. USERS MUST TAKE FULL RESPONSIBILITY FOR THEIR APPLICATION OF ANY PRODUCTS.

THE SOFTWARE LICENSE AND LIMITED WARRANTY FOR THE ACCOMPANYING PRODUCT ARE SET FORTH IN THE INFORMATION PACKET THAT SHIPPED WITH THE PRODUCT AND ARE INCORPORATED HEREIN BY THIS REFERENCE. IF YOU ARE UNABLE TO LOCATE THE SOFTWARE LICENSE OR LIMITED WARRANTY, CONTACT YOUR CISCO REPRESENTATIVE FOR A COPY.

The Cisco implementation of TCP header compression is an adaptation of a program developed by the University of California, Berkeley (UCB) as part of UCB’s public domain version of the UNIX operating system. All rights reserved. Copyright © 1981, Regents of the University of California.

NOTWITHSTANDING ANY OTHER WARRANTY HEREIN, ALL DOCUMENT FILES AND SOFTWARE OF THESE SUPPLIERS ARE PROVIDED “AS IS" WITH ALL FAULTS. CISCO AND THE ABOVE-NAMED SUPPLIERS DISCLAIM ALL WARRANTIES, EXPRESSED OR IMPLIED, INCLUDING, WITHOUT LIMITATION, THOSE OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OR ARISING FROM A COURSE OF DEALING, USAGE, OR TRADE PRACTICE.

IN NO EVENT SHALL CISCO OR ITS SUPPLIERS BE LIABLE FOR ANY INDIRECT, SPECIAL, CONSEQUENTIAL, OR INCIDENTAL DAMAGES, INCLUDING, WITHOUT LIMITATION, LOST PROFITS OR LOSS OR DAMAGE TO DATA ARISING OUT OF THE USE OR INABILITY TO USE THIS MANUAL, EVEN IF CISCO OR ITS SUPPLIERS HAVE BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.

Any Internet Protocol (IP) addresses and phone numbers used in this document are not intended to be actual addresses and phone numbers. Any examples, command display output, network topology diagrams, and other figures included in the document are shown for illustrative purposes only. Any use of actual IP addresses or phone numbers in illustrative content is unintentional and coincidental.

The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product.

Cisco and the Cisco logo are trademarks or registered trademarks of Cisco and/or its affiliates in the U.S. and other countries. To view a list of Cisco trademarks, go to this URL: https://www.cisco.com/go/trademarks. Third-party trademarks mentioned are the property of their respective owners. The use of the word partner does not imply a partnership relationship between Cisco and any other company. (1110R)

© 2017-2024 Cisco Systems, Inc. All rights reserved.