Ciscoworks DFM Question

Does Ciscoworks keep a log locally on the server for all the Device alerts?
The reason for this question is I got pinged by an Auditor yesterday seeing if we can obtain this type of information.
Thanks in advance.

The log file that has information about the alerts that LMS produces is the
AAD.log. It is located at NMSROOT\log\dfmLogs. The kind of information you
will see in the log file depends on the logging level that you currently
have for it.
Additionally you might want to see the syslog.log which is located at
NMSROOT\log and contains info about the syslogs that LMS receives from your
devices.
Also, LMS has a fault history option in which you should be able to see old
alerts.

Similar Messages

Ciscoworks--dfm notification--cpu utilization-customization

Hi Clarke, Could you let me know how to customized the cpu utilization threshold limits in ciscoworks dfm module, so that only above 70per cpu'ed devices give alerts and not the default values.
~PR

If an interface is in an up state when the DFM discovery is done you will be alerted when it goes down. or if someon put it in shut
This doesn't work for switch access ports though. I don't think there is an easy way to create a "new" group of ports where you will get an alert.
For an uplink you will be alerted when it goes down
For the CRC errors you will get an alert when the threshold for x crc per poll period is exceeded
Cheers,
Michel

CiscoWorks DFM and NAC appliance

Can NAC appliances be monitored by CiscoWorks DFM ?

Here's the supported device list for DFM:
http://www.cisco.com/en/US/docs/net_mgmt/ciscoworks_device_fault_manager/2.0_IDU_2.0.6/device_support/table/dfm2_0_6.html
If it's not on here then its not supported. Looks like NAC appliances aren't supported.

Ciscoworks 3.2 login issue with ACS

Hi All,
I am facing an issue with login into Ciscoworks portal from the LMS server, which is integrated with ACS tool.
Now I am unable to login to the portal with the username and password, which is already configured in the ACS server.
I have ended up with reinstalling the ciscoworks software and restored the backup, still problem persists. Please let me know how to fix it.
If I again reinstall it, how would I restore the backup - since back restoration again gives the login issue.
If Im using only the dcrcli exported devices list after the reinstallation, all the devices gets stuck in DFM question status, hence I restored the proper backup. Now I am stuckup. please help.

You need to sort out your DNS get the lookup and reverse lookup working.
Say your device is a box with
Fa 0/0 10.10.1.1
Lo 0 172.32.1.1
If you get you dns to resolve the address of port Fa 0/0 (10.10.1.1) to the DNS "name adevice.yournetwork.com".
Next you get your DNS to resolve the name "adevice.yournetwork.com" to 172.32.1.1 with happens to be to Lo0 interface of the device
Then you can get LMS to use the address you want as it is configured in DNS
Cheers,
Michel

Ciscoworks issues

Hi support,
i am facing an issue which is exactly similar to the thread ( https://supportforums.cisco.com/message/3116706#3116706 ) as below.
In DFM(3.1.0,lms 3.1) im getting alerts as insufficientfreememory for the modules as MEM Processor, MEM I/O, MEM PosixMemory etc.
The free threshold configured in dfm is the default 15% and the image running in the cisco devices is s72033-ipservicesk9_wan-vz12.2.33.sxh4.
I had checked the show process memory and confirmed that the memory utilization is 62%. I could see in ciscoworks dfm that the alert is cleared after a few minutes and occurr's daily very frequently. Found two bugs but out of which one is already resolved in the present version(CSCso05920) and the other too.
Also how to identify the modulewise mem utilization report from the total mem utilization.(MEM Processor, MEM I/O, MEM PosixMemory etc)
http://www.cisco.com/en/US/docs/net_mgmt/ciscoworks_device_fault_manager/1.1/user/guide/defaults.html#wp1017758 -- this url says The other thresholds in this setting are not applicable to switches except Backplane Utilization Threshold parameter.....!!!
Could you pls anyone help on immediate basis....i have attached all the screenshots of the problem
thanks in advance...
regards
Rajesh

Start a sniffer trace filtering on udp/161 traffic to this switch. Let it run for eight minutes. Then post the trace file. If you cannot post the capture, you will need to open a TAC service request and include that capture file. DFM should be using the CISCO-ENHANCED-MEMPOOL-MIB to get modular IOS memory data. MIB support should be working properly in 12.2(33)SXH4, so we need to confirm that DFM is using the correct objects.

Sending Ciscowrks device credential Verification Job alters the device ARP table.

Hi:
I send a Device credential verification Job to two different devices , a Cisco 3750 and a blade switch WS-CBS3120. I configured SNMP write access to the switches. The SNMP write access in either SNMP v1 or SNMP V3 , tried both.
The job is send from the Ciscoworks server.
Once the job has completed, I do a show ip arp on the device and find a new entry with the IP address of the Ciscoworks Server and the mac-address of the L2 next hop.
We would not have noticed this behavior had it not been that in the case that the switch next hop is an HSRP vlan on a nexus , the ARP entry entered into the switch is incorrect, and from then on the switch loses connection to Ciscoworks.
The Mac-address that is entered by Ciscoworks , in the case of nexus is a statice mac defined on the Nexus for the Vlan in question , but it is NOT the HSRP default gateway MAC address. Therefore we lose connection between the switch and Ciscoworks. One has to manually clear the ARP table inorder to again reach the Ciscoworks.
Questions:
1. Why does Ciscoworks insist on changing the ARP table?
2. Is this ARP entry aged out or is it permeant as would an ARP entry which is entered through CLI be permeant ?
3. In the case of the Nexus connection, this ARP entry does not allow Ciscoworks and the device to communicate. This is not productive!
Has any one come across this situation ? Any known fixes, workarround? I was not able to find a word about this on Cisco's site.
Our Ciscoworks is at the following levels:
CW Common services    3.3.0
LMS portal                    1.2.0
CW Assistent                1.2.0
RME                             4.3.1
Device fault manager      3.2.0
IPM                              4.2.1
Cisco View                    6.1.9
campus Manager            5.2.1
thanks   for any help
Mickey

CiscoWorks does not change the ARP table, at least not overtly. A credential verification job will do the following things depending on what protocols are selected to test:
SNMP RO : Fetches sysLocation.0
SNMP RW : Sets sysLocation.0 to the value currently stored in sysLocation.0
Telnet : Logs in using DCR username and password
SSH : Logs in using DCR username and password
Enable : Enters enable mode and verifies privilege level 15
If one of these things are causing the ARP table to change, then there is something fishy in the device or network configuration. I've never heard of such behavior relating to CiscoWorks before.

CiscoWorks LMS 4.0.1 - some questions

Hello community,
I would like to ask some questions about CiscoWorks LMS 4.0.1.
We are using for a few days, and I can't set some request in the system. I hope someone could help me to customize the CW as I would like to use it.
- We have some Catalyst 6500s, and between them there are Etherchannels. CiscoWorks sends us email because HighUtilization, and it relies on a Gi interface. I read that CW doesn't support etherchannels, is this true.
- I would like to receive email notifications about errdisabled state, etc. I know this is dome by RME, not DFM. The CiscoWorks server acts as Syslog server, too, and it collects the syslogs. I see in the Syslog summary, that the device sends to CW the syslog, but I can't receive email. I did an automated actions, (Monitor-Syslog-Automated actions), I defined the parameters (Facility: *, Sub-facility: *, Severity: 2, Mnemonic: PSECURE_VIOLATION, Description: *), but CW doesn't send me an email.
- I would like to customize interface threshould parameters per device. We have some router with Tunnel utilization 90%, but it's okay because we have a 10Mbit line for the external site. But when our distribution switch ethernet utilization would be 90%, it would be critical. Where can I set these parameters per device/interface?
Thank you for your help in advance.
Ferenc KURIS

If you go to Monitoring > Fault Settings > setup > fault device details
Select the device click view and click the device to open the detailed device view.
There you may see the tu interface under interfaces and set it to managed.
Cheers,
Michel

DFM in Ciscoworks.

Hi,
I am setting up Device Fault Manager in Ciscoworks LMS 3.0.1
At the moment we used What's Up Gold (ping)to alert the Technical Support team if devices go down. As you can imagine, they get hundreds of email every day notifying them that these devices are going up and down etc...
As Ciscoworks can alert on more detailed information, I would like to setup alerts for the Technical Support team when devices goes down/crash/unreachable etc... using SNMP. Do these devices need any configuration on them to alert Ciscowork. They are already send syslogs to the Ciscoworks server. What settings will suffice for these devices going down?
Also, I more question, for the SNMP trap notification on the Ciscoworks server, what info do I need to put in here?
DFM version is 3.0.2
Thanks a million
Anthony.

First, I strongly recommend you upgrade to DFM 3.0.3. There is a pretty serious issue which can cause all of LMS to fail if certain DLLs are installed on the system. This bug is fixed in DFM 3.0.3.
If you want to notify your operators based on syslog messages, then you can configure automated actions to do so under RME > Tools > Syslog > Automated Actions. Any time a matching syslog message is processed by RME, and email can be sent, or a script can be run.
While DFM can process some traps, it mainly relies on SNMP and ICMP polling to build its events. Therefore, as long as SNMP and ICMP connectivity exists between your server and your devices, you should be set. You can configure DFM notifications under DFM > Notification Services. I recommend that when configuring your Notification Group, you only check the radio buttons under Events. Events contain the specific details about a device fault. Alerts, contain a high-level roll-up of multiple events. DFM notifications can be sent as emails, traps, and/or syslogs.

DFM device discovery issue "Devices stuck in Questioned state"

Hi
We have LMS 3.0.1 installed with DFM 3.0.4 The devices are showing Questioned with Error code "SNMP timeout" with no specific reason. The snmpwalk is coming for the device as I checked with snmpwalk command. The only device discovered as"known" has ICMP permitted from Server to device and no other device has. They only have SNMP permit. Can this affect the dicovery?? or what else can I try....Please suggest!!
Rgds

Yes. DFM requires that all devices be both SNMP and ICMP reachable. DFM uses ICMP to verify reachability to all IP addresses on the device. However, at the very least, the address by which you manage the device MUST be ICMP reachable.

Ciscoworks LMS 4.0 DFM Custom Traps

Hello,
We want to use Ciscoworks LMS 4.0 for Access Control List Monitoring. i.e. if we end the ACLs with "log" entry, we may send the ACL deny logs to the Ciscoworks as Syslog or Snmp Trap format.
With "debug snmp packets" command we may observe the packets are sent to the LMS, but the traps don't show up as alarms. Is it possible to observe any trap entry with LMS DFM Fault Manager by customizing the module, because we think the engine of the DFM analyzes the traps and shows some of the traps, not all of the traps are observable.
The command output is as below:
Thanks in Advance,
Best Regards,
Mar 2 10:28:30.028: SNMP: Queuing packet to 10.10.10.1
.Mar 2 10:28:30.028: SNMP: V1 Trap, ent ciscoSyslogMIB.2, addr 10.10.20.1, gen trap 6, spectrap 1
clogHistoryEntry.2.742 = SEC
clogHistoryEntry.3.742 = 7
clogHistoryEntry.4.742 = IPACCESSLOGDP
clogHistoryEntry.5.742 = list 191 denied icmp 10.10.10.1 -> 10.10.20.1 (0/0), 10 packets
clogHistoryEntry.6.742 = 69082382

DFM consumes the traps and decides based on its built-in code-book what to do - rise one of the predefined Events or just silently ignore it. The best DFM can do is forward the trap as-is to another trap receiver.
Perhaps the LMS Syslog-Server can do what you want and lauch automated actions (like scripts or e-mail) based on certain criteria.
But you should take care of the underlying syslog file and keep its size under control with logrot.pl utility.
The online help of LMS should give you more details on the syslog capabilities or this link to the LMS 4.0 Administration Guide:
http://www.cisco.com/en/US/docs/net_mgmt/ciscoworks_lan_management_solution/4.0/user/guide/admin/useNotif.html#wp1075603

LMS 3.2 DFM-all devices QUESTIONED-SNMP Timeout

I imported 26 devices to DFM. All devices became QUESTIONED, error is SNMP timeout. Here are the troubleshooting steps that I tried:
1. rediscovered devices
2. deleted and rediscovered devices
3. increase snmp timeout settings
4.re-entered snmp strings in device credentials
But I still get the same result.I noticed that devices become questioned so fast.Any advise on this?

Hi,
What version of SNMP you are using on these 26 devices ?Try to do the following:
- Go to Device Center
- Select one device for test
- click on "check device credentials", select SNMP according to the version you are using.
- See the results.
May be you get more technical and detailed information about the SNMP timeout error. I have already experienced some problems using SNMP v3. The problem was resolved when I configured the SNMP v2c instead of v3.
Also, I suggest you to try do "SNMP walk" test in the Device Center. If you get some results reading, for example, the value of "sysObjectId", just verify the Credentials Settings in DCR. You can edit the Credentials trhough the Device Center -> Edit device credentials.
Regards,
Wando N. Rocha

Ciscoworks 4.2 - dfm email issue

Hi Cisco Team,
Dfm email alerts are not coming though it was configured properly.
Did a wireshark pcap and below is the info taken from wireshark.
Command: MAIL FROM:<[email protected]>\r\n
Command: RCPT TO:<[email protected]>\r\n
Response: 550 5.7.1 Unable to relay for [email protected]\r\n
Response code: Requested action not taken: mailbox unavailable (550)
Response parameter: 5.7.1 Unable to relay for [email protected]
Im able to telnet to smtp server on port 25.
ciscoworks ip and smtp server ip are in the same pvt ip range.
Can you pls help.

Hi Rajesh,
Type:Daily
[ Fri Jan 24 12:00:25 IST 2014 ] INFO   [Util : sendMail] : sendMail() - Ends
[ Fri Jan 24 12:05:03 IST 2014 ] INFO   [Util : sendMail] : sendMail() - Starts
[ Fri Jan 24 12:05:03 IST 2014 ] INFO   [Util : sendMail] : SMTP Server:hm02sql01.xyz.com
[ Fri Jan 24 12:05:03 IST 2014 ] INFO   [Util : sendMail] : Date:Fri, 24 Jan 2014 12:05:03 +0530
[ Fri Jan 24 12:05:03 IST 2014 ] INFO   [Util : sendMail] : From ID:[email protected]
[ Fri Jan 24 12:05:03 IST 2014 ] INFO   [Util : sendMail] : To ID:
[ Fri Jan 24 12:05:03 IST 2014 ] INFO   [Util : sendMail] : Subject:Job Id:1004.277, Status:Failed(25), Application:SysInvPoller, Run Type:Daily
[ Fri Jan 24 12:05:03 IST 2014 ] INFO   [Util : sendMail] : sendMail() - Ends
This seems to show that the smtp server is trying to push the mail.
Please check if the smtp server host name is correct in the log.
Regards,
Syed Khalid

Questioned Devices in LMS - DFM

Hi, We are running LMS 3.2 (windows) and I have a group of switches I am trying to monitior in DFM.
I have discovered the devices in device management successfully. Then I import the devices into DFM they always go into a questioned state.
Several attempts with the same results have been tried.
I checked in MARS and I see denies from my LMS server to the devices Im trying to import to DFM. The traffic seems to be in relation to when Im attemping the imports to DFM. The denies are on UDP-137. Is this port needed from LMS to the device for DFM to discover and monitor it ???
I have increased the SNMP Timeout to 14 seconds 3 retries
DFM version is 3.2.0
Credentials are correct for the monitored devices
THANKS - John

No, udp/137 is not required. The devices must be pingable and reachable via SNMP. Make sure the LMS server can ping the management IP addresses of these devices.

CiscoWorks Assistant Doesnt support the installed CM & DFM Version

We have Cisco Works 3.1 installed with following details :
1. CiscoWorks Common Services 3.2.0 31 2. Campus Manager 5.1.3 01
3. CiscoView 6.1.8
4. CiscoWorks Assistant 1.1.0
5. Device Fault Manager 3.1.3
6. Internetwork Performance Monitor 4.1.0
7. Integration Utility 1.8.0
8. LMS Portal 1.1.0
9. Resource Manager Essentials 4.2.0
When i try to access CW Assistant (e.g. Workflow) i get error :
CWA27: CWA Does not support the installed Campus Manager & DFM version.
I have tried updating CW Assistant modeul, it says no updates available.

It could be any of the three bugs below, most likely the first two:
CSCsw35439, CSCsv59291, or CSCsk19350. The first two you'd need to contact TAC to get the patches. For the last one, it may be specific to LMS 3.0 only, though you can download the patch directly from http://www.cisco.com/cgi-bin/tablebuild.pl/cwa10
Here're two old threads talking about those bugs:
http://forums.cisco.com/eforum/servlet/NetProf?page=netprof&forum=Network%20Infrastructure&topic=Network%20Management&topicID=.ee71a02&fromOutline=&CommCmd=MB%3Fcmd%3Ddisplay_location%26location%3D.2cd42614
http://forums.cisco.com/eforum/servlet/NetProf?page=netprof&forum=Network%20Infrastructure&topic=Network%20Management&topicID=.ee71a02&CommCmd=MB%3Fcmd%3Dpass_through%26location%3Doutline%40%5E1%40%40.2cbe45e8/0#selected_message

Questioned devices in DFM

Hello,
I installed LMS 3.2 on Win2008 Server without ACS integrations. I have all devices (43) in DCR and all credentials are correct. These devices are managed by RME correctly (I have all configs in archive management, I have all these devices in inventory database...). But I have a problem with these devices in DFM. When I use auto or manual synchronization with DCR - all these devices are in the questioned state. I tried to use rediscovery in DFM, I tried to use delete and add devices in the DFM, but the result is always same - questioned state:-( I installed patch dfm3.2-win-CSCta56151.tar - the installation was succesful, but the result for all devices is same - questioned state:-( The snmp-server engineid is not configured on all these devices. So can you help me with this problem?? Thank you

What is the reason DFM is giving for why the devices are in a questioned state? In order for DFM to manage a device, the device must be reachable by both SNMP and ICMP on the IP address by which it has been added to DFM.

Ciscoworks DFM Question

Similar Messages

Maybe you are looking for