Ciscoworks LMS 4.0 DFM Custom Traps

Hello,
We want to use Ciscoworks LMS 4.0 for Access Control List Monitoring. i.e. if we end the ACLs with "log" entry, we may send the ACL deny logs to the Ciscoworks as Syslog or Snmp Trap format.
With "debug snmp packets" command we may observe the packets are sent to the LMS, but the traps don't show up as alarms. Is it possible to observe any trap entry with LMS DFM Fault Manager by customizing the module, because we think the engine of the DFM analyzes the traps and shows some of the traps, not all of the traps are observable.
The command output is as below:
Thanks in Advance,
Best Regards,
Mar 2 10:28:30.028: SNMP: Queuing packet to 10.10.10.1
.Mar 2 10:28:30.028: SNMP: V1 Trap, ent ciscoSyslogMIB.2, addr 10.10.20.1, gen trap 6, spectrap 1
clogHistoryEntry.2.742 = SEC
clogHistoryEntry.3.742 = 7
clogHistoryEntry.4.742 = IPACCESSLOGDP
clogHistoryEntry.5.742 = list 191 denied icmp 10.10.10.1 -> 10.10.20.1 (0/0), 10 packets
clogHistoryEntry.6.742 = 69082382

DFM consumes the traps and decides based on its built-in code-book what to do - rise one of the predefined Events or just silently ignore it. The best DFM can do is forward the trap as-is to another trap receiver.
Perhaps the LMS Syslog-Server can do what you want and lauch automated actions (like scripts or e-mail) based on certain criteria.
But you should take care of the underlying syslog file and keep its size under control with logrot.pl utility.
The online help of LMS should give you more details on the syslog capabilities or this link to the LMS 4.0 Administration Guide:
http://www.cisco.com/en/US/docs/net_mgmt/ciscoworks_lan_management_solution/4.0/user/guide/admin/useNotif.html#wp1075603

Similar Messages

CiscoWorks LMS: not receveing certain SNMP traps

CiscoWorks LMS 4.0.1 (I know it's old and unsupported).
Problem: not receiving certain SNMP traps.
For example: I receive trap like "STP new root" but not like "port put to err-disabled" or my custom traps (produced by EEM scripts).
I've investigated my situation and found out that switch sends traps and they reach* LMS but somehow LMS ignores them (there's no trace of them in GUI). I've read that some traps just pass through LMS but my traps are very important and I need to know about them.
* I did Wireshark capture on LMS machine.
I'd like to know how to debug receiving of SNMP traps in LMS:
which specific debugs need to be enabled,
which specific log files need to be examined.

LMS uses DFM to process certain traps.
All traps it deems unimportant are dropped.
If you want to use the LMS GUI you can have you device send a SYSLOG message rather than a trap.
use logging source command to make the management interface send the message.
Then there is a GUI that allows you to launch an action on a message
Cheers,
Michel

Custom device prompt in Ciscoworks LMS

Hello,
In emerging network infrastructure of our client we decided to use some custom promps at device VTY (SSH and Telnet). Console users are network authenticated by means of ACS, and in case ACS is not reachable, we decided to use login prompts as follows:
Username(local):
Password(local):
In this local mode, when CiscoWorks LMS (3.1) tries to collect configuration of switches, VLAN configuration exactly, we got such error messages in LMS interface:
TELNET: Failed to establish TELNET connection to 10.52.0.1 - Cause: Authentication failed on device 3 times. VLAN Config fetch is not supported using TFTP. Command failed VLAN Config fetch is not supported using RCP.
Of course, we have checked the possibility to got from LMS host to these devices by SSH and Telnet, credentials are correct, only login prompts are as described earlier.
I conclude, we need to tell LMS to accept our custom prompts. Is there any possibility and how to achieve this?

If you're sure the failure is due to the custom prompt, yes, you can simply follow the steps in the following document to let LMS know about that:
http://www.cisco.com/en/US/products/sw/cscowork/ps2073/products_tech_note09186a00801442c9.shtml

CiscoWorks LMS 4.1

Hi,
Currently we have CiscoWorks LMS 2.6 and looking to buy or if possible upgrade to latest version of CiscoWorks LMS 4.1
I need confirmation is this LMS 4.1 is a bundle? Like including RME, Common Services, CiscoView, Device fault Manager, Campus Manager and etc.,?
Naidu.

An upgrade from LMS 2.x to LMS 4.1 is possible. With LMS 2.6 there was no device count restriction but the next major release (LMS 3.0) introduced licensing based on device count. So you have to determine which device count you need. Available licenses are for example:
    LMS41-300-UP-K9         Upgrade LMS 2.x 3.x to 4.1 Base DVD for 300 devices
    LMS41-1.5K-UP-K9         Upgrade LMS 2.x 3.x to 4.1 Base DVD for 1500 devices
LMS 4.1 is a bundle and - under the cover - still contains CS, CiscoView, RME, CM, DFM and meanwhile also IPM (Internetwok Performance Monitor) and HUM (Health and Utilization Monitor); With LMS 4.x they cannot be installed as standalone applications as it was with LMS 2.x/ 3.x; Also the GUI has undergone a complete re-write (and thus re-organization) - see the link to the data sheets below.
There will be some changes with LMS because it will be merged together with "Cisco Prime Network Control System" into "Cisco Prime Infrastructure".
Thus the latest release of LMS (LMS 4.2) is available in the "Cisco Prime Infrasturcture" Bundle which contains both these products:
      Cisco Prime Network Control System 1.1        (Mgmt for Wireless Products)
      Cisco Prime LAN Management Solution 4.2       (Mgmt for Network devices)
Data sheets for LMS 4.2 and LMS 4.1 are available here:
    http://www.cisco.com/en/US/customer/products/ps11200/products_data_sheets_list.html
Ordering and licensing guide for "Cisco Prime Infrasturcture" is here:
    http://www.cisco.com/en/US/prod/collateral/netmgtsw/ps6504/ps6528/ps12239/ordering_guide_c07-697784_ps11686_Products_Data_Sheet.html

LMS 4.2 - DFM devices stuck in "Learning" state

Hi,
Does anybody know why this same kind of bug/error/software fault exist in LMS 4.2 as it was in LMS 3.2 ? Why after a while after discovery of devices (state is "Known") DFM drops the state of devices to "Learning" and it stucks forever. Restarting of daemon manager helps for a short time. It looks like the processing of faults stops a while after discovery is complete.
LMS 4.2 is running on Solaris 10, connected to other LMS in DCR Slave configuration.

The connection between the ciscoworks GUI and the DFM repository is not 'optimal', or something like that. It's complicated.
What could cause the behavior you mention however, is either someone rediscovering devices that are still in learning state, or the presence of multiple active rediscovery schedules.
You may even delete all schedules excepts the default redisovery schedule which you can/should suspend. If the problem then stays away you know what caused it.
At this stage any device that really changes must be rediscoverd in DFM manually.
I think Admin -> Fault takes you to a page showing the schedule, if not lookup 'fault rediscovery schedule' in the help.
Cheers,
Michel

Ciscoworks LMS 4.0 – Fault Device Details Issue

       We currently use Ciscoworks LMS 4.0 but when I go into, Monitor > Fault Settings > Setup > Fault Device Details
       I get the following message (see attached document with screenshot) and being a LMS newbie am unsure what to do? As have tried to search for this
       file but no luck.
       So thanks in advance for any advice.

Check if the fault management rediscovery page shows device as discovered and known or does it have any errors?
Are you able to generate any fault management reports and view other pages?
Just try to reboot the server/restart daemon to see if it is goes away.
Else it is mostly corrupt FM DB. Which would need to be re-initialized.
Fault Mgmt reinitialize is very simple task, which doesnt removes a lot of data, except past 31 days of FM history and custom notifications, if configured.
Thanks
Vinod
**Rating Encourages contributors, and its really free. **

Ciscoworks LMS 4.0 – Email Notifications Issue

We currently use Ciscoworks LMS 4.0 with over 1000 devices in the database. I'm a LMS novice. And have been assigned the task of minimising the amount of email notification’s we receive, as if one device goes Operationally Down all devices off that switch also send alerts to the email notification group, which in turn overwhelms the mailbox.
The ports are configured not to log or send snmp traps.
no logging event link-status
no snmp trap link-status
So any advice on how we can limit these alerts being generated would be much appreciated.
Thanks in advance.

Hi Nessie,
Go to Monitor > Fault Settings > Setup > Fault Device Details
select the device and click on view then Click on the hyperlink or the device name\ip address
that will bring a new window from there click on Interface and chanaged the Managed state from ture to FLASE for those interfaces for which you do not want ALERTS.
Thanks-
Afroz
[Do rate the useful post]

CiscoWorks LMS 4.0.1 and devices other than Cisco.

Hello.
Can I use some CiscoWorks LMS functions like config management, topology, with devices other than Cisco?
Thanks.
Andrea

No, RME, Campus and DFM are still hardcoded to restrict to cisco devices.
HUM and IPSLA are more open.
The functionality from the HUM will allow you to monitor availablilty, interfaces and you can add OID's yourself.
IPSLA can use non cisco devices as a target for their tests.
Cheers,
Michel

CiscoWorks LMS 4.0.1 - some questions

Hello community,
I would like to ask some questions about CiscoWorks LMS 4.0.1.
We are using for a few days, and I can't set some request in the system. I hope someone could help me to customize the CW as I would like to use it.
- We have some Catalyst 6500s, and between them there are Etherchannels. CiscoWorks sends us email because HighUtilization, and it relies on a Gi interface. I read that CW doesn't support etherchannels, is this true.
- I would like to receive email notifications about errdisabled state, etc. I know this is dome by RME, not DFM. The CiscoWorks server acts as Syslog server, too, and it collects the syslogs. I see in the Syslog summary, that the device sends to CW the syslog, but I can't receive email. I did an automated actions, (Monitor-Syslog-Automated actions), I defined the parameters (Facility: *, Sub-facility: *, Severity: 2, Mnemonic: PSECURE_VIOLATION, Description: *), but CW doesn't send me an email.
- I would like to customize interface threshould parameters per device. We have some router with Tunnel utilization 90%, but it's okay because we have a 10Mbit line for the external site. But when our distribution switch ethernet utilization would be 90%, it would be critical. Where can I set these parameters per device/interface?
Thank you for your help in advance.
Ferenc KURIS

If you go to Monitoring > Fault Settings > setup > fault device details
Select the device click view and click the device to open the detailed device view.
There you may see the tu interface under interfaces and set it to managed.
Cheers,
Michel

Adding Device support/definitions in Ciscoworks LMS 3.2

Hi All
I am having some issues adding updated definitions for Cisco C3750X-48PS switches.
We have ciscoworks LMS 3.2 and I need to update the definition/device support for these switches. We are conducting a network refresh and are having some issues with ciscoworks polling these devices correctly.
I have looked through the various user guides and searched on google with not much luck as to how to actually do this, the links I have found breifly go into it, but not indepth, and the cisco links I have found, of course have redirects to new pages which bear to resemblance to what is in the original document. Is there a clear guide out there on how to update the switch definiton in ciscoworks? So I can i can try and do this correctly?
I am new in my current role and I want to ensure I am doing this correctly. Apologies if this has been asked before.
thanks

First thing to check is the supported device table for LSM3.2. According to it, the 3750X-48P-S is supported pretty much across the board by the LMS tools.
So you then need to just make sure you update the RME, CM, DFM and CiscoView device packages to integrate the updates into your server. While you can manually download and install the various packages, this task is more easily accomplished via the application GUI itself.
In LMS 3.2, updates can be done via the Common Services Software Center. The User Guide (here) tells how to use that area in great details. I usually just select "everything" for updating so as to be fully updated for whatever gets installed (as opposed to trying to pick and choose the minimal set of packages).

CiscoWorks LMS 3.2 Won't Start on Windows Server 2008 Enterprise

All,
I installed CiscoWorks LMS 3.2 RME on Windows Server 2008 Enterprise and the daemon manager won't start. The server is a VMware ESX server 4.0.
I've uninstalled and reinstalled and still nothing.
I get message "The service is not responding to the control function"
Has anyone had this issue?
Stephanie

There could be several reasons this happens. Common one in Windows 2008 is the swap is not set properly as it defaults to "Automatically manage paging file size for all drives". Try setting the swap to 8GB manually or whichever is the recommendation for your current device count as per:
http://www.cisco.com/en/US/docs/net_mgmt/ciscoworks_lan_management_solution/3.2/install/guide1/prereq.html
Also make sure the startup services are set this way:
CiscoWorks ANI database engine: Manual
CiscoWorks Daemon Manager: Automatic
CiscoWorks RME NG database engine: Manual
CiscoWorks Tomcat Servlet Engine: Manual
CiscoWorks Web Server: Manual
CWCS Cmf database engine: Manual
CWCS rsh/rcp service: Automatic
CWCS syslog service: Automatic
CWCS tftp service: Automatic
DFM dfmEpm database engine: Manual
DFM dfmFh database engine: Manual
DFM dfmInv database engine: Manual
Set DEP for "Windows Essential Programs Only" and set an exclusion for CSCOpx in your anti-virus on-access scanning settings. Note that Windows 2008 R2 versions are not supported.

LMS 4.2 - DFM operation ?

Hi,
I'm wondering what is required for DFM in LMS 4.2 to work properly. I've migrated it from LMS 3.2.1 an it was quite easy to set up : tie master and slave server with DCR, allow some ports (icmp, snmp) for DFM and the discovery process started without a problem.
Now, I have same configuration (the server is the same) but it looks like DFM is not going to allocate any devices and is not going to start discovery at all. They are present in CS but DFM is not seeing them. What could be preventing DFM from starting?
Greets,
Tomek

The connection between the ciscoworks GUI and the DFM repository is not 'optimal', or something like that. It's complicated.
What could cause the behavior you mention however, is either someone rediscovering devices that are still in learning state, or the presence of multiple active rediscovery schedules.
You may even delete all schedules excepts the default redisovery schedule which you can/should suspend. If the problem then stays away you know what caused it.
At this stage any device that really changes must be rediscoverd in DFM manually.
I think Admin -> Fault takes you to a page showing the schedule, if not lookup 'fault rediscovery schedule' in the help.
Cheers,
Michel

Extract Devices from Ciscoworks LMS 4.2 to Nagios database

Hello everyone,
I'm working on ciscoworks LMS 4.2 and as part of a project I need to extract all of my devices to a Nagios Database.
Is it possible to do ?
If yes, can you explain me how can I do that ?
Perhaps with snmp traps, I don't know.
Thank for your consideration and your help.
Cordially.

I am not an expert in Nagios, so no idea on what options does it have to import devices.
In LMS, you have an option to export devices and its credentials list in .csv and xml format. Please check if you can use any one of those to get imported on Nagios.
Check details on how to export from user guide here :
http://www.cisco.com/en/US/docs/net_mgmt/ciscoworks_lan_management_solution/4.2/user/guide/inventory/mng_device.html#wp1132486
Also, you can try to fetch database details from LMS using Open Database Connect. Use the following document for more details :
http://www.cisco.com/en/US/docs/net_mgmt/ciscoworks_lan_management_solution/4.2/database_schema/dbviews_42.html#wp23144
You should check the possible option on Nagios to import devices and than ask if that is available on LMS.
-Thanks
Vinod
**Rating Encourages contributors, and its really free. **

Prblem while adding firewall in ciscoworks lms 2.6

We are not able to add firewall ASA5510 in ciscoworks LMS 2.6.
SNMP configuration on firewall is as follows
snmp-server host inside 10.48.2.54 community firewall version 2c
no snmp-server location
no snmp-server contact
snmp-server community ****
snmp-server enable traps snmp authentication linkup linkdown coldstart
Please check attached file for ciscoworks configuration, SNMP Walk command output and Firewall "show version" output.

Now I am able to add firewall but when i am trying to access firewall through Cisco View> Chassis View I am getting following error.
Message
Can't find applicable device package for 10.44.100.37.
Cause
Device package for this device type is not installed or device support for this device type might not be available or you are attempting to open a component inside a device.
Action
Please install a device package for the device type or open the parent device to manage the component.
When I configured netshow job for "show running-config" and "show tech-support" it ends with following error
Command(s) failed on the device Insufficient no. of interactive responses(or timeout) for command: show tech-support. Insufficient no. of interactive responses(or timeout) for command: show tech-support.

Ciscoworks LMS 4.2.2 keeps sending icmp to a specific IP

Hi All,
I got the following logs from the syslog server. My Ciscoworks LMS 4.2.2 (IP 10.26.73.1) keeps sending icmp to 128.100.3.221 and generated tons of logs. I checked the Ciscoworks but couldn't locate the IP of 128.100.3.221. Please help me stop the ICMP on the Ciscoworks. Thanks in advance.
1                            2013/06/18 15:12:33.839 EDT            10.26.0.9               Jun 18 2013 15:12:31: %ASA-3-106014: Deny inbound icmp src inside:10.26.73.1 dst inside:128.100.3.221 (type 8, code 0)
2                            2013/06/18 15:12:42.105 EDT            10.26.0.9               Jun 18 2013 15:12:39: %ASA-3-106014: Deny inbound icmp src inside:10.26.73.1 dst inside:128.100.3.221 (type 8, code 0)
3                            2013/06/18 15:12:44.918 EDT            10.26.0.9               Jun 18 2013 15:12:42: %ASA-3-106014: Deny inbound icmp src inside:10.26.73.1 dst inside:128.100.3.221 (type 8, code 0)
4                            2013/06/18 15:12:49.512 EDT            10.26.0.9               Jun 18 2013 15:12:46: %ASA-3-106014: Deny inbound icmp src inside:10.26.73.1 dst inside:128.100.3.205 (type 8, code 0)
5                            2013/06/18 15:13:18.562 EDT            10.26.0.9               Jun 18 2013 15:13:15: %ASA-3-106014: Deny inbound icmp src inside:10.26.73.1 dst inside:128.100.3.221 (type 8, code 0)
6                            2013/06/18 15:13:19.234 EDT            10.26.0.9               Jun 18 2013 15:13:16: %ASA-3-106014: Deny inbound icmp src inside:10.26.73.1 dst inside:128.100.3.205 (type 8, code 0)
7                            2013/06/18 15:13:30.985 EDT            10.26.0.9               Jun 18 2013 15:13:28: %ASA-3-106014: Deny inbound icmp src inside:10.26.73.1 dst inside:128.100.3.205 (type 8, code 0)
8                            2013/06/18 15:13:31.361 EDT            10.26.0.9               Jun 18 2013 15:13:28: %ASA-3-106014: Deny inbound icmp src inside:10.26.73.1 dst inside:128.100.3.205 (type 8, code 0)
9                            2013/06/18 15:13:52.144 EDT            10.26.0.9               Jun 18 2013 15:13:49: %ASA-3-106014: Deny inbound icmp src inside:10.26.73.1 dst inside:128.100.3.221 (type 8, code 0)
10                          2013/06/18 15:13:59.692 EDT            10.26.0.9               Jun 18 2013 15:13:57: %ASA-3-106014: Deny inbound icmp src inside:10.26.73.1 dst inside:128.100.3.205 (type 8, code 0)
11                          2013/06/18 15:14:33.727 EDT            10.26.0.9               Jun 18 2013 15:14:31: %ASA-3-106014: Deny inbound icmp src inside:10.26.73.1 dst inside:128.100.3.221 (type 8, code 0)
12                          2013/06/18 15:14:42.103 EDT            10.26.0.9               Jun 18 2013 15:14:39: %ASA-3-106014: Deny inbound icmp src inside:10.26.73.1 dst inside:128.100.3.221 (type 8, code 0)
13                          2013/06/18 15:14:45.697 EDT            10.26.0.9               Jun 18 2013 15:14:43: %ASA-3-106014: Deny inbound icmp src inside:10.26.73.1 dst inside:128.100.3.221 (type 8, code 0)
14                          2013/06/18 15:14:49.213 EDT            10.26.0.9               Jun 18 2013 15:14:46: %ASA-3-106014: Deny inbound icmp src inside:10.26.73.1 dst inside:128.100.3.205 (type 8, code 0)
15                          2013/06/18 15:15:19.169 EDT            10.26.0.9               Jun 18 2013 15:15:16: %ASA-3-106014: Deny inbound icmp src inside:10.26.73.1 dst inside:128.100.3.205 (type 8, code 0)
16                          2013/06/18 15:15:19.294 EDT            10.26.0.9               Jun 18 2013 15:15:16: %ASA-3-106014: Deny inbound icmp src inside:10.26.73.1 dst inside:128.100.3.221 (type 8, code 0)
17                          2013/06/18 15:15:30.467 EDT            10.26.0.9               Jun 18 2013 15:15:27: %ASA-3-106014: Deny inbound icmp src inside:10.26.73.1 dst inside:128.100.3.205 (type 8, code 0)
18                          2013/06/18 15:15:31.592 EDT            10.26.0.9               Jun 18 2013 15:15:28: %ASA-3-106014: Deny inbound icmp src inside:10.26.73.1 dst inside:128.100.3.205 (type 8, code 0)
19                          2013/06/18 15:15:52.673 EDT            10.26.0.9               Jun 18 2013 15:15:50: %ASA-3-106014: Deny inbound icmp src inside:10.26.73.1 dst inside:128.100.3.221 (type 8, code 0)
20                          2013/06/18 15:15:59.720 EDT            10.26.0.9               Jun 18 2013 15:15:57: %ASA-3-106014: Deny inbound icmp src inside:10.26.73.1 dst inside:128.100.3.205 (type 8, code 0)
21                          2013/06/18 15:16:34.334 EDT            10.26.0.9               Jun 18 2013 15:16:31: %ASA-3-106014: Deny inbound icmp src inside:10.26.73.1 dst inside:128.100.3.221 (type 8, code 0)
22                          2013/06/18 15:16:42.428 EDT            10.26.0.9               Jun 18 2013 15:16:39: %ASA-3-106014: Deny inbound icmp src inside:10.26.73.1 dst inside:128.100.3.221 (type 8, code 0)

You can unmanage or remanage device components using the Detailed Device View (cards, interfaces, ports, IP addresses, and so forth). If you unmanage a component, LMS will ignore subsequent events (including traps).
You can check the details here :
http://www.cisco.com/en/US/docs/net_mgmt/ciscoworks_lan_management_solution/4.2/user/guide/lms_monitor/mnt-fault.html#wp1586744

Ciscoworks LMS 4.0 DFM Custom Traps

Similar Messages

Maybe you are looking for