LMS 4.0 - a fault annotation

Hi,
the customer uses LMS 4.0. He annotated one fault and he cleared this fault. So this fault was cleared and it wasn't seen in the fault monitor. For now the fault is again active and the annotation for this fault is shown. So my question is: Does DFM have some annotation database where all anotation of faults are saved? When the same faults re-occur and the annotation was made for this fault in history - this fault will be displayed with this annotation??
Thank you.
Best Regards
Roman

The annotations are saved to a specific event. If the event re-occurs, that event will have a new ID, so the annotation will not be there. Annotations are saved in the dfmEpm database.

Similar Messages

LMS 4.2.2 Fault manager does not resolve hostname for some devices

This is Cisco Prime LMS 4.2.2 on Windows 2008 R2
As far as I understand it Fault Manager need to be able to do reverse lookup for ip adresses to show the correct name in the "device name" column. I have double and tripple checked and all devices that only is shown as an ip address do have a reverse in the dns used by the LMS server.
The device is correctly registered and inventory have been run. If I hold the mouse pointer over the crosshair on the row of the offending device all info is shown including correct device name and fqdn.
The server is upgraded from 4.2.1 to 4.2.2 and we have the same problem before the upgrade.

The problem may occur if the lookup was not possible when the device was added to fault management.
Faultmanager, unlike the rest of LMS, does not update the display name.
If the resolver.pl in /opt/CSCOpx/bin is able to get the device name, then resolution is fine.
The only workarrounds are to the delete the device from LMS and re-add it, or use cli tools on the server to remove and re-add the device from the DFM repository.
Cheers,
Michel

LMS 4.2.2 Fault Discovery - Network Adapters Limit Exceeded

Running fault device discovery after adding approx 50 new devices to LMS DCR. It seems I have reached a limit in DFM with regards to how many device components it can manage. The devices are put into questioned mode and the following error is seen in the Question State Device Report
Network Adapters Limit Exceeded.The number of Network Adapters discovered by Fault Management exceeded the maximum supported limit.Please check on screen help for more information.
What is the limit that is being referred to here? Is it independent of the LMS device licence? Where can I see how many "network adapters" LMS is monitoring? I have approx 900 devices being managed by LMS on a 1500 device licence. I am running LMS 4.2.2
Any light you could shed on this would be appreciated
Thanks,
Mark

I've come across this a few times. I did not find a solution. It went away with a reinstall.
What seems to happen is that somehow DFM puts all the device interfaces in a managed state.
It should not.
It should only manage the ports and interfaces that connect to another managed device.
There is a hardcoded limit of 40.000 managed ports in DFM.
Suspected situations:
On one server where I found this the system locale that I put to us-english, was somehow put back to be-french. Maybe even during the installation, not sure who or what did this.
On another server the anti-virus which I had turned off, was turned back on during installation,probably by a policy server.
Cheers,
Michel

LMS 4.2.2 Fault discovery stalls, never complete

Using LMS 4.2.2 on a network with approx 800 devices. Fault discovery runs for long periods without completion, previously known devices sit in learning state for long long periods. Some devices do become known but this seems random as to which ones. Faults are still reported on devices in a learning state, which means there are often many faults reported which are false. However because devices are in learning state the false positives cannot be weeded out. This problem has been occuring since LMS 4.0 so have not had Fault and event monitoring working properly for some time, however would seriously like to utilise this feature.
Would appreciate any pointers as to where to start... Mark

I am having the IP vs. device name issue as well. The funny thing is if you hover over the IP of the device in Fault Monitor, you can see the device name listed. I was on a conference call with Cisco recently and pointed this out. One of the reps said the faults and alerts showing IP address issue should be fixed in version 4.2.3, but I don't know if he was basing this on first-hand knowledge or was just assuming. Does anyone know if this is the case?
As for throttling alerts. I had a false positive alert from a device that I put in a custom fault group and changed the threshold on to keep them from firing. You probably have already resolved this issue, but I didn't see a resolution listed here. You would have to determine if raising a threshold for a device is adequate for your situation.
Thank you,
Mark

LMS 3.2 DFM Fault History purge Job

Hey experts,
the Online Help for LMS 3.2 say "Data for Fault History remains in the DFM database for 31 days".
How can I increase or reduce the amount of days the data will remain in the DFM Fault History Database?
Is it possible to have only 10 Days in Fault History or can I set it up to 60 Days?
Is there a specific config file which could be edited for my purposes?
I know the purge Job for Fault Hostory but it purges the data which is older than 31 days, I can´t adjust this job.
thx,
Patrick

No, this is immutable. The only thing you can change is the TIME at which the purge happens.

LMS 4.2.2 Fault Monitor suspend device

Hello to everyone,
might sound strange but i´m looking for two hours now and can not find a way to suspend a device in the Fault Monitor. We´re using LMS 4.2.2
Can someone point me to the right direction? Thank you.
Regards,
Chris

Ok, found it: Inventory -> Manage Device State -> Device Count -> Suspend!!

LMS 4.0 - Invisible faults

Since I installed LMS 4, the Faults panel at the top of the screen always reports 4 critical faults. When I click on the red icon to go to the Fault Monitor, I get "No faults are available" (screenshot attached).
Anyone know how to fix this?
Thanks

The quickest way is to reinitialize the DFM databases by following the instructions in https://supportforums.cisco.com/docs/DOC-8796 . However, if you want a more tactical analysis you can open a TAC service request, and they can go through the dfmEpm database to look at why these counters are wrong. The counters should be showing the total number of events, which are the atomic conditions occurring on the devices. This would not necessarily line up to the alerts seen at the top level of the Fault Monitor. However, in your case since you don't see any alerts, you shouldn't have any events.

LMS 4.2.3 Fault Monitor threshold question

Hello, I would like to know if anyone know how to find out which Fault Threshold group a specific interface belongs to.
The scenario is that in Fault Manager there is an alarm for which I want to change the Threshold Setting.
Example Alarm:
Event_Description HighUtilization
Device IP x.x.x.x
Device Type Routers
Fault Last Updated At 19-Mar-2013 09:44:25
Component IF-router2.x.x/26 [Tu187] [x.x.x.x]
Component Class Interface
Component Event Code 1056
Current Utilization 68.323204 %
Duplex Mode FULLDUPLEX
Event Category Utilization
Event Source DFM
If Description Tunnel187
Max Speed 100000
Traffic Rate 8540.4 BYPS
Type TUNNEL
Utilization Threshold 40
If I look in Monitor > Fault Settings > Setup > Threshold Settings.
Then expand all groups under DFM, there is no group called "Tunnel", so the question is which group this Interface belongs to?
BR /Crille

Its defined as an 10/100 ethernet interface " Component Class Interface" with a 40% threshold utilization which it fell below per the event notifiation of 68.3%.
Component IF-router2.x.x/26 [Tu187] [x.x.x.x]
If Description Tunnel187 --> Interface on router
Max Speed 100000 --> Interface type(Fast Ethernet)

LMS4 + DFM timing for SNMP3

Hello,
Have the problem (LMS4 + newest CS and DFM device package) that I get just 10% of DCR devices discovered in DFM and just a little bit increased with max. SNMP timeout.
All DFM Unknown devices are SNMP timeouted in DFM, but could be discovered in CM and RME inventory.
Because SNMPv3-AuthPriv could be much slower than v2 for a lot of devices, I wanted to try with a better timing for it.
But in DFM-Admin GUI I cant lower retries count not less than 3 and cant increase timeout more than 30s.
What can I do to get all devices managed in DFM as well?
Steffen

I doubt the problem is really an SNMP timeout. If other features in LMS can manage the devices, make sure that the devices can be pinged from the LMS server. The fault management piece of LMS is the only feature that requires devices to be ICMP reachable. If the managed IPs of the devices cannot be pinged, DFM will not be able to manage them.
Also, make sure the SNMP engineIDs are unique across all devices. Run the "show snmp engine" command on all devices, and confirm the value is unique. If not, you will need to set the engineID to a unique value, then reboot the device. Unmanage the device from fault management, then re-manage it.

LMS 4.1 - Fault Notification Group

I've populated my LMS v4.1 device database with all our managed devices (192.168.x.x). When I go to 'FAULT NOTIFICATION GROUP' and I must select either the nodes or groups that are associated with this this group, certain nodes are not appearing in the list where I must add them to the group.
As another test, I've created a 'USER DEFINED GROUP' and added all the nodes into it (including the ones I did not see in my prior test). When I add the "UDG" to the 'FNG", most of the are listed int he "Group Subscription Summary" but not all nodes.
I am running LMS v4.1 on Windows 2008.
I suspect it has something to do with the status of the device but I'm still trying to figure it out.
Any assistance would be appreciated.
Thanks,

thanks Joe for your efforts! - and again, you are correct...
resolver.pl LMSserverName
returned 127.0.0.1 as the servers' address - and where did it come from? - the hosts file... There, the hostname and FQDN of the server had entries which pointed to 127.0.0.1 - no clue why this was done. For a test I commented out these entries and at least resolver.pl now returns the correct IP address of the server.
I tried to force a Fault Notification Trap to be sent, but currently no chance; Usually I can do this by just clear a currently active event which gets forwarded, but this time it seems not working. I can mark the event, I get a pop-up to to change the name and make annotations, I even can click on "Yes" to confirm the action -but then nothing happens. - I tried these steps a couple of times the last 45 mins- I think I will wait know until the HighUtil goes a way and drink a wine meanwhile :-)
and I believe cenAlarmServerAddress will be correct now...

LMS 4.0 Fault Management Module alert doesn't show CurrentUtilization

Hi,
I would like to know if there's a way to show CurrentUtilization percentage within the messages generated by the Fault Management Module in LMS 4.0
EVENT ID                = 00008Z1
TIME                    = S
STATUS                  = Active
SEVERITY                = Critical
MANAGED OBJECT          = switch
MANAGED OBJECT TYPE     = Switches and Hubs
EVENT DESCRIPTION       = HighUtilization::Component=PORT-switch/11150 [Gi3/0/50] [---> TRUNK ];ComponentClass=Port;ComponentEventCode=1057;TrafficRate=5.2261432E7 BYPS;DuplexMode=FULLDUPLEX;UtilizationThreshold=40;MaxSpeed=1000000000;Type
NOTIFICATION ORIGINATOR = Fault Management Module
As you can see above CurrentUtilization percentage is not shown in Event Description section.
Could someone help?
Thank you!
Massimiliano.

To my knowledge nothing can be configured here.
You have to take traffic rate and max speed and do the calculation yourself
FAD! functioning as designed
Cheers,
Michel

LMS 4.2 Fault Manager Issue

Hi All,
We are seeing many Unidentified traps on the DFM for multiple devices.
274.              008ZETI      Active          InformAlarm                   Mumbai_6509-1          Mumbai_6509-1: Unidentified Trap Generic Trap:6 Specific Trap:1 EnterpriseOid:.1.3.6.1.4.1.9       04-Feb-2015 01:59:28                    NA
275.              008ZETG    Cleared      InformAlarm                   Mumbai_6509-1          Mumbai_6509-1: Unidentified Trap Generic Trap:6 Specific Trap:1 EnterpriseOid:.1.3.6.1.4.1.9       04-Feb-2015 01:59:03                    NA
276.              008ZETA     Active          InformAlarm                   Mumbai_6509-1          Mumbai_6509-1: Unidentified Trap Generic Trap:6 Specific Trap:2 EnterpriseOid:.1.3.6.1.4.1.9.9.109.2            04-Feb-2015 01:58:22                    NA
274.              008ZETI      Active          InformAlarm                   Mumbai_6509-1          Mumbai_6509-1: Unidentified Trap Generic Trap:6 Specific Trap:1 EnterpriseOid:.1.3.6.1.4.1.9       04-Feb-2015 01:59:28                    NA
275.              008ZETG    Cleared      InformAlarm                   Mumbai_6509-1          Mumbai_6509-1: Unidentified Trap Generic Trap:6 Specific Trap:1 EnterpriseOid:.1.3.6.1.4.1.9       04-Feb-2015 01:59:03                    NA
276.              008ZETA     Active          InformAlarm                   Mumbai_6509-1          Mumbai_6509-1: Unidentified Trap Generic Trap:6 Specific Trap:2 EnterpriseOid:.1.3.6.1.4.1.9.9.109.2            04-Feb-2015 01:58:22                    NA
Regards,
Channa

Hi,
The unidentified trap message in fault manager is expected when LMS receives a trap that is not in the list of traps that the fault manager is capable of processing.
Here are the traps that fault manager can process:
http://www.cisco.com/c/en/us/td/docs/net_mgmt/ciscoworks_lan_management_solution/4-2/user/guide/lms_monitor/lms_mnt/TrapFwd.html
The SNMP traps are only processed by the fault manager and as per the document above the ones that will be identified are pre-defined and the list cannot be modified.
Clearing an Unidentified Trap
You can manually clear Unidentified Traps from LMS. To do this:
Step 1 Select the Unidentified Trap and click Clear.
A message appears prompting you to confirm the clearing.
Step 2 Enter your user ID.
This will be used as a reference to identify who cleared the Unidentified Trap.
Step 3 Click OK to confirm.
The Unidentified trap is cleared.
To retain the trap click Cancel.
- Ashok
Please rate the post or mark as correct answer as it will help others looking for similar information

LMS 4.2.1 - unidentified traps in fault monitor

MY LMS, under fault monitor, shows many messages (actually hundreds), "Unidentified Trap Generic Trap:6 Specific Target:1 EnterpriseOid:.1.3.6.1.4.1.9.9.41.2"
This OID leads me down the CISCO-SYSLOG-MIB.my, to ciscoSyslogMIBNotification.
vestigaiton looks like this MIB actually doesn't do anything (other than generate a fault message on LMS).
Anyone have any ideas how I can get rid of this fault in LMS, such as adding the CISCO-SYSLOG-MIB.my to my LMS so that it can at least identify the OID being sent.
Along these lines, I have downloaded the above referenced MIB, and have tried in LMS to upload it, but the "upload MIB" functionality ONLY allows the loading of MIBS which already exist on LMS (only choose a server side path).
Any ideas would be aprpeciated.
Joe

Hi Joe,
check the below link for more results on Unidentified traps:
http://www.cisco.com/en/US/docs/net_mgmt/ciscoworks_device_fault_manager/3.1
/user/guide/TrapFwd.html#wpxref57860
It looks like "snmp-server enable traps syslog" is enabled on your devices, and this will appears as Unidentified trap , you can stop this by change the configuration on the Device , or disable the "InformAlarm" from the notification Group under : Admin > Network > Notification and Action Settings > Fault Notification Group From the following Link you can check the traps that will generate "INFORM ALARM" event :
I hope this will help
Thanks-
Afroz

LMS 4.2 Fault Monitor - Device Name and Frequency of Events

Hi all,
I've just installed LMS 4.2, like it a lot so far. But I'm running into a few problems, and I'm hoping someone out here has a suggestion.
In the Fault Monitor, the Device Name column shows the device's IP address rather than the host name. We need for it to show the host name, for ease of troubleshooting; most folks don't have the IP addresses memorized. Likewise, when an email is sent out for an event, the managed device field also shows up as the device's IP address.
The devices were all discovered with their IP addresses rather than a host name...should LMS have automatically found their host names? Regardless, I manually updated all of the device's host names, yet they still display as an IP address in the fault monitor.
Also, it appears I need to figure out some way to throttle alerts. One particular device will report an event (ie a temperature out of range) dozens of times in a polling period...several per second, even though it's the same alert. Any suggestions on where I can throttle this? My inbox is exploding.
If anyone has any ideas, I would appreciate it!
Jen

I am having the IP vs. device name issue as well. The funny thing is if you hover over the IP of the device in Fault Monitor, you can see the device name listed. I was on a conference call with Cisco recently and pointed this out. One of the reps said the faults and alerts showing IP address issue should be fixed in version 4.2.3, but I don't know if he was basing this on first-hand knowledge or was just assuming. Does anyone know if this is the case?
As for throttling alerts. I had a false positive alert from a device that I put in a custom fault group and changed the threshold on to keep them from firing. You probably have already resolved this issue, but I didn't see a resolution listed here. You would have to determine if raising a threshold for a device is adequate for your situation.
Thank you,
Mark

Ciscoworks LMS 4.0 – Fault Device Details Issue

       We currently use Ciscoworks LMS 4.0 but when I go into, Monitor > Fault Settings > Setup > Fault Device Details
       I get the following message (see attached document with screenshot) and being a LMS newbie am unsure what to do? As have tried to search for this
       file but no luck.
       So thanks in advance for any advice.

Check if the fault management rediscovery page shows device as discovered and known or does it have any errors?
Are you able to generate any fault management reports and view other pages?
Just try to reboot the server/restart daemon to see if it is goes away.
Else it is mostly corrupt FM DB. Which would need to be re-initialized.
Fault Mgmt reinitialize is very simple task, which doesnt removes a lot of data, except past 31 days of FM history and custom notifications, if configured.
Thanks
Vinod
**Rating Encourages contributors, and its really free. **

LMS 4.0 - a fault annotation

Similar Messages

Maybe you are looking for