LMS 4.2.3 Fault Monitor threshold question

Hello, I would like to know if anyone know how to find out which Fault Threshold group a specific interface belongs to.
The scenario is that in Fault Manager there is an alarm for which I want to change the Threshold Setting.
Example Alarm:
Event_Description HighUtilization
Device IP x.x.x.x
Device Type Routers
Fault Last Updated At 19-Mar-2013 09:44:25
Component IF-router2.x.x/26 [Tu187] [x.x.x.x]
Component Class Interface
Component Event Code 1056
Current Utilization 68.323204 %
Duplex Mode FULLDUPLEX
Event Category Utilization
Event Source DFM
If Description Tunnel187
Max Speed 100000
Traffic Rate 8540.4 BYPS
Type TUNNEL
Utilization Threshold 40
If I look in Monitor > Fault  Settings > Setup > Threshold  Settings.
Then expand all groups under DFM, there is no group called "Tunnel", so the question is which group this Interface belongs to?
BR /Crille

Its defined as an 10/100 ethernet interface " Component Class Interface"  with a 40% threshold utilization which it fell below per the event notifiation of 68.3%.
Component IF-router2.x.x/26 [Tu187] [x.x.x.x]
If Description Tunnel187 --> Interface on router
Max Speed 100000 --> Interface type(Fast Ethernet)

Similar Messages

  • LMS 4.2.2 Fault Monitor suspend device

    Hello to everyone,
    might sound strange but i´m looking for two hours now and can not find a way to suspend a device in the Fault Monitor. We´re using LMS 4.2.2
    Can someone point me to the right direction? Thank you.
    Regards,
    Chris

    Ok, found it: Inventory -> Manage Device State -> Device Count -> Suspend!!

  • LMS 4.2 Fault Monitor - Device Name and Frequency of Events

    Hi all,
    I've just installed LMS 4.2, like it a lot so far.  But I'm running into a few problems, and I'm hoping someone out here has a suggestion. 
    In the Fault Monitor, the Device Name column shows the device's IP address rather than the host name.  We need for it to show the host name, for ease of troubleshooting; most folks don't have the IP addresses memorized.    Likewise, when an email is sent out for an event, the managed device field also shows up as the device's IP address.
    The devices were all discovered with their IP addresses rather than a host name...should LMS have automatically found their host names?  Regardless, I manually updated all of the device's host names, yet they still display as an IP address in the fault monitor. 
    Also, it appears I need to figure out some way to throttle alerts.  One particular device will report an event (ie a temperature out of range) dozens of times in a polling period...several per second, even though it's the same alert.  Any suggestions on where I can throttle this?  My inbox is exploding.                  
    If anyone has any ideas, I would appreciate it!
    Jen

    I am having the IP vs. device name issue as well. The funny thing is if you hover over the IP of the device in Fault Monitor, you can see the device name listed. I was on a conference call with Cisco recently and pointed this out. One of the reps said the faults and alerts showing IP address issue should be fixed in version 4.2.3, but I don't know if he was basing this on first-hand knowledge or was just assuming. Does anyone know if this is the case?
    As for throttling alerts. I had a false positive alert from a device that I put in a custom fault group and changed the threshold on to keep them from firing. You probably have already resolved this issue, but I didn't see a resolution listed here. You would have to determine if raising a threshold for a device is adequate for your situation.
    Thank you,
    Mark

  • LMS 4.0: Fault Monitoring Device Administration stuck in learning

    Hello Members,
    i have a problem with Fault Monitoring Device Administration. i have two devices which stuck in learning mode for almost forever. When the job is done the devices report an error SNMP timeout. I run a credential verfication job and the credentials for the devices are correct.
    any ideas?
    regards
    alex

    Assuming these are the only four devices using SNMPv3 in LMS, then the engineID is a non-issue.  However, if any other device has the same engineID as those two non-working devices, the problem could still be a duped engineID.  Debugging with logs is fairly complex.  The easiest way to identify the problem is to use a sniffer.  Start a sniffer trace filtering on all traffic to one of the failing devices.  Then, rediscover the device in Fault Monitoring under Admin > Collection Settings > Fault > Fault Monitoring Device Administration.  When it goes to a Questioned state, look at the sniffer trace.
    If you see SNMP report packets indicating an error of notInWindow, that points to the duplicate engineID problem.  ICMP packets without responses points to problems with ping.

  • LMS 4.2.1 - unidentified traps in fault monitor

    MY LMS, under fault monitor, shows many messages (actually hundreds), "Unidentified Trap Generic Trap:6 Specific Target:1 EnterpriseOid:.1.3.6.1.4.1.9.9.41.2"
    This OID leads me down the CISCO-SYSLOG-MIB.my, to ciscoSyslogMIBNotification.
    vestigaiton looks like this MIB actually doesn't do anything (other than generate a fault message on LMS).
    Anyone have any ideas how I can get rid of this fault in LMS, such as adding the CISCO-SYSLOG-MIB.my to my LMS so that it can at least identify the OID being sent.
    Along these lines, I have downloaded the above referenced MIB, and have tried in LMS to upload it, but the "upload MIB" functionality ONLY allows the loading of MIBS which already exist on LMS (only choose a server side path).
    Any ideas would be aprpeciated.
    Joe

    Hi Joe,
    check the below link for more results on Unidentified traps:
    http://www.cisco.com/en/US/docs/net_mgmt/ciscoworks_device_fault_manager/3.1
    /user/guide/TrapFwd.html#wpxref57860
    It looks like  "snmp-server enable traps syslog"  is enabled on your devices, and this will appears as Unidentified trap , you can stop this by change the configuration on the Device , or disable the "InformAlarm" from the notification Group under :     Admin > Network > Notification and Action Settings > Fault Notification Group      From the following Link you can check the traps that will generate "INFORM ALARM" event :
    I hope this will help
    Thanks-
    Afroz

  • Not able to see devices in fault monitor LMS 4.0

    I can see devices in the managed group ,but cannot see devices in fault monitor,its show no device available

    Balbir,
    LMS 4.0 is now obsolete. We recommend to use LMS 4.2.x to have the support.
    In LMS 4.x the devices are by default managed by each module like fault monitor. Please share a screenshot where you're expecting and don't see devices.
    When was this installed? Was it working ever? You can also try to reset your fault Monitor module by reinitializing the DataBase for Fault.
    Check the commands from here:
    LMS Database Troubleshooting
    -Thanks
    Vinod
    **Encourage Contributors. RATE Them.**

  • Cisco Works LMS 4.0 - Fault Monitor Issue

    Hi!,
         I have a little problem with the LMS application. when I try to access to the screen of: Monitor --> Monitoring Tools --> Fault Monitor, the application shows an error message that only said: "Sorry an error occurred" and thats all.
    Any idea of what can I try in order to solve this?,
    Thanks,

    Hi Duong!, thanks for your reply. The services was restarted but the problem still exist (the process DFMCTMStartup is allways down although I started manually)
    And the only change that I see is that the Fault Monitor Screen show first a message "There are no faults available" but I Have marked 46 Faults!"

  • Cannot suppress unidentified trap in LMS Fault Monitor

    Hello,
    We have Ciscoworks LMS upgraded from version 4.0.1 to Cisco Prime 4.1.
    DFM is displaying in "Fault Monitor", "Device Fault Summary Tab" an entry which says "Unidentified Trap". In the lower pane titled "Fault for unidentified trap" we have no event to own or clear, so we cannot suppress this line from DFM.
    Any fix available ?
    Best regards
    C.Barbu

    There have been known issues with Fault Monitoring Alerts caused by steal entries in EPM database. To fix this, please run the below commands on your server's command prompt (this will delete all the data from the EPM database):
    + Stop daemon manager :
    net stop crmdmgtd  
    + Re-initialize EPM db as below : 
    NMSROOT\bin\perl.exe NMSROOT\bin\dbRestoreOrig.pl dsn=dfmEpm dmprefix=EPM
    example:
    C:\progra1\CSCOpx\bin\perl.exe C:\progra1\CSCOpx\bin\dbRestoreOrig.pl dsn=dfmEpm dmprefix=EPM
    + Start daemon manager:
    net start crmdmgtd

  • LMS 4.2.2 Fault discovery stalls, never complete

                      Using LMS 4.2.2 on a network with approx 800 devices. Fault discovery runs for long periods without completion, previously known devices sit in learning state for long long periods. Some devices do become known but this seems random as to which ones. Faults are still reported on devices in a learning state, which means there are often many faults reported which are false. However because devices are in learning state the false positives cannot be weeded out. This problem has been occuring since LMS 4.0 so have not had Fault and event monitoring working properly for some time, however would seriously like to utilise this feature.
    Would appreciate any pointers as to where to start... Mark

    I am having the IP vs. device name issue as well. The funny thing is if you hover over the IP of the device in Fault Monitor, you can see the device name listed. I was on a conference call with Cisco recently and pointed this out. One of the reps said the faults and alerts showing IP address issue should be fixed in version 4.2.3, but I don't know if he was basing this on first-hand knowledge or was just assuming. Does anyone know if this is the case?
    As for throttling alerts. I had a false positive alert from a device that I put in a custom fault group and changed the threshold on to keep them from firing. You probably have already resolved this issue, but I didn't see a resolution listed here. You would have to determine if raising a threshold for a device is adequate for your situation.
    Thank you,
    Mark

  • LMS 4.0 - a fault annotation

    Hi,
    the customer uses LMS 4.0. He annotated one fault and he cleared this fault. So this fault was cleared and it wasn't seen in the fault monitor. For now the fault is again active and the annotation for this fault is shown. So my question is: Does DFM have some annotation database where all anotation of faults are saved? When the same faults re-occur and the annotation was made for this fault in history - this fault will be displayed with this annotation??
    Thank you.
    Best Regards
    Roman

    The annotations are saved to a specific event.  If the event re-occurs, that event will have a new ID, so the annotation will not be there.  Annotations are saved in the dfmEpm database.

  • LMS 4.0 - Invisible faults

    Since I installed LMS 4, the Faults panel at the top of the screen always reports 4 critical faults. When I click on the red icon to go to the Fault Monitor, I get "No faults are available" (screenshot attached).
    Anyone know how to fix this?
    Thanks

    The quickest way is to reinitialize the DFM databases by following the instructions in https://supportforums.cisco.com/docs/DOC-8796 .  However, if you want a more tactical analysis you can open a TAC service request, and they can go through the dfmEpm database to look at why these counters are wrong.  The counters should be showing the total number of events, which are the atomic conditions occurring on the devices.  This would not necessarily line up to the alerts seen at the top level of the Fault Monitor.  However, in your case since you don't see any alerts, you shouldn't have any events.

  • How to change Self Monitoring Thresholds in SOLMAN 7.1 SP8?

    Hello Expert,
    I'm wondering if there is an option to change Self Monitoring Thresholds in SOLMAN 7.1 SP8? I'm getting so many SOLMAN Self Monitoring alert's emails, so looking forward to adjust the thresholds (if this is possible at all)?
    Your help is always appreciated.
    Thanks & regards,
    MM

    Hi Roland,
    Thanks a lot for advice!
    Sorry, how are you getting to this screen where you can create a custom template?
    Somehow I can't find any option to create a custom template in step 3.2 of  the Self-Mon in my system.
    When I press 'Configure and Activate' button it's just activating the Self-Mon, without any option to create a custom template.
    In Alerting Directory Browser I can see SAP Standard Template for Self-Mon,...
    ...but I'm struggeling to find where I can create the custom template a copy of this standard one?
    Probably I'm missing something.
    I'm on SP08.
    You help is much appreciated.
    Best,
    MM

  • Fault Monitor in LMS 4

    Hi all,
    Ciscoworks LMS 4 is very complicated tool for me and it is very hard to configure any cisco device what I need to monitor.
    Currently I have 3750-X configured, properly discovered and added to DCR.
    I would like to receive SMTP messages(mail) from LMS if some event occurs. For example when link UPDOWN occurs or when LOGIN_FAILED occurs and so on. Is it possible to configure this?
    I tried to configure it in Monitor > Monitoring Tools > Fault Monito, but without siccess. LMS tell me that there are no devices available.
    How can I configure some notification so it is able to send me message via smtp?
    Thank you for answer.
    Jan

    Hi Joe,
    check the below link for more results on Unidentified traps:
    http://www.cisco.com/en/US/docs/net_mgmt/ciscoworks_device_fault_manager/3.1
    /user/guide/TrapFwd.html#wpxref57860
    It looks like  "snmp-server enable traps syslog"  is enabled on your devices, and this will appears as Unidentified trap , you can stop this by change the configuration on the Device , or disable the "InformAlarm" from the notification Group under :     Admin > Network > Notification and Action Settings > Fault Notification Group      From the following Link you can check the traps that will generate "INFORM ALARM" event :
    I hope this will help
    Thanks-
    Afroz

  • LMS 4.2.2 Fault Discovery - Network Adapters Limit Exceeded

    Running fault device discovery after adding approx 50 new devices to LMS DCR. It seems I have reached a limit in DFM with regards to how many device components it can manage. The devices are put into questioned mode and the following error is seen in the Question State Device Report
    Network Adapters Limit Exceeded.The number of Network Adapters discovered by Fault Management exceeded the maximum supported limit.Please check on screen help for more information.     
    What is the limit that is being referred to here? Is it independent of the LMS device licence? Where can I see how many "network adapters" LMS is monitoring? I have approx 900 devices being managed by LMS on a 1500 device licence. I am running LMS 4.2.2
    Any light you could shed on this would be appreciated
    Thanks,
    Mark         

    I've come across this a few times. I did not find a solution. It went away with a reinstall.
    What seems to happen is that somehow DFM puts all the device interfaces in a managed state.
    It should not.
    It should only manage the ports and interfaces that connect to another managed device.
    There is a hardcoded limit of 40.000 managed ports in DFM.
    Suspected situations:
    On one server where I found this the system locale that I put to us-english, was somehow put back to be-french. Maybe even during the installation, not sure who or what did this.
    On another server the anti-virus which I  had turned off, was turned back on during installation,probably by a policy server.
    Cheers,
    Michel

  • Alert Monitor Threshold and Information, Warning and Alerts

    Hi,
    I defined a Forecast Alert Profile that is supposed to display the MAPE Alert in the Alert Monitor when the MAPE for the said selection is > x %. This x as I understand is maintained in the Diagnosis group of the Master Forecast Profile.
    I now try to make use of this Threshold Value Description "Variance is > %. and define  >(x-10) % but less than x % as information, x % as warning and >(x +20) as error but I am unable to make out how the alerts are determined and whether these values are indeed read (threshold >)
    Secondly my Alert may have been originally based on particular selection(s)- some in FG, some in BG. Some of these selections may not be assigned to the Alert Profile and the Planner may not remember at what level the forecast was carried out to begin with. So my query is at what level of selection is the Alert generated when there is no selection assigned to the Alert Profile ?
    Thanks
    Amit

    Hi,  I was hoping someone answers. It was not a profound question I believe
    I am also curious to know the same with respect SDP Macro based alerts. When a Macro Alert is triggered at Cell Val > y % and it is called a "warning" per the macro definition, of what good is the information, warning and alert threshold values in the Alert Monitor ?
    Does it mean the value 'Y' that I defined in macro step as 'threshold' for alert or process message can be more 'freely' defined in the alert monitor with three distinct values ? I tried testing but I am unable to conclude.
    Please help me understand
    Thanks
    Amit

Maybe you are looking for