vManage配置邮件告警

[Rps-Cheers]

基本设置

首先在administration中开启邮件的通知和设置
这里以QQ邮箱为例。注意SMTP认证的密码应该是生成授权码，具体可以参考https://www.ujcms.com/documentation/351.html

然后在alarm notification中设置一下告警的Severity，关于Alarm Name的具体内容，可以参考后续的表格。

Alarm Name	Severity	Description
AAA Admin Password Change	Critical	The password for the AAA user admin changed on a router or controller.
BFD Between Sites Down	Critical	All BFD sessions on all routers between two sites are in the Down state. This means that no data traffic can be sent to or transmitted between those two routers.
BFD Between Sites Up	Medium	A BFD session on a router between two sites transitioned to the Up state.
BFD Node Down	Critical	All BFD sessions for a router are in the Down state. This means that no data traffic can be sent to or transmitted from that router.
BFD Node Up	Medium	A BFD session for a router transitioned to the Up state.
BFD Site Down	Critical	All BFD sessions on all Cisco vEdge devices in a site are in the Down state. This means that no data traffic can be sent to or transmitted from that site.
BFD Site Up	Medium	A BFD session on a router in a site transitioned to the Up state.
BFD TLOC Down	Major	All BFD sessions for a TLOC (transport tunnel identified by a color) are in the Down state. This means that no data traffic can be sent to or transmitted from that transport tunnel.
BFD TLOC Up	Medium	A BFD session for a TLOC transitioned to the Up state.
BGP Router Down	Critical	All BGP sessions on a router are in the Down state.
BGP Router Up	Medium	A BGP session on a router transitioned to the Up state.
Clear Installed Certificate	Critical	All certificates on a controller or device, including the public and private keys and the root certificate, have been cleared, and the device has returned to the factory-default state.
Cloned Cisco vEdge Detected	Critical	A duplicate router that has the same chassis and serial numbers and the same system IP address has been detected.
Cloud onRamp	Major	The Cloud onRamp service was started on a router.
Control All Cisco vSmarts Down	Critical	All control connections from all Cisco Catalyst SD-WAN Controllers in the overlay network are in the Down state. This means that the overlay network cannot function.
Control Node Down	Critical	All control connections for a Cisco vEdge device are in the Down state.
Control Node Up	Medium	At least one control connection for a Cisco vEdge device transitioned to the Up State.
Control Site Down	Critical	All control connections from all Cisco Catalyst SD-WAN devices in a site are in the Down state. This means that no control or data traffic can be sent to or transmitted from that site.
Control Site Up	Medium	A control connection from Cisco SD-WAN Manager and the Cisco Catalyst SD-WAN Validator in the site transitioned to the Up state.
Control Cisco vBond State Change	Critical Major	A control connection on a Cisco Catalyst SD-WAN Validator transitioned to the Down state (Critical) or the Up state (Major).
Control TLOC Down	Major	All control connections for a TLOC are in the Down state.
Control TLOC Up	Medium	A control connection for a TLOC is in the Up state.
Control Cisco vManage Down	Critical	All control connections from Cisco SD-WAN Manager are in the Down state.
Control Cisco vManage Up	Medium	A control connection from Cisco SD-WAN Manager transitioned to the Up state.
Control Cisco vSmart Down	Critical	All control connections from a Cisco SD-WAN Controller in the overlay network are in the Down state.
Control Cisco vSmart Up	Medium	A control connection from a Cisco SD-WAN Controller in the overlay network transitioned to the Up state.
Control Cisco vSmarts Up	Medium	Control connection from all Cisco SD-WAN Controllers in the overlay network transition to the Up state.
CPU Load	Critical Medium	The CPU load on a controller or device has reached a critical level that could impair or shut down functionality, or a medium level that could impair functionality.
Default App List Update	Major	The default application and application family lists, which are used in application-aware routing policy, have changed.
Device Activation Failed	Critical	Activation of a software image on a controller or device failed.
Device Upgrade Failed	Critical	The software upgrade on a router failed.
DHCP Server State Change	Major	The state of a DHCP server changed.
Disk Usage	Critical Major	The disk usage load on a controller or device has reached a critical level that could impair or shut down functionality, or a medium level that could impair functionality.
Domain ID Change	Critical	A domain identifier in the overlay network changed.
Interface Admin State Change	Critical Medium	The administrative status of an interface in a controller or router changed from up to down (Critical) or down to up (Medium).
Interface State Change	Medium	The administrative or operational status of an interface changed.
Memory Usage	Critical Medium	The memory usage on a controller or device has reached a critical level that could impair or shut down functionality, or a medium level that could impair functionality.
New CSR Generated	Minor	A controller or router generated a certificate signing request (CSR). Note   In Cisco IOS XE Catalyst SD-WAN Release 17.11.1a and earlier, this alarm's severity value is Critical.
OMP All Cisco vSmarts Down	Critical	All OMP connections from all Cisco SD-WAN Controller in the overlay network are in the Down state. This means that the overlay network cannot function.
OMP Cisco vSmarts Up		At least one OMP connection from all Cisco SD-WAN Controllers in the overlay network is in the Up state.
OMP Node Down		All OMP connections for a Cisco vEdge device are in the Down state.
OMP Node Up	Medium	At least one OMP connection for a Cisco vEdge device is in the Up state.
OMP Site Down	Critical	All OMP connections to Cisco Catalyst SD-WAN Controller from all nodes in the a are in the Down state. This means that site cannot participate in the overlay network.
OMP Site Up	Medium	At least one OMP connection to Cisco Catalyst SD-WAN Controller from all nodes in the site is in the Up state.
OMP State Change	Critical Medium	The administration or operational state of an OMP session between a Cisco Catalyst SD-WAN Controller and a Cisco vEdge device has changed, from Up to Down (Critical) or Down to Up (Medium).
OMP vSmarts Up	Medium	OMP connection from all Cisco Catalyst SD-WAN Controllers in the overlay network transition to the Up state.
Org Name Change	Critical	The organization name used in the certificates for all overlay network devices changed.
OSPF Router Down	Critical	All OSPF connections on a router are in the Down state.
OSPF Router Up	Medium	An OSPF connection on a router transitioned to the Up state.
PIM Interface State Change	Major	The state of a PIM interface changed.
Process Restart	Critical	A process (daemon) on a controller or router restarted.
Pseudo Commit Status	Minor	Cisco SD-WAN Manager has started pushing a device configuration template to a controller or router. Cisco SD-WAN Manager pushes a tentative configuration (called the pseudo commit) to the device and starts the rollback timer. If , with the new configuration, the control connections between the device and Cisco SD-WAN Manager come up, the tentative configuration becomes permanent. If the control connections do not come up, the tentative configuration is removed, and the device's configuration is rolled back to the previous configuration (that is, to the last known working).
Root Cert Chain Installed	Minor	The file containing the root certificate key chain was installed on a controller or router. Note   In Cisco IOS XE Catalyst SD-WAN Release 17.11.1a and earlier, this alarm's severity value is Critical.
Root Cert Chain Uninstalled	Minor	The file containing the root certificate key chain was removed from a controller or router. Note   In Cisco IOS XE Catalyst SD-WAN Release 17.11.1a and earlier, this alarm's severity value is Critical.
Site ID Change	Critical	A site identifier in the overlay network changed.
System IP Change	Critical	The system IP address on a controller or router changed.
System IP Reuse	Critical	The same system IP address is being used by more than one device in the overlay network.
System Reboot Issued	Critical Medium	A device rebooted, either initiated by the device (Critical) or by a user (Medium).
Template Rollback	Critical	The attaching of a device configuration template to a router did not succeed in the configured rollback time, and as a result, the configuration on the device was not updated, but instead was rolled back to the previous configuration.
Unsupported SFP Detected	Critical	The software detected an unsupported transceiver in a hardware router.
Cisco vEdge Serial File Uploaded	Critical	The WAN Edge serial number file was uploaded to the Cisco SD-WAN Manager server.
Cisco vSmart/Cisco vManage Serial File Uploaded	Critical	Cisco SD-WAN Manager uploaded the file containing certificate serial numbers for Cisco SD-WAN Managers and Cisco Catalyst SD-WAN Controllers in the overlay network.
ZTP Upgrade Failed	Critical	A software upgrade using ZTP failed on a controller or router.

进一步可以配置告警通知的邮箱，这里可以最多添加10个邮箱地址。

注意到这里还有WebHooks，这个Webhooks由外部系统使用，以通知本地系统有关特定事件或更新的信息。就类似API调用一样，具体不在本次的范围中展开。

邮箱阈值的设置，可以控制电子邮件通知页面中有一个阈值字段。Monitor> Alarms> Email Notifications。此字段表示我们希望每分钟收到多少封电子邮件。 默认情况下，每分钟最多 5 封电子邮件。 

告警检查

配置完成告警设置之后，可以做一些基本的检查：

• 例如通过vManage的log查看是否有发送邮件。具体log位置/var/log/nms/vmanage-server.log
• 也可以在VManage的Dashboard里面，查看Audit log，路径为Monitor>Audit Log（高一些的版本可能再Monitor>log>Audit log下）
• 通过接收告警的邮箱来查看告警是否正常。

参考文档

https://www.cisco.com/c/en/us/support/docs/routers/sd-wan/214615-vmanage-configure-alarm-email-notificat.html#toc-hId--606714268

https://www.cisco.com/c/en/us/td/docs/routers/sdwan/configuration/Monitor-And-Maintain/monitor-maintain-book/m-alarms-events-logs.html#view-alarms

https://www.ujcms.com/documentation/351.html