04-15-2009 07:10 AM
Start are job to change something on a device Like SNMP Community Strings. I create a Netconfig job to make the change, the change happens and I start to receive a bunch of alerts from device. I will enter a few here for reference.
EVENT ID = 0001H7C
ALERT ID = 000025B
TIME = Wed 15-Apr-2009 10:37:27 EDT
STATUS = Active
SEVERITY = Critical
MANAGED OBJECT = 10.1.32.1
MANAGED OBJECT TYPE = Routers
EVENT DESCRIPTION = OperationallyDown::Component=CARD-10.1.32.1/1 [0] [c2851 Motherboard with 2GE and integrated VPN];ComponentClass=Card;ComponentEventCode=1073;SystemName=10.1.32.1;Status=NOTPRESENT;Description=c2851 Motherboard with 2GE and integrated VPN;StandbyStat
EVENT ID = 0001H7E
ALERT ID = 000025B
TIME = Wed 15-Apr-2009 10:37:27 EDT
STATUS = Active
SEVERITY = Critical
MANAGED OBJECT = 10.1.32.1
MANAGED OBJECT TYPE = Routers
EVENT DESCRIPTION = OperationallyDown::Component=CARD-10.1.32.1/3 [0/1] [2nd generation two port FXO voice interface daughtercard];ComponentClass=Card;ComponentEventCode=1073;SystemName=10.1.32.1;Status=NOTPRESENT;Description=2nd generation two port FXO voice interface
This looks like the hardware on the router is there. But the device is working correctly. PLease provide assistance.
04-15-2009 09:21 AM
It looks like for at least one polling cycle, the device reported that these cards were no longer present in the device. Are these events still active now?
04-15-2009 12:55 PM
Ciscoworks geneates the alerts and they are sent to email and when I go look at the alert on the portal under Network I see the alert for the device and when I open the alert all of the operationally down or other alerts are there I acknowledge or clear them and it goes away.
But if you see 20 or 30 alerts for the same device because it looks like every card or interface show not available for a time? Is that a correct assumption?
04-15-2009 12:58 PM
It appears that for whatever reason, the device responded with an SNMP value that made DFM think the module was no longer present. We have seen these things from time to time, but they are generally transient, and the events clear on their own. If the events are still active, then could be an SNMP issue on the device.
If you've manually cleared these events, do they come back?
04-15-2009 01:20 PM
They go away but we are making some mast changes on devices in the network and we were getting 20 or so alerts for each device. This first started to happen when we updated the snmp community strings on all devices. So we where seeing hundreds of alerts.
04-15-2009 03:10 PM
If you can reproduce, it would be useful to see a sniffer trace of SNMP traffic between the server and device when DFM throws these events.
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide