Interface Status in the DFM Alerts & Activities

[keshavahp]

Hi,

I have configured LMS 2.5 to monitor the WAN Network. I have just added the devices into DCR and trying to monitor the Interface Status (Serial Links) which goes DOWN and UP. I have configured the below SNMP Parameters in the Cisco 3825 Router -

snmp-server group BELCommunity v3 auth write BELView notify

snmp-server user BELTest1 BELCommunity remote 128.200.199.160 v3 auth md5 cisco@BEL

snmp-server view BELView mib-2 included

snmp-server view BELView products.543 included

snmp-server community private RW

snmp-server community public RO

snmp-server enable informs

snmp-server host 128.200.199.160 inform version 3 auth BELTest1

Problem Facing: When launched the DFM Alerts & Activities, i see only the Link Status *Operationally Down* and the Alert page never displays the activity of the Serial Which has come UP Active.

Can any one please help me to solve this problem.

Regards,

Keshav

HP India

[Joe Clarke]

What SNMP credentials are configured in DCR for this device?

[keshavahp]

Good morning Mr. Clarke,

When adding the devices in DCR, i have configured the Primary Credentials (i.e., login Username & Password of the Router in the Primary Credentials). And, SNMP v3 Username & Password with Auth Alogorithm as MD5 (username & password of SNMP v3 as configued in the Router, config attached in the previous message).

[Joe Clarke]

Please post a screenshot of the event properties as well as an snmpwalk of the ifTable on this device.

[keshavahp]

Hello Mr. Calrke,

Please find the attached SNMP Walk output & the Screenshot of the DFM Alerts & Activities page attached. However, i feel - using DFM Alerts & Activities is not handy. Is there any way we can customize and make the DFM to log only the Interfaces Status which goes DOWN & UP.

[Joe Clarke]

This event, and this SNMP walk are not for the same device, so there's nothing I can tell you based on this.

You can disable these ExceededMaximumUptime events by going to DFM > Configuration > Polling and Thresholds > Managing Thresholds > DFM > System Defined Groups > Interface Groups > Dial-On-Demand, edit the settings, and check the box to disable all threshold settings for the group.

[keshavahp]

Apologies Mr. Clarke, i had attached the wrong Events Display. Please find the Events page of 128.200.199.150 attached (128.200.199.148 is the Standby IP).

SNMP Walk of 128.200.199.150 is attached in the previous message.

[Joe Clarke]

The event is correct in this case. The ifOperStatus is down. If you do not care about receiving events for this interface you can unmanage it under DFM > Device Management > Device Details.

[keshavahp]

Hello Mr. Clarke,

Please find the attached screenshot of Fault History Report launched through the Device Center. All of the *ExceededMaximumUptime* fault Description shows both the interface status DOWN & UP. It is the same case with the fault description *OperationallyDown*. How do we customize this?

It is not possible to easily identify the Interface Status by just looking at the Faulty History page, i will have to drill down with every Event ID to find out what has gone wrong with the interface.

Can we customize the Fault History Screen to display only the Router's Link Status which goes DOWN & UP?

Please, Request your Help!

[keshavahp]

Sorry, missed to attach the screenshot! Please find the attached screen shot.

WITH Ref TO MY PREVIOUS MESSAGE (Mar 18, 10:48 PST).

[Joe Clarke]

You cannot customize what you see in Fault History. Yes, you will have to drill in to get the event details. However, the interface status for an ExceededMaximumUptime event which is active should be UP/UP. When the event is cleared, the operational status of the interface should have gone down. For the OperationallyDown events (like 0000159), the operational status of the interface will be down for active events and up for cleared events.

[keshavahp]

OK...Many thanks Mr. Clarke.

I have two more final Questions / Problem.

Request your help!

1.) Fault History alerts & events are stored only for 31 days. Can we increase this period to more than 31 days? or should i have to forward the traps to an external Syslog server using the DFM configuaration settings; to store all the events & alerts activities more than 31 days?

2.) Can we save all the Syslog messages seen in the Devicee Center; either locally on the Cisco Works Server or an external Syslog Server. Please can you let me know the procedure for this. Syslog logs of Device Center is very important, and i'll have to keep it backed up regularly. What is the default Syslog reports purging duration from Device Center?

[Joe Clarke · Accepted solution]

1. No, this cannot be increased. You would need to forward the events as notifications (either trap, syslog, or email) to store them for longer than a month.

2. RME has the capability to backup syslog messages from its database to a flat file. This is configured under RME > Admin > Syslog > Set Backup Policy.

[keshavahp]

Many thanks Mr. Clarke,

Your above solution works!

But i have one more problem with respect to Syslog Custom Report Generation. I'm trying to filter only Link Status messages from Syslog reports. *RME>Reports>Custom Report Template*. I have defined the message type as follows -

Facility: LINEPROTO

Sub-Facility: LINEPROTO

Severity: 5

Mnemonic: UPDOWN

Description: All Interface DOWN/UP.

But when generating the reports {RME>Reports>ReportGenerator} i see nothing after the Finish Page of the selected Custome Report. Report Generator fecthes no Syslog Messages.

Request your help! for creating the above Custom Report - with only Sev 5 LINK UP/DOWN.