LMS - Device Alert Identifier 00000RV

[tech_trac]

Hello,

After adding ASA5540 into LMS 3.2, I can see the following error in Device Center

Device Alert Identifier 00000RV (with Red Excalamation mark)

What is the reason ? ssh and snmp are going thru.

Regards.

[Joe Clarke]

The alert identifiers don't mean much themselves. If you go to DFM > Alerts and Activities > Alerts and Activities, you will see this same alert ID. Click on it, and the underlying events will explain why the alert was created.

Alternatively, you can click on the Fault History link in Device Center, and you should see the same details about the alert/events. It's the events, though, that will always give you the most information.

[tech_trac]

Ok. I checked the fault history. And it shows 'Unresponsiveness' against various SVI's of the FWSM.

In all cases, the InterfaceAdminStatus is UNKNOWN, IPStatus is TIMEDOUT and InterfaceOperStatus is UNKNOWN.

The device is fully functional through and working in Production.

Are these alerts serious.

Rgds.

[Joe Clarke]

Maybe not. Can the DFM server ping the IP addresses bound to these interfaces? If not, then you should probably unmanage those interfaces or IP addresses in the Detailed Device View under DFM > Device Management > Device Details.

[tech_trac]

In the given path, I see three devices as 'Questioned Devices in Inventory Services' due the SNMP Timeouts.

But these are not necessarily the devices with 'Unresponsiveness' alerts. Those that are showing as Unresponsive are not listed on the device list under DFM at all.

One more...after adding the ASA's under Common Services, I can see the firewall icon along with 2 small white waves. Is this normal or does it indicate a problem. FWSM shows without these two waves.

Regards.

[Joe Clarke]

This is expected. Only devices which are in the Known state are properly managed by DFM, and will have events and alerts generated. Devices in a Questioned state were not properly managed. In this case, it sounds like the SNMP credentials in DCR are incorrect for these devices, or they are not allowing LMS to poll them.

Can you post a screenshot showing the icon? It sounds normal. Each device has its own icon, so the ASA will look different than the FWSM.

[Joe Clarke · Accepted solution]

FYI, I took a screenshot of my ASA to show you what the icon should look like. This device is an ASA5505.

[tech_trac]

Hi,

What should be the hostname entered while adding ASA's in Active/Standby mode. In such case, hostnames on both devices are the same. CiscoWorks accepts it but then shows the actual IP (which is different under hostname column in device details).

[Joe Clarke]

Do you mean DFM Device Details? If so, DFM has a very different way of handling device names. It does not respect the DCR display name. Instead, it attempts to resolve the IP of the device. If there is a problem, then you will just see the IP address in DFM. In that case, it is usually easiest just to add an entry for the device to the server's local hosts file.

In this case, add an entry for each ASA's IP with their respective display names to the server's hosts file. Then delete the devices from DFM, and re-add them. they should then show up my hostname.

[tech_trac]

Please excuse me..

I meant DCR where the ASA's in active/standby mode were showing with IPs and not hostnames.

[Joe Clarke]

That could just be how they were entered into DCR, then. You can always go into DCR, and adjust the display name of the devices to be what you want. Display names can contain letters, numbers, spaces, dashes, underscores, and colons.

To change the display name of a device go to Common Services > Device and Credentials > Device Management, and click Edit Identity. Perhaps it would be a good idea to name the designated primary ASA HOSTNAME-primary, and the secondary HOSTNAME-secondary. While the names won't dynamically change if there is a failover, you will at least be able to distinguish them in the device selectors.