Table Of Contents

Event and Alarm Configuration Parameters

Alarm Type Definition

Event (Subtype) Configuration Parameters

General Event Parameters

Root Cause Configuration Parameters

Correlation Configuration Parameters

Network Correlation Parameters

Flapping Event Definitions Parameters

Event and Alarm Configuration Parameters

---

These topics describe the different options that exist to modify the alarm behavior by editing the appropriate alarm parameters in the system registry:

•Alarm Type Definition—Describes the alarm type concept.

•Event (Subtype) Configuration Parameters—Describes the event and alarm configuration parameters and values that can be controlled through the registry.

The parameters described in the following section are defined per event (subtype) belonging to the alarm.

---

Note Changes to the registry should be performed only with the support of Cisco. For details, contact your Cisco Account Team.

---

Alarm Type Definition

In alarm type definitions, the event subtype is a specific occurrence of a fault in the network. For example, Link Down and Link Up are two subtypes that share the same type. The event type is used to group together event subtypes that appear in the same event sequence. For example, Link Down and Link Up subtypes both fall under the Link Down event type.

Event (Subtype) Configuration Parameters

General Event Parameters

Parameter Name	Description	Permitted Values
severity	Severity level of the event.	Any of the following: •CRITICAL •MAJOR •MINOR •WARNING •CLEARED •INFO
is-ticketable	Determines whether the alarm will generate a new ticket, if there is no root-cause alarm to correlate to.	•True (ticketable) •False (not ticketable)
auto-remove	If the ticket is cleared it will be archived.	•True (auto-removed) •False (remains in Cisco ANA NetworkVision until it is manually removed by the user)
auto-remove- timeout	The period of time, in milliseconds, of how long a cleared ticket waits before being archived. The default is 88 minutes.	Positive integer

Root Cause Configuration Parameters

These parameters define the behavior of the alarm when serving as the root cause of other alarms.

Parameter Name	Description	Permitted Values
is-correlation-allowed	If true, this event can be the possible cause for other events, and also allows other alarms to correlate to it.	•True (correlates) •False (does not correlate)
short-description	Textual description of the event.	User-defined text
gw-correlation-timeout	This parameter affects sequencing to clearing events. The period of time, in milliseconds, of how long an alarm with the severity Clear or Info is open for sequencing. Alarms with noncleared severity are always open for a consequent alarm, and this parameter is irrelevant for nonclearing events.	Positive integer

For more information about root causes, see Event Correlation and Alarms, page 5-5.

Correlation Configuration Parameters

These parameters define the behavior of the alarm in finding its root-cause alarm:

Parameter Name	Description	Permitted Values
correlate	Determines whether the alarm should attempt to find and correlate to a root-cause alarm. When this parameter is set to true, either local correlation or flow-based correlation is performed.	•True (correlates) •False (does not correlate)

Network Correlation Parameters

These parameters control the alarm's behavior in initiating an active correlation-search flow:

Parameter Name	Description	Permitted Values
activate-flow	Determines if the new event will initiate a network correlation process or only local correlation.	•True (network correlation) •False (local correlation)
weight	Defines the relative weight of an event as a cause candidate in relation to other causing events. A new event can only correlate to an event which has a higher weight. The heavier the event, the more likely it will be chosen as the cause.	Positive integer

---

Note All delays should be smaller than the expiration time to allow correlation to take place. Flow activation delay is counted only when the correlation delay has expired.

---

Flapping Event Definitions Parameters

If a flapping event application is enabled on an event, then the following parameters control the alarm's behavior regarding its flapping state:

Parameter Name	Description	Permitted Values
flapping-interval	The maximum time interval between consecutive event notifications that are part of a flapping sequence (default is one minute).	Positive integer (in milliseconds
flapping-threshold	The number of consecutive events that must be received at intervals shorter than the flapping interval, to be considered a flapping sequence (default is five).	Positive integer
update-interval	If no Flapping Update event notification was sent during this time, one will be generated (default is about three minutes).	Positive integer (in milliseconds)
clear-interval	The time that the alarm is not updated with new events, in order to exit the flapping mode (four minutes).	Positive integer (in milliseconds)
update-threshold	The number of events in an incoming flapping sequence that triggers the generation of a Flapping Update event notification (default is 20).	Positive integer