Table Of Contents
Working in EventVision
Viewing Event Properties
Ticket Tab Properties
Tabbed Pane
General Tab
History Tab
Affected Parties Tab
Correlation Tab
Notes Tab
Advanced Tab
Toolbar
Audit Tab Properties
Security Tab Properties
Provisioning Tab Properties
V1 and V2 Trap Tabs Properties
Trap Tab
Refreshing the Events List
Filtering Events
Exporting Displayed Data
Logging Out
Working in EventVision
This chapter describes how to view, filter and display the properties of specific events, and how to refresh and export events:
•
Viewing Event Properties—Describes how to view the properties of a specific event type.
•Refreshing the Events List—Describes how to manually and automatically refresh the Events List.
•Filtering Events—Describes how to define a filter for the events displayed in the Events List.
•Exporting Displayed Data—Describes how to export the currently displayed data from the EventVision table. In addition, it describes how to import the data and view it at a later stage.
•Logging Out—Describes how to log out of EventVision.
Viewing Event Properties
EventVision enables you to view the properties of a specific event type. The Event Properties dialog box displays detailed information about the event, for example, the severity and the number of affected parties.
For a detailed description of the properties refer to:
•Ticket Tab Properties
•Audit Tab Properties
•Security Tab Properties
•Provisioning Tab Properties
•V1 and V2 Trap Tabs Properties
To view Event Properties:
Step 1 Select the required tab for the specific event type and the event in the EventVision window.
Step 2 Double-click on the event in the Events List or on the View menu, click Properties, or right-click the event, and select Properties from the shortcut menu.
The Properties tabbed window is displayed for the selected event.
Note Clicking Details Pane on the toolbar displays the properties of the selected ticket or event in the Properties Details pane.
The header displays the ID number of the selected event.
Ticket Tab Properties
The properties of a selected ticket can be viewed by displaying the Ticket Properties dialog box. For example, you can view alarm severity, correlated alarms, active alarms, alarm history or the source of the alarm. See Ticket Tab.
For information about opening the Properties dialog box, see Viewing Event Properties.
The information displayed in the Ticket Properties dialog box corresponds with the information displayed in the Ticket pane of the NetworkVision window. The ID number displayed in the header corresponds to the ID number of the ticket selected in the EventVision window.
The Ticket Properties dialog box is divided into the following areas:
•Tabbed Pane
•Toolbar
Tabbed Pane
The Ticket Properties dialog box is divided into the following tabs:
•General—General information about the selected ticket. See General Tab.
•History—The history of the ticket. See History Tab.
•Affected Parties—The services (affected pairs) that are potentially affected (potential impact analysis) by the ticket. See Affected Parties Tab.
•Correlation—All the alarms that are correlated to the selected ticket. See Correlation Tab.
•Notes—Enables you to add notes to the selected ticket. See Notes Tab.
•Advanced—All the affected devices, correlation, duplication and reduction counts for the selected ticket. In addition, it provides any other additional information available about the ticket. See Advanced Tab.
General Tab
The following fields are displayed in the General tab providing information about the compiled alarm:
•Alarm—The supported root-cause alarm name, for example, Link Down.
•Location—The entity that triggered the root-cause alarm, as a hyperlink that opens the relevant location.
•Severity—Displays the severity that was propagated from all the correlated alarms. See Color Coding of Events List Severity Icons.
•Time—The date and time when the initial root-cause alarm was generated. The time is taken from Cisco ANA and is displayed in the following format MM/DD/YY - HH:MM:SS.
•Open Alarms—The number of correlated alarms for the ticket that are open. For example, 3 / 4. Four relates to the total number of correlated alarms for the ticket. Three indicates the number of alarms that have not been cleared, and therefore there is one alarm that is closed.
•Acknowledged—The status of the ticket that is being handled, namely, acknowledged (true) and unacknowledged (false).
•Description—The description from the message field.
History Tab
The History tab enables you to display the history of the ticket, including all the events.
The following columns are displayed in the History tab providing information about the compiled alarm:
•Severity—Displays a severity bell icon, which is colored according to the severity of the alarm on the event.
•Alarm ID—The ID number of the alarm that changed the ticket.
•Duplication Count—Displays the number of occurrences of the original root-cause alarm included in the ticket. For example, if the ticket was created by a link down root-cause alarm, and then the link goes up and down again quickly so that it is included in the same ticket, then the duplication counter displays the number 2, as the root-cause alarm occurred twice.
•Short Description—A description of the change in the ticket.
•Reduction Count—Displays the number of alarms included in the ticket. For example, nine alarms can be viewed in the History tab of the Ticket Properties window, but only a single ticket is displayed in the Ticket pane.
•Location—The entity that triggered the alarm, as a hyperlink that opens the relevant location.
•Time—The date and time when the ticket changed.
Affected Parties Tab
When a fault occurs, Cisco ANA automatically calculates the affected parties (automatic impact analysis). For example, when a link goes down, and embeds this information in the ticket along with all the correlated faults. You can view a list of all the endpoints that are affected and that have lost connectivity. For more information about proactive impact analysis, refer to the Cisco Active Network Abstraction NetworkVision User Guide.
The Affected Parties tab displays the services (affected pairs) that are affected (automatic impact analysis) by the ticket. For more information about accumulating affected parties, refer to the Cisco Active Network Abstraction NetworkVision User Guide.
The Affected Parties tab is divided into two areas, Source and Destination. The Source area displays the set of affected elements (A side and Z side). The following columns are displayed in the Affected Parties tab providing information about the affected parties:
•Location—A hyperlink that opens the Inventory window, highlighting the port with the affected parties.
•Key—The unique value taken from the affected element's business tag key (if it exists).
•Name—The subinterface (site) name or business tag name of the affected element (if it exists). For more information, refer to the Cisco Active Network Abstraction Managing MPLS User Guide.
•Type—The business tag type.
•IP Address—If the affected element is an IP interface the IP address of the subinterface (site) is displayed. For more information, refer to the Cisco Active Network Abstraction Managing MPLS User Guide.
•Highest Affected Severity—The same source can be part of multiple pairs, and therefore each pair can have different affected severities. The highest affected severity is the highest severity of these affected pairs. The affected pair can have one of the following severities:
–Potential—The service may be affected but its real state is not known.
–Real—The service is affected.
–Recovered—The service was recovered after the network fault. This state only applies to affected pairs that were previously marked as Potentially Affected or Real Affected.
–N/A—From Links view this indicates not relevant.
When an affected side (a row) is selected in the Source area the selected element's related affected pairs are displayed in the Destination area.
The following additional columns are displayed in the Destination area table in the Ticket Properties window:
•Affected Severity—The severity of the affected pair as calculated by the client according to the rules defined in the Cisco Active Network Abstraction NetworkVision User Guide.
•Alarm Clear State—An indication for each pair of the clear state of the alarm. The following states exist:
–Not Cleared—There are one or more alarms that have not been cleared for this pair.
–Cleared—All the related alarms for this pair have been cleared.
In addition, you can view a detailed report for every affected pair that includes a list of the events that contributed to this affected pair. For more information about viewing a detailed report, refer to the Cisco Active Network Abstraction NetworkVision User Guide.
Correlation Tab
The Correlation tab displays all the alarms that are correlated to the selected ticket.
Each branch provides a short description of the alarm, a severity icon, ID, location and time of the alarm.
The following columns are displayed in the Correlation tab providing information about the alarm as follows:
•ID—The ID number of the event that changed the ticket. The branches can be expanded and collapsed in order to hide information as needed.
•Short Description—A description of the change in the ticket. The full description is displayed in the lower tab area.
•Location—A hyperlink that opens the Alarm Properties window, highlighting the port with the affected parties.
•Time—The date and time the ticket was issued.
•Last Modification Time—The date and time when the ticket changed.
•Reduction Count—Displays the number of alarms included in the ticket. For example, nine alarms can be viewed in the History tab of the Ticket Properties window, but only a single ticket is displayed in the Ticket pane.
•Duplication Count—Displays the number of occurrences of the original root-cause alarm included in the ticket. For example, if the ticket was created by a link down root-cause alarm, and then the link goes up and down again quickly so that it is included in the same ticket, then the duplication counter displays the number 2, as the root-cause alarm occurred twice.
The Find field on the toolbar enables you to search for information in the Ticket Properties table.
Notes Tab
The Notes tab enables you to add and save notes for the selected ticket.
To add text, enter text in the Notes field and click Save Notes. The new text is added to any previously existing text.
Note Save Notes is enabled only when text is entered in the Notes field.
Note The text cannot be edited or removed after you have saved the notes.
Advanced Tab
The Advanced tab enables you to view all the affected devices, correlation, duplication and reduction counts for the selected ticket. In addition, it provides any other additional information available about the ticket.
The following fields are displayed in the Advanced tab providing information about the compiled alarm:
•Successor—A hyperlink to the successor event, for example, port up.
•Correlator—A hyperlink to the correlator alarm.
•Predecessor—A hyperlink to the predecessor event, for example, port down.
•Affected Devices—The number of devices affected by the ticket (the sources of the alarm and their subsequent alarms).
•Duplication Count—Displays the number of occurrences of the original root-cause alarm included in the ticket. For example, if the ticket was created by a link down root-cause alarm, and then the link goes up and down again quickly so that it is included in the same ticket, then the duplication counter displays the number 2, as the root-cause alarm occurred twice.
•Correlation Count—Displays the number of correlated alarms included in the ticket. For example, if in the Correlation tab of the Ticket Properties, there are three alarms correlated to the root-cause alarm, then the counter displays the number 3. If there are two alarms correlated to the root-cause alarm, and each alarm in turn has two alarms correlated to it, then the counter displays the number 4.
•Reduction Count—Displays the number of alarms included in the ticket. For example, nine alarms can be viewed in the History tab of the Ticket Properties window, but only a single ticket is displayed in the Ticket pane.
Toolbar
The Ticket Properties dialog box contains the following tools:
Table 4-1 Tools in Ticket Properties Dialog Box
|
Refreshes the information displayed in the Ticket Properties dialog box.
|
|
Acknowledges that the ticket is being handled and the status of the ticket is displayed as true in the Ticket pane and in the Ticket Properties dialog box. For more information, refer to the Cisco Active Network Abstraction NetworkVision User Guide.
Note This button is enabled only if the ticket has not yet been acknowledged.
|
|
Requests the relevant Cisco ANA to remove the faulty network element from the Cisco ANA networking inventory. In addition, it sets the ticket to Cleared severity/status (the icon is displayed in green) and automatically changes the acknowledged status of the ticket to true. For more information, refer to the Cisco Active Network Abstraction NetworkVision User Guide.
Note This button is enabled only if the severity of the alarm is higher than Cleared/Normal.
|
|
Saves the notes for the selected ticket.
Note This button is enabled only when text is entered in the Notes field of the Notes tab.
|
Audit Tab Properties
The properties of a selected auditing event can be viewed in detail by displaying the Audit Event Properties dialog box. For information about opening the Properties dialog box, see Viewing Event Properties.
The Audit Event Properties dialog box is divided into the following tabs:
•General—General information about the selected event. For a detailed description of the information displayed in the Audit tab, see Audit Tab.
•Advanced—This tab is not relevant for auditing events.
•Audit—Detailed information specific to auditing events. For a detailed description of the information displayed in the Audit tab, see Audit Tab.
Security Tab Properties
The properties of a selected security event can be viewed in detail by displaying the Security Event Properties dialog box. For information about opening the Properties dialog box, see Viewing Event Properties.
The Security Event Properties dialog box is divided into the following tabs:
•General—General information about the selected event. For a detailed description of the information displayed in the Security tab, see Security Tab.
•Affected Parties—This tab is not relevant for security events.
•Advanced—This tab is not relevant for security events.
•Security—Detailed information specific to security events. For a detailed description of the information displayed in the Security tab, see Security Tab.
Provisioning Tab Properties
The properties of a selected provisioning event can be viewed by displaying the Provisioning Event Properties dialog box. For example, you can view a detailed description of the provisioning event.
For information about opening the Properties dialog box, see Viewing Event Properties.
For a detailed description of the information displayed in the Provisioning tab, see Provisioning Tab.
The Description area of the Provisioning Event Properties dialog box details all the content of the workflow output or the command. If it is a workflow the description includes the execution sequence of the workflow and log messages. The execution sequence includes the output of all the scripts executed by the workflow and also indicates if workflow rollback has occurred. If it is a command, the description includes the output of the script.
V1 and V2 Trap Tabs Properties
The properties of a selected V1 Trap and/or V2 Trap alarm can be viewed by displaying the V1/V2 Trap Alarm Properties dialog box. For example, you can view the translated Oid and value.
For information about opening the Properties dialog box, see Viewing Event Properties.
The V1/V2 Trap Alarm Properties dialog box is divided into the following tabs:
•General—General information about the selected event. For more information about the information displayed in the V1 Trap tab, see V1 Trap Tab. For more information about the information displayed in the V2 Trap tab, see V2 Trap Tab.
•Affected Parties—The services (affected pairs) that are potentially affected (potential impact analysis) by the ticket. See Affected Parties Tab.
•Advanced—All the affected devices, correlation, duplication and reduction counts for the selected ticket. In addition, it provides any other additional information available about the ticket. For more information, see Advanced Tab.
•Trap—General description of V1 and V2 trap information. See Trap Tab.
Trap Tab
The Trap tab enables you to view V1 and V2 trap information.
The following fields are displayed in the Trap tab:
•Version—The SNMP version, namely, version-1 or version-2c.
•Community String—The community that the device sends to in the PDU.
•Error Status—The error status, namely, No Error, Too Big, No Such Name, Bad Value, Read Only, and Gen Err.
The following columns are displayed in the Values table:
•Translated Oid—A string representation of the Oid. For example, 1.3.6 is translated into iso(1).org(3).dod(6).
•Translated Value—A string representation of the Oid value. For example, 1.3 is translated to iso(1).org.10.
•Oid—The Oid that is not translated, that is, it is a dot notation representation of the oid, for example, 1.3.6.1.4.1.9.
•Value—The value that is not translated, that is, it is not represented by string values.
Refreshing the Events List
EventVision displays current event information in the log. While viewing the log, this information is not updated unless you:
•Refresh the list manually.
•Use the Auto Refresh option.
Note Be sure that when you use the Auto Refresh option, you configure EventVision to automatically run the refresh option. You define the refresh time period (in seconds) in the EventVision Options dialog box. See Setting EventVision Viewing Options.
Step 1 To manually refresh the Events List, on the toolbar, click Refresh.
or
From the View menu, select Refresh. The Events List is refreshed.
Note Click Refresh to redisplay the first page of information, namely, the most recent events.
Step 2 To automatically refresh the Events List, on the toolbar, click Refresh Table. The Events List is automatically refreshed, and older information is moved down the list.
Note When you click Refresh Table the Events List continues to be repeatedly refreshed after the defined refresh time period. The previous setting is maintained, for example, if the order in the Events List is ascending and the Events List is refreshed the order will remain ascending. To cancel automatic refresh, click Refresh Table.
Filtering Events
The Filter dialog box allows you to filter events according to:
•Severity
•ID
•Date and Time
•Text in the description field
The Filter button toggles to indicate that a filter has been applied.
You may also use the filter to search for information in the database.
Note Filter fields are enabled or disabled according to the event type. For example, if a filter is applied to a ticket, all the fields are enabled.
To define a filter:
Step 1 From Edit menu, select Filter,
or
On the toolbar, click Filter. The Filter Events dialog box is displayed.
Step 2 Select and type in the required filter values.
Step 3 Click OK to save your filter settings and apply the filter. The filtered events are displayed in the Events List according to the defined criteria.
Note Selecting Keep last filter in the EventVision Options dialog box (see Setting EventVision Viewing Options) saves the currently defined filter settings in the registry. The next time you log into the application, these filter settings are displayed in the Filter Events dialog box. In addition, the events are filtered repeatedly for the current session according to the defined settings.
Note Selecting Open using filter in the EventVision Options dialog box (see Setting EventVision Viewing Options), the events are continuously filtered according to the defined settings even after logging out of and into the application.
To remove the filter:
Step 1 On the toolbar, click Filter. The Filter Events dialog box is displayed.
Step 2 Click Clear. The selected options in the Filter Events dialog box are cleared.
Step 3 Click OK. All the events are displayed in the Events List.
Exporting Displayed Data
EventVision enables you to export the currently displayed data from the EventVision table according to the criteria (total quantity of events) defined in the EventVision Options dialog box. The data can then be imported and viewed at a later stage.
To export the table to a file:
Step 1 Select Export from the File menu. The Export Table to File dialog box is displayed.
Step 2 Browse to the directory where you want to save the list.
Step 3 In the File name field, type a name for the list.
Step 4 Click Save. The displayed Events List or row(s) are saved in the selected directory.
Logging Out
When you have finished working with EventVision you can log out of the application.
To log out of EventVision, click to close the EventVision window. The EventVision window is closed.
Feedback
