Table Of Contents
Event and Alarm Configuration Parameters
Alarm Type Definition
Event (Sub-Type) Configuration Parameters
General Event Parameters
Root Cause Configuration Parameters
Correlation Configuration Parameters
Network Correlation Parameters
Flapping Event Definitions Parameters
System Correlation Configuration Parameters
Event and Alarm Configuration Parameters
This chapter describes the different options that exist to modify the alarm behavior by editing the appropriate alarm parameters in the system registry.
•
Alarm Type Definition—Describes the alarm type concept.
•Event (Sub-Type) Configuration Parameters—Describes the event and alarm configuration parameters and values that can be controlled through the registry.
The parameters described in the following section are defined per event (subtype) that belongs to the alarm.
Note Changes to the registry should only be carried out with the support of Cisco Professional Services.
Alarm Type Definition
The alarm type serves as an identifier which enables group events from different subtypes to share the same type and source in a single event sequence.
The event subtype is a specific occurrence of fault in the network. For example, link down and link up are two subtypes that share the same type.
Event (Sub-Type) Configuration Parameters
General Event Parameters
Parameter Name
|
Description
|
Permitted Values
|
severity
|
Severity level of the event.
|
Either:
•CRITICAL
•MAJOR
•MINOR
•WARNING
•CLEARED
•UNKNOWN
•INFO
|
is-ticketable
|
Determines whether the alarm will generate a new ticket, if there is no root-cause alarm to correlate to.
|
True (ticketable)
False (not ticketable)
|
functionality-type
|
Determines the event type.
|
Either:
•SERVICE (Cisco ANA-generated)
•SYSLOG
•TRAP
|
Root Cause Configuration Parameters
These parameters define the behavior of the alarm when serving as the root cause of other alarms.
Name
|
Description
|
Permitted Values
|
is-correlation-allowed
|
Defines whether the alarm may serve as a root cause, and allow child alarms to correlate to it.
|
True (correlates) or False (will not correlate)
|
short description
|
Textual description that describes the event.
|
User defined text
|
gw-correlation-timeout
|
The period of time in milliseconds for how long an alarm with the severity Clear or Info is open for sequence. Alarms with non-cleared severity are always open for a consequent alarm. This parameter is deprecated for non-clearing events (its value is defined as a very large number, so that it does not interfere with correlation decisions from a VNE). This parameter only affects chaining to clearing events.
|
Positive integer
|
select-root-cause-method
|
Used to determine the most fitting alarm from the set of possible root causes sets. This set may be a result of a correlation flow or may represent all alarms in the local Event Correlator component having a correlation key that matches one of the EventData object correlation keys.
|
Select the class name to be used from the set of classes
|
correlation-filters
|
Used to define a set of filters that will remove, from the potential set of alarms, unnecessary root causes. For example, remove from the list all the root causes that have a weight lower than the event that wants to correlate.
|
Select the class name to be used from the set of classes
|
post-correlation-
applications
|
Used to define a set of applications that will be invoked after the event was correlated. For example, running affected is such an application.
|
Select the class name to be used from the set of classes
|
For more information about root cause see Correlation By Root Cause.
Correlation Configuration Parameters
These parameters define the behavior of the alarm in finding its root-cause alarm:
Name
|
Description
|
Permitted values
|
correlate
|
Determines whether the alarm should attempt to find and correlate to a root-cause alarm. If this parameter is set to true at least box level correlation will be performed.
|
Trueor false
|
Network Correlation Parameters
These parameters control the alarm's behavior in initiating an active correlation-search flow:
Name
|
Description
|
Permitted values
|
activate-flow
|
Determines whether to initiate network level correlation.
|
True or false
|
weight
|
Defines the weight of an alarm as a correlation candidate. The heavier the alarm, the more likely it will be chosen as the root cause.
|
Positive integer
|
Note All delays should be smaller than the expiration time to allow correlation to take place. Flow activation delay is being counted only when the correlation delay has expired.
Flapping Event Definitions Parameters
If a flapping event application is enabled on an event, then the following parameters control the alarm's behavior regarding its flapping state:
Name
|
Description
|
Permitted values
|
Flapping interval
|
The maximum amount of time in milliseconds between two alarms which can be considered as a flapping change.
|
Positive integer
|
Flapping threshold
|
After this amount of changes (each change arriving at an interval lower then the flapping interval), the event will be considered as flapping.
|
Positive integer
|
Update interval
|
After this interval in milliseconds an update will be sent.
|
Positive integer
|
Clear interval
|
The amount of time in milliseconds an event has to stay in one state to be considered as a normal alarm and not in a flapping state.
|
Positive integer
|
Update threshold
|
After this number of flapping alarms, an update will be sent to the gateway updating the alarm with the number of events received.
|
Positive integer
|
System Correlation Configuration Parameters
These parameters correctly correlate all the events that occur within the specified timeframe.
Name
|
Description
|
Permitted values
|
correlation-delay
|
Period of time in milliseconds to wait before attempting to find and correlate to a root-cause parameter (it is system-wide, not configured per event).
|
Positive integer
|
time-stamp-delay
|
Used for normalization of the event occurrence time. The value in milliseconds is subtracted from the event time, to compensate for the time difference with the root-cause alarm. It is also used for running the network correlation against the historic network configuration.
|
Positive integer
|
Feedback
