Cisco Active Network Abstraction NetworkVision User Guide, 3.6
Working with Tickets

Table Of Contents

Working with Tickets

About Alarms

Alarm Life-Cycle

Accumulating Affected Parties

Accumulating the Affected Parties in an Alarm

Accumulating the Affected Parties in the Correlation Tree

Updating Affected Severity Over Time

Filtering Tickets by Device

Filtering Tickets by Criteria

Opening Ticket Properties

Tabbed Pane

General Tab

History Tab

Affected Parties Tab

Correlation Tab

Notes Tab

Advanced Tab

Toolbar

Viewing a Detailed Report for the Affected Pair

Acknowledging a Ticket

Clearing a Ticket

Removing a Ticket

Ticket Status in the Ticket Pane

Generated Ticket

Cleared Ticket

Acknowledged Ticket

Generated Up Ticket

Clearing and Removing Tickets


Working with Tickets


This chapter describes how Cisco ANA NetworkVision correlates alarms and how to view the tickets and ticket properties, including correlated alarms, active alarms and alarm history. In addition, it describes ticket management, for example, acknowledging a ticket.

About Alarms, describes the ability to correlate related alarms and detect the root cause.

Filtering Tickets by Device, describes how to filter the tickets that are shown in the ticket pane so that only the tickets of a selected device or network element are displayed.

Filtering Tickets by Criteria, describes how to filter the tickets that are shown in the ticket pane according to various criteria.

Opening Ticket Properties, describes how to view ticket properties.

Viewing a Detailed Report for the Affected Pair, describes how to view a detailed report for every affected pair.

Acknowledging a Ticket, describes how to acknowledge tickets using the ticket pane.

Clearing a Ticket, describes how to clear a ticket.

Removing a Ticket, describes how to remove a ticket.

Ticket Status in the Ticket Pane, describes the different ways in which a ticket is displayed in the ticket pane depending on the status or severity of the alarm and what affect manipulating the ticket has on the way in which the ticket is displayed in the ticket pane.

Cisco ANA NetworkVision enables you to view and acknowledge tickets using the ticket pane. For more information, see Ticket Pane.

About Alarms

Cisco ANA provides the ability to correlate related alarms and events and accurately detect the root cause. The following scenarios are supported by Cisco ANA and illustrate alarm correlation:

Correlating an event to the actual network element that created the event, that is a device, interface, and so on.

Correlating a clearing alarm with its fault alarm, for example, a link up with a link down.

Correlating a set of events into a single network failure, for example, multiple events of port down with a related module-out event.

Correlating side-effect events with a single root-cause alarm across the network, for example, OSPF neighbor-down syslog message with a link-down alarm.

Correlating loss of reachability to a device with a network failure.

For more information about the definition of a ticket, alarm, and event, see Events, Tickets and Alarm Definitions.

For more information about alarms, refer to the Cisco Active Network Abstraction Fault Management User Guide.

For more specific information on tickets, including fault and IP correlation, MPLS-TE (Traffic Engineering), refer to the Cisco Active Network Abstraction Managing MPLS User Guide.

Alarm Life-Cycle

Cisco ANA NetworkVision correlates all the subalarms to the original parent alarm (root-cause alarm), and changes its status accordingly.

Cisco ANA provides for an aging period before closing alarms. The alarm may remain open for correlation even if it has already been cleared or acknowledged. In other words, for a specified aging period, new correlated alarms are accepted into a parent alarm even after the parent alarm has been cleared or acknowledged.

An alarm is considered closed after the parent alarm has been cleared and the aging period has passed even if the parent alarm still contains open correlated alarms.

Accumulating Affected Parties

When a fault occurs, Cisco ANA automatically calculates the affected parties (automatic impact analysis), for example, when a link goes down and embeds this information in the ticket along with all the correlated faults. You can view a list of all the inter-site connections that are affected and the sites that have lost connectivity. For more information about proactive impact analysis, see Viewing Impact Analysis.

The Affected Parties tab displays the services (affected pairs) that are potentially affected (automatic impact analysis) by the ticket. For more information about the Affected Parties tab, see Affected Parties Tab.

In the example below the following types of alarms exist in the correlation tree:

Ticket root-cause alarm (card out).

An alarm which is correlated to the root cause and has other alarms correlated to it (link A down).

An alarm with no other alarms correlated to it (link B down and BGP neighbor loss).

An event sequence is correlated to each of these alarms.

Figure 8-1 Event Sequence Example

For each type of alarm Cisco ANA NetworkVision provides a report of the affected parties. This report includes the accumulation of:

The affected parties reported on all the events in the alarm event sequence (this also applies to flapping alarms).

The affected parties reported on the alarms that are correlated to it.

Each report includes the accumulation of the affected report of all the events in its own correlation tree.

For example, in the diagram:

"BGP neighbor loss" includes the accumulation of the affected report of its own event sequence.

"Link A down" includes the accumulation of the report of its own event sequence. In addition, it includes the report of the BGP neighbor loss.

Accumulating the Affected Parties in an Alarm

When there are two events that form part of the same event sequence in a specific alarm the reoccurring affected pairs are only displayed once in the Affected Parties tab. Where there are different affected severities reported for the same pair, the pair is marked with the severity that was reported by the latest event, according to the time stamp.

Accumulating the Affected Parties in the Correlation Tree

Where there are two or more alarms:

That are part of the same correlation tree,

That report on the same affected pair of edge points and,

That have different affected severities.

Then the reoccurring affected pairs are only displayed once in the Affected Parties tab. Where there are different affected severities reported for the same pair, the pair is marked with the highest severity.

In this example X and Y are the OIDs of edge points in the network and there is a service running between them. Both of the alarms "Link B down" and "BGP neighbor loss" report on the pair "X<->Y" as affected:

"Link B down" reports on "X<->Y" as "Potentially" affected.

"BGP neighbor loss" reports on "X<->Y" as "Real" affected.

The affected severity priorities are:

Real - Priority 1

Recovered - Priority 2

Potentially - Priority 3

"Card out" reports on "X<->Y" as "Real" affected only once.

Updating Affected Severity Over Time

Cisco ANA has the ability to update the affected severity of the same alarm (report) over time due to the fact that in some cases the affect of the fault on the network cannot be determined until the network has converged.

For example, a link-down alarm creates a series of affected severity updates over time. These updates are added to the previous updates in the system database. In this case the system provides the following reports:

The first report of a link down reports on "X<->Y" as Potentially affected.

Over time the VNE identifies that this service is Real affected or Recovered and generates an updated report.

The Affected Parties tab of the Ticket Properties dialog box displays the latest severity which is Real affected.

The Affected Parties Destination Properties dialog box displays both reported severities.

This functionality is currently only supported for link down.

Filtering Tickets by Device

Cisco ANA NetworkVision enables you to filter the tickets that are shown in the ticket pane so that only the tickets of a selected device or network element are displayed.

To filter tickets for a specific network element:


Step 1 Right-click on the required device or network element in the tree pane or map pane of the Cisco ANA NetworkVision window to display the Device shortcut menu.

Step 2 Select Filter Tickets. The ticket pane displays the tickets of the selected device or network element only.


Note The Filter button in the ticket pane toggles to indicate that a filter has been applied.



The filter can be removed to display all the tickets in the system. For more information about removing a filter, see Filtering Tickets by Criteria.

Filtering Tickets by Criteria

Cisco ANA NetworkVision enables you to define a filter for the tickets displayed in the ticket pane according to various criteria; for example, tickets can be filtered according to the number of affected parties or acknowledged tickets.

To define the ticket filter:


Step 1 On the toolbar of the ticket pane, click Ticket Filter. The Ticket Filter dialog box is displayed.

Figure 8-2 Ticket Filter Dialog Box

The Severity area in the Ticket Filter dialog box enables the user to filter the tickets displayed in the ticket pane by selecting one or more options. For more information about severities, see Status of Network Objects.

The checkboxes displayed in the Other area reflect the columns displayed in the ticket pane and enable the user to filter the tickets according to any of these criteria. For more information about the columns displayed in the ticket pane, see Ticket Pane.

The Source checkbox (selected by default) enables the user to filter the tickets that are shown in the ticket pane so that only the tickets of a selected device or network element are displayed by selecting a source.

Step 2 Select the required filter values.

Step 3 Click OK. The filtered tickets are displayed in the ticket pane according to the defined criteria.


Note The Ticket Filter button in the ticket pane toggles to indicate that a filter has been applied.



To remove the ticket filter:


Step 1 On the toolbar of the ticket pane, click Ticket Filter. The Ticket Filter dialog box is displayed.

Step 2 Click Clear. The selected options in the Ticket Filter dialog box are cleared.

Step 3 Click OK. All the tickets are displayed in the ticket pane.


Opening Ticket Properties

The properties of a selected ticket can be viewed by displaying the Ticket Properties dialog box. For example, you can view alarm severity, correlated alarms, active alarms, alarm history or the source of the alarm.

To open ticket properties:


Step 1 Double-click on the required ticket in the ticket pane.

or

Right-click on a ticket in the ticket pane to display the Ticket shortcut menu, select Properties.

The Ticket Properties dialog box is displayed.

Figure 8-3 Ticket Properties Dialog Box

The information displayed in the Ticket Properties dialog box corresponds with the information displayed in the ticket pane. The ID number displayed in the header corresponds to the ID number of the ticket selected in the ticket pane.

The Ticket Properties dialog box is divided into the following areas:

Tabbed Pane

Toolbar


Tabbed Pane

The Ticket Properties dialog box is divided into the following tabs:

General—General information about the selected ticket, see General Tab.

History—The history of the ticket, see History Tab.

Affected Parties—The services (affected pairs) that are potentially affected (potential impact analysis) by the ticket, see Affected Parties Tab.

Correlation—All the alarms that are correlated to the selected ticket, see
Correlation Tab.

Notes—Enables you to add notes to the selected ticket, see Notes Tab.

Advanced—All the affected devices, correlation, duplication and reduction counts for the selected ticket. In addition, it provides any other additional information available about the ticket, see Advanced Tab.

General Tab

The following fields are displayed in the General tab providing information about the compiled alarm:

Alarm—The supported root-cause alarm name, for example, link down.

Location—The entity that triggered the root-cause alarm, as a hyperlink that opens the relevant location.

Severity—Displays the severity that was propagated from all the correlated alarms. For more information, see Map Pane.

Time—The date and time when the initial root-cause alarm was generated. The time is taken from Cisco ANA.

Open Alarms—The number of correlated alarms for the ticket that are open. For example, 3 / 4. Four relates to the total number of correlated alarms for the ticket. Three indicates the number of alarms that have not been cleared, and therefore there is one alarm that is cleared.

Acknowledged—The status of the ticket that is being handled, namely, acknowledged (true) and unacknowledged (false).

Description—The detailed description from the ticket.

History Tab

The History tab enables you to display the history of the ticket, including all the events. The History tab is displayed.

Figure 8-4 History Tab

The following columns are displayed in the History tab providing information about the compiled alarm:

Severity—Displays a severity bell icon, which is colored according to the severity of the alarm.

Alarm ID—The ID number of the event that changed the ticket.

Duplication Count—The number of occurrences of the root alarm in a successors sequence. For example, link down, link up, link down would equal a duplication counter of 2.

Short Description—A description of the event.

Reduction Count—The number of alarms displayed under the ticket. For example, nine alarms may be viewed in the History tab accessed from the NetworkVision ticket pane, whereas, only a single ticket is displayed in the ticket pane.

Location—The entity that triggered the alarm, as a hyperlink that opens the relevant location.

Time—The date and time when the ticket changed.

Affected Parties Tab

When a fault occurs Cisco ANA automatically calculates the affected parties (automatic impact analysis), for example, when a link goes down, and embeds this information in the ticket along with all the correlated faults. You can view a list of all the endpoints that are affected. For more information about proactive impact analysis, see Viewing Impact Analysis.

The Affected Parties tab displays the service resources (affected pairs) that are affected (automatic impact analysis) by the ticket. For more information about accumulating affected parties, see Accumulating Affected Parties.

The Affected Parties tab is displayed.

Figure 8-5 Affected Parties Tab

The Affected Parties tab is divided into two areas, namely, Source and Destination. The Source area displays the set of affected elements (A side and Z side). The following columns are displayed in the Affected Parties tab providing information about the affected parties:

Location—A hyperlink that opens the Inventory window, highlighting the port with the affected parties.

Key—The unique value taken from the affected element's business tag key (if it exists).

Name—The subinterface (site) name or business tag name of the affected element (if it exists). For more information refer to the Cisco Active Network Abstraction Managing MPLS User Guide.

Type—The business tag type.

IP Address—If the affected element is an IP interface the IP address of the subinterface (site) is displayed. For more information refer to the Cisco Active Network Abstraction Managing MPLS User Guide.

Highest Affected Severity—The severest affected severity for the affected pair (Destination). The same source can be part of multiple pairs, and therefore each pair can have different affected severities. The highest affected severity reflects the highest one among these. The affected pair can have one of the following severities:

Potential—The service may be affected but its real state is not known.

Real—The service is affected.

Recovered—The service was recovered after the network fault. This state only applies to affected pairs that were previously marked as Potentially Affected or Real Affected.

N/A—From Links view this indicates not relevant.

When an affected side (a row) is selected in the Source area the selected element's related affected pairs are displayed in the Destination area.

The following additional columns are displayed in the Destination area table in the Ticket Properties window:

Affected Severity—The severity of the affected pair as calculated by the client according to the rules defined in Accumulating Affected Parties.

Alarm Clear State—An indication for each pair of the clear state of the alarm. The following states exist:

Not Cleared—There are one or more alarms that have not been cleared for this pair.

Cleared—All the related alarms for this pair have been cleared.

In addition, you can view a detailed report for every affected pair that includes a list of the events that contributed to this affected pair. For more information about viewing a detailed report, see Viewing a Detailed Report for the Affected Pair.

Correlation Tab

The Correlation tab displays all the alarms that are correlated to the selected ticket.

Figure 8-6 Correlation Tab

Each branch provides a short description of the alarm, a severity icon, ID, location, and time of the alarm. For more information about the columns displayed in the Correlation tab, see Ticket Pane.

The following columns are displayed in the Correlation tab providing information about the alarm as follows:

ID—The ID number of the alarm. The branches can be expanded and collapsed in order to hide information as needed.

Short Description—A description of the change in the ticket. The full description is displayed in the lower tab area.

Location—A hyperlink that opens the Inventory window, selecting the node with the affected parties.

Time—The date and time the alarm was issued.

Last Modification Time—The date and time when the alarm changed.

Reduction Count—The number of alarms displayed under the ticket. For example, nine alarms may be viewed in the History tab accessed from the NetworkVision ticket pane, whereas, only a single ticket is displayed in the ticket pane.

Duplication Count—The number of occurrences of the root alarm in a successors sequence. For example, link down, link up, link down would equal a duplication counter of 2.

The Find field on the toolbar enables you to search for information in the Correlated Alarms table.

Notes Tab

The Notes tab enables you to add and save notes for the selected ticket. The Notes tab is displayed below.

To add text, enter text in the Notes field and click Save Notes. The new text is added to any previously existing text.


NoteSave Notes is only enabled when text is entered in the Notes field.

The text cannot be edited or removed once you have saved the notes.


Advanced Tab

The Advanced tab enables you to view all the affected devices, correlation, duplication and reduction counts for the selected ticket. In addition, it provides any other additional information available about the ticket. The Advanced tab is displayed below.

The following fields are displayed in the Advanced tab providing information about the compiled alarm:

Successor—A hyperlink to the successor event (if it exists), for example, port up.

Correlator—A hyperlink to the correlator alarm (if it exists).

Predecessor—A hyperlink to the predecessor event (if it exists), for example, port down.

Affected Devices—The number of devices affected by the ticket (the source(s) of the alarm and their subsequent alarms).

Duplication Count—Displays the number of occurrences of the original root-cause alarm included in the ticket. For example, if the ticket was created by a link-down root-cause alarm, and then the link goes up and down again quickly so that it is included in the same ticket, then the duplication counter displays the number 2, as the root-cause alarm occurred twice.

Correlation Count—Displays the number of correlated alarms included in the ticket. For example, if in the Correlation tab of the Ticket Properties, there are 3 alarms correlated to the root-cause alarm, then the counter displays the number 3. If there are 2 alarms correlated to the root-cause alarm, and each alarm in turn has 2 alarms correlated to it, then the counter displays the number 4.

Reduction Count—Displays the number of alarms included in the ticket. For example, nine alarms can be viewed in the History tab of the Ticket Properties window, but only a single ticket is displayed in the ticket pane.

Toolbar

The Ticket Properties dialog box contains the following tools:

Refreshes the information displayed in the Ticket Properties dialog box.

Acknowledge—Acknowledges that the ticket is being handled and the status of the ticket is displayed as true in the ticket pane and in the Ticket Properties dialog box. For more information, see Acknowledged Ticket.

If a ticket was acknowledged, and some events were correlated to it afterwards, then the ticket is considered to have been NOT acknowledged.

Note This button is only enabled if the ticket is not acknowledged.

Clear—Requests the relevant Cisco ANA to remove the faulty network element from the Cisco ANA networking inventory. In addition, it sets the ticket to Cleared severity or status (the icon is displayed in green) and automatically changes the acknowledged status of the ticket to true. For more information, see Cleared Ticket.

Note This button is only enabled if the severity of the alarm is higher than Cleared or Normal.

Save Notes—Saves the notes for the selected ticket.

Note This button is only enabled when text is entered in the Notes field of the Notes tab.


Viewing a Detailed Report for the Affected Pair

Cisco ANA NetworkVision enables you to view a detailed report for every affected pair. The detailed report includes a list of the events that contributed to the affected pair.

To open a detailed report:


Step 1 Open the Ticket Properties dialog box for the required ticket, see Opening Ticket Properties.

Step 2 Select the Affected Parties tab. The Affected Parties tab is displayed in the Ticket Properties dialog box.

Step 3 Select an affected side (a row) in the Source area table of the Ticket Properties dialog box. The selected element's related affected pairs are displayed in the Destination area.

Step 4 Select one of the element's affected pairs in the Destination area table of the Ticket Properties dialog box.

Step 5 Right-click to display the shortcut menu, and select Detailed Report, or double-click on the affected pair. The Affected Parties Destination Properties dialog box is displayed.

The following fields are displayed at the top of the Affected Parties Destination Properties dialog box:

Affected Pair—The details of A side and Z side of the affected pair.

Alarm Clear State—An indication for each pair of the clear state of the alarm. The following states exist:

Not Cleared—There are one or more alarms that have not been cleared for this pair.

Cleared—All the related alarms for this pair have been cleared.

Affected Severity—The severity of the affected pair as calculated by the client according to the rules defined in Accumulating Affected Parties.

Name—The name of the destination from which you opened the detailed report.

Each row in the Instances table represents an event that was reported for the affected pair. The following columns are displayed in the Instances table of the Affected Parties Destination Properties dialog box:

Alarm OID—The ID of the alarm to which the event is correlated as a hyperlink to the relevant alarm's properties.

Alarm Description—A description of the alarm to which the event is correlated.

Alarm Clear State—The alarm's calculated severity.

Event OID—The ID of the event as a hyperlink to the relevant event's properties.

Event Description—A description of the event.

Event Time Stamp—The event's time stamp. The date and time of the event.

Affected Severity—The actual affected severity of the pair that was reported by the selected event. For more information, see Affected Parties Tab.

Step 6 Click to close the Affected Parties Destination Properties dialog box. The Ticket Properties dialog box is displayed.


Acknowledging a Ticket

When an alarm occurs, a warning or ticket is displayed in the ticket pane. Cisco ANA NetworkVision enables you to handle the status of a ticket by acknowledging it. This acknowledges the fault.

The change is reported to the Cisco ANA Gateway and all open Cisco ANA NetworkVision applications. Several tickets can be acknowledged at the same time. For more information, see Ticket Status in the Ticket Pane.


Note Rule-based alarms can be configured per customer site or upon request.


An acknowledged ticket will change back to not acknowledged when a new event is correlated to it. You cannot undo this operation. To acknowledge a ticket:


Step 1 Right-click on a ticket in the ticket pane. The Ticket shortcut menu is displayed.

Step 2 From the Ticket shortcut menu, select Acknowledge.

or

Click Acknowledge in the Ticket Properties dialog box.

The ticket is handled as described above.


Clearing a Ticket

When an alarm occurs a warning or ticket is displayed in the ticket pane. Cisco ANA NetworkVision enables you to handle the reported ticket by verifying the report of what is faulty and clearing the faulty network element. The change is reported to the Cisco ANA Gateway and all open Cisco ANA NetworkVision applications. This operation cannot be reversed.

Clearing an open ticket performs the following operations:

Sends a request to the Cisco ANA system to remove the faulty network element from the Cisco ANA networking inventory.

Sets the alarm to Cleared or Normal severity or status by issuing a corresponding Clear alarm.

Automatically sets the alarm severity or status to acknowledged (true).


Note When a Card Out or link-down alarm occurs the relevant information is displayed in the inventory and maintained in the VNE.


To clear a ticket:


Step 1 Right-click on a ticket in the ticket pane. The Ticket shortcut menu is displayed.

Step 2 From the Ticket shortcut menu, select Clear.

or

Click Clear in the Ticket Properties dialog box.

The ticket is handled as described above.

For more information, see Ticket Status in the Ticket Pane.


Removing a Ticket

When an alarm occurs a warning or ticket is displayed in the ticket pane. Cisco ANA NetworkVision enables you to completely remove the ticket and all its active alarms and business tags. The change is reported to the Cisco ANA Gateway and all open Cisco ANA NetworkVision applications. In addition, several tickets can be removed at the same time. When a ticket has been cleared or when an `Up Alarm' occurs then the ticket can be removed. This operation cannot be reversed. A ticket that has been removed can only be viewed using Cisco ANA EventVision.

Removing an alarm performs the following operations:

Sends a request to the Cisco ANA system to remove the faulty network element from the Cisco ANA networking inventory.

Archives the ticket, and active alarms.

Removes the ticket from the Cisco ANA NetworkVision ticket pane.

Notifies all the open Cisco ANA NetworkVision applications of the removal.


Note Only tickets with a Cleared/Normal or Information severity can be removed.


To remove a ticket:


Step 1 Right-click on a ticket in the ticket pane. The Ticket shortcut menu is displayed.

Step 2 From the Ticket shortcut menu, select Remove.

The ticket is handled as described above.

For more information, see Ticket Status in the Ticket Pane.


In addition, an uncleared ticket (which has a severity higher than Cleared or Normal) can be cleared and removed by right-clicking in the ticket pane and selecting Clear and Remove. For more information about the Ticket shortcut menu, see Ticket Shortcut Menu.

Ticket Status in the Ticket Pane

The appearance of a ticket displayed in the ticket pane depends on the status or severity of the (ticket) alarm and what affect manipulating the ticket has on the way in which the ticket is displayed in the ticket pane.

Tickets detailed in the ticket pane change when a:

Ticket is generated.

Ticket is cleared.

Ticket is acknowledged.

`Up Ticket' is generated.

Ticket is cleared and removed.

Ticket is removed.

Some other properties are updated, for example, severity, description, counters and so on.

Generated Ticket

An example of the appearance of the ticket pane when a ticket is generated is displayed.

Table 8-1 Generated Ticket

Severity
Ticket ID
Short Description
Acknowledged

Major

27

Port down

False (Not Acknowledged)


Cleared Ticket

An example of the appearance of the ticket pane when a ticket is cleared is displayed.

Table 8-2 Cleared Ticket

Severity
Ticket ID
Short Description
Acknowledged

Normal

27

Cleared due to Force Clear

True (Acknowledged)


A ticket that has been cleared can then be removed from the ticket pane. For more information, see Removing a Ticket.

When a ticket is cleared, its definition changes to acknowledged automatically in the ticket pane and its definition in the Acknowledged column is True.

Acknowledged Ticket

An example of the appearance of the ticket pane when a ticket is acknowledged is displayed below. When a ticket is acknowledged it can then be cleared and the severity changes to Normal.

Table 8-3 Acknowledged Ticket

Severity
Ticket ID
Short Description
Acknowledged

Major

27

Port up

True



Note When a ticket with an Information severity is acknowledged, the ticket is automatically removed from the Cisco ANA Gateway and from the ticket pane.


Generated Up Ticket

The cause of the alarm is fixed; therefore an `Up Ticket' is automatically generated with a Normal severity. An example of the appearance of the ticket pane when an `Up Ticket' is generated is displayed.

Table 8-4 Generated Up Ticket

Severity
Ticket ID
Short Description
Acknowledged

Normal

27

Port up

True


Clearing and Removing Tickets

Approves the reported faulty ticket and clears the faulty networking entity from Cisco ANA.