LMS 2.6 - How to remove false alarms

Unanswered Question
Sep 3rd, 2007


I receive from DFM a Duplicate IP address alarm from 2 differents devices (router1 &2).

I have removed from router2 the duplicate IP address (it was on a shutdown interface) but DFM continue to send alarm from both devices (router1 &2).

I have restarted LMS without success.

Other info: when I search this IP address into the RME config database, I find it correctly only into router1.

DFM make a device rediscovery every week

Best Regards


I have this problem too.
0 votes
  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 5 (2 ratings)
Joe Clarke Mon, 09/03/2007 - 08:32

Since you have LMS 2.6, you can manually clear the event from AAD. Just click on the Alert ID in AAD, and you should see the Duplicate Event in the resulting window. Click on the Event ID, then click the Clear button. The event will then stay in AAD for 20 minutes then it will disappear, and can be found in Fault History for 30 days.

acalligher Mon, 09/03/2007 - 12:25


I have do so, but when I restart the LMS (for other raisons) the alarm come out again...and I have to clear another time...

No way to remove completly the alarm?



Joe Clarke Mon, 09/03/2007 - 12:54

Not unless the IP address is truly removed from the network, or the interface that has that IP address is unmanaged in the Detailed Device View.

jedavis Thu, 11/08/2007 - 10:37

No, there is something strange about the way DFM keeps sending these alarms. I have this situation now for a number of reasons.

First, I was using a pix 501 to perform a NAT function on a test network in order to stage and configure some new switches. This allowed me to config the switches their production IP, yet allowed me to access them via a bogus NATed address. The result is that the 501 at various times had an address on its inside interface that duplicated one of 4 address on the production network. Although the pix has since had it's address changed back to its original unique address, DFM still complains that the pix has a duplicate address with the production switches - all 4 of them. I can clear the alerts, but they will come back.

Also, I have deployed the switches that I staged into the production network. The addresses that they have in many cases matched an address of one of the switches that they replaced. The old switches have been deleted from Ciscoworks common services, and I have verified that they are also removed from the DFM device repository. However, the AAD STILL complains that the IPs on the new switches conflict with the old ones that are no longer in the system.

One other situation that I have problems with DFM AAD and duplicate addresses. I have several ASAs on our internal network that at this time have no failover mechanism. To mitigate the risk of a failure of one of these devices, I have configured the IP addresses of the internal interfaces on shut-down interfaces of layer 3 switches. The purpose of this is so that in the event of an ASA failure, I can bring up the interfaces on the switches and continue to run, albeit in an unprotected mode. DFM complains about these shutdown interfaces as being duplicates. I would unmanage them, but the alert is for the ASA and not the switches with the shut down interfaces. I don't know how to unmanage these interfaces when the device doesn't show up in AAD.

jedavis Tue, 11/13/2007 - 07:08

I even tried reinitializing the EPM database, and these alarms still return after a restart.

1) net stop crmdmgtd

2) cd \program files\CSCOpx\bin

3) perl dbRestoreOrig.pl dsn=dfmEpm dmprefix=EPM

4) net start crmdmgtd

I don't get it. I am getting duplicate IP alerts for devices that no longer exist on the network, are not in the common services DB, and no longer exist within the DFM device list. I've wiped out EPM and they still return. Where are these stored?

Joe Clarke Tue, 11/13/2007 - 07:53

You can't simply wipe out EPM. EPM is only a Cisco copy of what is in the EMC DFM database. If you want to completely start over in DFM, you need to reinitialize all four DFM databases:




Then delete the NMSROOT/objects/smarts/local/repos/DFM.rps file. Only then will DFM be able to start from scratch.

acalligher Tue, 11/13/2007 - 08:04

after suggest of TAC I reinitialized the

perl dbRestoreOrig.pl dsn=dfmEpm dmprefix=EPM

perl dbRestoreOrig.pl dsn=dfmInv dmprefix=INV

perl dbRestoreOrig.pl dsn=dfmFh dmprefix=FH

But at this moment I haven't resolved the problem



Joe Clarke Tue, 11/13/2007 - 08:12

There are two people with different issues on this thread. Since you started the thread, I'll focus on your issues, and jedavis can start a new thread.

When you reinitialized the databases, did you delete the DFM.rps file as I said to do previously? This is a vital step. After reinitializing the databases, I assume you're still getting the duplicate events? Are those duplicate IP addresses still in the network?

jedavis Tue, 11/13/2007 - 10:15

Well no, not exactly. I have the exact same issue as acalligher. I found this thread after having thrown out a search for "dfm duplicate address" to see if there was a solution already posted.

I assume that the EPM database is where the alerts are stored, and that the INV DB is the inventory store. What is the FH DB and the DFM.rps file?

Joe Clarke Tue, 11/13/2007 - 10:47

At this point, I do not think your issues are exactly the same, and I don't want to confuse things. Please start a new thread, and I will address your questions there.

jedavis Tue, 11/13/2007 - 17:11

Ok well reinitializing the DFM DBs as per your instructions solved the first two of my problems listed in my previous post. It was a little painful, as I had to go back in and suspend various devices and interfaces. It also took me a little while to figure out how to inhibit the ExceededMaximumUptime alerts again, but I got 'er done.

Thanks for your help!


This Discussion