cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
1531
Views
10
Helpful
11
Replies

LMS 2.6 - How to remove false alarms

acalligher
Level 1
Level 1

Hello

I receive from DFM a Duplicate IP address alarm from 2 differents devices (router1 &2).

I have removed from router2 the duplicate IP address (it was on a shutdown interface) but DFM continue to send alarm from both devices (router1 &2).

I have restarted LMS without success.

Other info: when I search this IP address into the RME config database, I find it correctly only into router1.

DFM make a device rediscovery every week

Best Regards

Andrea

11 Replies 11

Joe Clarke
Cisco Employee
Cisco Employee

Since you have LMS 2.6, you can manually clear the event from AAD. Just click on the Alert ID in AAD, and you should see the Duplicate Event in the resulting window. Click on the Event ID, then click the Clear button. The event will then stay in AAD for 20 minutes then it will disappear, and can be found in Fault History for 30 days.

Hello

I have do so, but when I restart the LMS (for other raisons) the alarm come out again...and I have to clear another time...

No way to remove completly the alarm?

Bye

Andrea

Not unless the IP address is truly removed from the network, or the interface that has that IP address is unmanaged in the Detailed Device View.

No, there is something strange about the way DFM keeps sending these alarms. I have this situation now for a number of reasons.

First, I was using a pix 501 to perform a NAT function on a test network in order to stage and configure some new switches. This allowed me to config the switches their production IP, yet allowed me to access them via a bogus NATed address. The result is that the 501 at various times had an address on its inside interface that duplicated one of 4 address on the production network. Although the pix has since had it's address changed back to its original unique address, DFM still complains that the pix has a duplicate address with the production switches - all 4 of them. I can clear the alerts, but they will come back.

Also, I have deployed the switches that I staged into the production network. The addresses that they have in many cases matched an address of one of the switches that they replaced. The old switches have been deleted from Ciscoworks common services, and I have verified that they are also removed from the DFM device repository. However, the AAD STILL complains that the IPs on the new switches conflict with the old ones that are no longer in the system.

One other situation that I have problems with DFM AAD and duplicate addresses. I have several ASAs on our internal network that at this time have no failover mechanism. To mitigate the risk of a failure of one of these devices, I have configured the IP addresses of the internal interfaces on shut-down interfaces of layer 3 switches. The purpose of this is so that in the event of an ASA failure, I can bring up the interfaces on the switches and continue to run, albeit in an unprotected mode. DFM complains about these shutdown interfaces as being duplicates. I would unmanage them, but the alert is for the ASA and not the switches with the shut down interfaces. I don't know how to unmanage these interfaces when the device doesn't show up in AAD.

I even tried reinitializing the EPM database, and these alarms still return after a restart.

1) net stop crmdmgtd

2) cd \program files\CSCOpx\bin

3) perl dbRestoreOrig.pl dsn=dfmEpm dmprefix=EPM

4) net start crmdmgtd

I don't get it. I am getting duplicate IP alerts for devices that no longer exist on the network, are not in the common services DB, and no longer exist within the DFM device list. I've wiped out EPM and they still return. Where are these stored?

You can't simply wipe out EPM. EPM is only a Cisco copy of what is in the EMC DFM database. If you want to completely start over in DFM, you need to reinitialize all four DFM databases:

dfmEpm

dfmInv

dfmFh

Then delete the NMSROOT/objects/smarts/local/repos/DFM.rps file. Only then will DFM be able to start from scratch.

after suggest of TAC I reinitialized the

perl dbRestoreOrig.pl dsn=dfmEpm dmprefix=EPM

perl dbRestoreOrig.pl dsn=dfmInv dmprefix=INV

perl dbRestoreOrig.pl dsn=dfmFh dmprefix=FH

But at this moment I haven't resolved the problem

bye

andrea

There are two people with different issues on this thread. Since you started the thread, I'll focus on your issues, and jedavis can start a new thread.

When you reinitialized the databases, did you delete the DFM.rps file as I said to do previously? This is a vital step. After reinitializing the databases, I assume you're still getting the duplicate events? Are those duplicate IP addresses still in the network?

Well no, not exactly. I have the exact same issue as acalligher. I found this thread after having thrown out a search for "dfm duplicate address" to see if there was a solution already posted.

I assume that the EPM database is where the alerts are stored, and that the INV DB is the inventory store. What is the FH DB and the DFM.rps file?

At this point, I do not think your issues are exactly the same, and I don't want to confuse things. Please start a new thread, and I will address your questions there.

Ok well reinitializing the DFM DBs as per your instructions solved the first two of my problems listed in my previous post. It was a little painful, as I had to go back in and suspend various devices and interfaces. It also took me a little while to figure out how to inhibit the ExceededMaximumUptime alerts again, but I got 'er done.

Thanks for your help!

Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community:

Innovations in Cisco Full Stack Observability - A new webinar from Cisco