CiscoWorks - Device fault manager HighUtilization Event every time

Unanswered Question
Jun 19th, 2008

I've got an issue with the device fault manager on CiscoWorks.

Basically, what i wanted to do was to stop the ExceededMaximumUptime reported to many times on all my routers (ADSL interface). I tried to do some tweaking but even if I don't have ExceededMaximumUptime anymore, a HighUtilization alert replaced it (with many more alert :-( ).

What I did :

Edited a customisable interface group.

create ruel expression : Interfaces.Type equals "ADSL"

Polling and Thresholds > Managing Thresholds > edit and set dial-on-demand interface support settings - maximum uptime to 0 (default value 7200).

settings priority > Interface Threshold Groups > putted the group on the first position. then saved the config.

I don't know what's wrong with that, but obviously it's not good.

I could set the HighUtilization value to 80 or more (default value : 40%) but i had some crazy value reported (more than 200% sometimes). So It's not relevant to change it.

Any help is more than welcome

Many Thanks

I have this problem too.
0 votes
  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 0 (0 ratings)
Loading.
Joe Clarke Thu, 06/19/2008 - 07:09

What you are seeing with the bogus highutilization could be a bug either on the device or in DFM. Start a sniffer trace filtering on udp/161 traffic to this router. When you get the bogus HighUtilization event, stop the trace. The last two polls should be interesting. Manually calculating the utilization on the interface (both in and out) will indicate whether the problem is with the device or with DFM.

nocrack21 Thu, 06/19/2008 - 07:21

I've got more than 50 routers (837, 877, 877W) on the group. It's probably not a bug device or too many cisco devices are bugged :) but I'll try anyway.

But don't you think I made a mistake on the configuration ?

Thanks

Joe Clarke Thu, 06/19/2008 - 07:29

The same bug could be affecting all of your devices. Based on what you said you did, I think your config is good. Modifying a custom group is the way to go in this case. The fact that you see bogus utilization is never a good thing, even if the config was totally wrong.

nocrack21 Thu, 06/19/2008 - 07:28

There are no available interfaces from which to capture the data.

Please make sure you have installed the WinPcap module. You may need to reboot to complete the installation.

Note: This tool only works with Ethernet interfaces.

I can't use packet capture, WinPcap is not installed on the server I guess.

And I can't reboot the server for the moment...

Any other solution to sniff the trafic ?

nocrack21 Thu, 06/19/2008 - 07:30

There are no available interfaces from which to capture the data.

Please make sure you have installed the WinPcap module. You may need to reboot to complete the installation.

Note: This tool only works with Ethernet interfaces.

I can't use packet capture, WinPcap is not installed on the server I guess.

And I can't reboot the server for the moment...

Any other solution to sniff the trafic ?

Joe Clarke Thu, 06/19/2008 - 07:36

We ship WinPcap with LMS, and you shouldn't need to reboot on Windows 2003. Go to NMSROOT\objects\jet\bin, and run the winpcap.exe.

nocrack21 Fri, 06/20/2008 - 03:14

I tried to use a new group (4) with exactly the same rule to capture the packets because I remove all the stuff on the old one (2) to stop those alerts for the night, and putted the group on the top of settings priority and it works fine... no more HighUtilization Alert, I don't understand...

And now when I try to use the old group (2), There is no more device on it, even if I recreate exactly the same rule ...

This is just crazy ! anyway, It works fine now.

thank you for your help

Actions

This Discussion