False Positive alerts in DFM

Unanswered Question
Jul 22nd, 2008
User Badges:

I'm getting the following alert on one of our 6500's


Here is the alert:

EVENT ID = 0000UGP

ALERT ID = 00006IE

TIME = Tue 22-Jul-2008 03:34:28 EDT

STATUS = Active

SEVERITY = Critical

MANAGED OBJECT = bs029sws01.corp.citistreet.org

MANAGED OBJECT TYPE = Switches and Hubs

EVENT DESCRIPTION = OperationallyDown::Component=IF-bs029sws01.corp.citistreet.org/328 [Lo0] [172.18.254.247];ComponentClass=Interface;ComponentEventCode=1075;Type=SOFTWARELOOPBACK;IsFlapping=false;AdminStatus=UP;MaxSpeed=8000000000;OperStatus=DOWN;InterfaceCode=CODEUNK

CUSTOMER IDENTIFICATION = Networkers


I did a show logging and I see nothing in regards to what the alert is stating.


Please advise.

  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 0 (0 ratings)
Loading.
Joe Clarke Tue, 07/22/2008 - 08:28
User Badges:
  • Cisco Employee,
  • Hall of Fame,

    Founding Member

This might only be visible by SNMP, and would point to a bug on the device. Try polling the ifOperStatus of Lo0 to see if it is going down. If the event has since cleared, it may be that the problem was transient, and you'll need a sniffer trace of DFM's polling to catch it again.

dionjiles Tue, 07/22/2008 - 09:53
User Badges:

Hi JClarke,


It seems to be a pattern the alert kicked off around 03:34 Monday am and 03:34 Tuesday am and it clears 4 minutes later. The polling interval is set for 240 seconds.

Joe Clarke Tue, 07/22/2008 - 09:55
User Badges:
  • Cisco Employee,
  • Hall of Fame,

    Founding Member

You'll need to start a sniffer trace around that time to capture what DFM is polling. If the switch is really saying Lo0 is down, then we have a device bug. Else there's a problem with DFM.

dionjiles Tue, 07/22/2008 - 10:11
User Badges:

Thanks for the info if it does the same thing in the morning. I will definitely put a sniffer on it to see what's going on during that time frame.

Actions

This Discussion