False Positive alerts in DFM

dionjiles · ‎07-22-2008

I'm getting the following alert on one of our 6500's

Here is the alert:

EVENT ID = 0000UGP

ALERT ID = 00006IE

TIME = Tue 22-Jul-2008 03:34:28 EDT

STATUS = Active

SEVERITY = Critical

MANAGED OBJECT = bs029sws01.corp.citistreet.org

MANAGED OBJECT TYPE = Switches and Hubs

EVENT DESCRIPTION = OperationallyDown::Component=IF-bs029sws01.corp.citistreet.org/328 [Lo0] [172.18.254.247];ComponentClass=Interface;ComponentEventCode=1075;Type=SOFTWARELOOPBACK;IsFlapping=false;AdminStatus=UP;MaxSpeed=8000000000;OperStatus=DOWN;InterfaceCode=CODEUNK

CUSTOMER IDENTIFICATION = Networkers

I did a show logging and I see nothing in regards to what the alert is stating.

Please advise.

Joe Clarke · ‎07-22-2008

This might only be visible by SNMP, and would point to a bug on the device. Try polling the ifOperStatus of Lo0 to see if it is going down. If the event has since cleared, it may be that the problem was transient, and you'll need a sniffer trace of DFM's polling to catch it again.

dionjiles · ‎07-22-2008

Hi JClarke,

It seems to be a pattern the alert kicked off around 03:34 Monday am and 03:34 Tuesday am and it clears 4 minutes later. The polling interval is set for 240 seconds.

Joe Clarke · ‎07-22-2008

You'll need to start a sniffer trace around that time to capture what DFM is polling. If the switch is really saying Lo0 is down, then we have a device bug. Else there's a problem with DFM.

dionjiles · ‎07-22-2008

Thanks for the info if it does the same thing in the morning. I will definitely put a sniffer on it to see what's going on during that time frame.