Cisco Works unexplainable alerts LMS 3.1

Unanswered Question

Start are job to change something on a device Like SNMP Community Strings. I create a Netconfig job to make the change, the change happens and I start to receive a bunch of alerts from device. I will enter a few here for reference.


EVENT ID = 0001H7C

ALERT ID = 000025B

TIME = Wed 15-Apr-2009 10:37:27 EDT

STATUS = Active

SEVERITY = Critical

MANAGED OBJECT = 10.1.32.1

MANAGED OBJECT TYPE = Routers

EVENT DESCRIPTION = OperationallyDown::Component=CARD-10.1.32.1/1 [0] [c2851 Motherboard with 2GE and integrated VPN];ComponentClass=Card;ComponentEventCode=1073;SystemName=10.1.32.1;Status=NOTPRESENT;Description=c2851 Motherboard with 2GE and integrated VPN;StandbyStat



EVENT ID = 0001H7E

ALERT ID = 000025B

TIME = Wed 15-Apr-2009 10:37:27 EDT

STATUS = Active

SEVERITY = Critical

MANAGED OBJECT = 10.1.32.1

MANAGED OBJECT TYPE = Routers

EVENT DESCRIPTION = OperationallyDown::Component=CARD-10.1.32.1/3 [0/1] [2nd generation two port FXO voice interface daughtercard];ComponentClass=Card;ComponentEventCode=1073;SystemName=10.1.32.1;Status=NOTPRESENT;Description=2nd generation two port FXO voice interface


This looks like the hardware on the router is there. But the device is working correctly. PLease provide assistance.



  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 0 (0 ratings)
Loading.
Joe Clarke Wed, 04/15/2009 - 09:21
User Badges:
  • Cisco Employee,
  • Hall of Fame,

    Founding Member

It looks like for at least one polling cycle, the device reported that these cards were no longer present in the device. Are these events still active now?

Ciscoworks geneates the alerts and they are sent to email and when I go look at the alert on the portal under Network I see the alert for the device and when I open the alert all of the operationally down or other alerts are there I acknowledge or clear them and it goes away.

But if you see 20 or 30 alerts for the same device because it looks like every card or interface show not available for a time? Is that a correct assumption?


Joe Clarke Wed, 04/15/2009 - 12:58
User Badges:
  • Cisco Employee,
  • Hall of Fame,

    Founding Member

It appears that for whatever reason, the device responded with an SNMP value that made DFM think the module was no longer present. We have seen these things from time to time, but they are generally transient, and the events clear on their own. If the events are still active, then could be an SNMP issue on the device.


If you've manually cleared these events, do they come back?

Joe Clarke Wed, 04/15/2009 - 15:10
User Badges:
  • Cisco Employee,
  • Hall of Fame,

    Founding Member

If you can reproduce, it would be useful to see a sniffer trace of SNMP traffic between the server and device when DFM throws these events.

Actions

This Discussion